Journal
2011 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP 2011)
Volume -, Issue -, Pages 64-77Publisher
IEEE COMPUTER SOC
DOI: 10.1109/SP.2011.32
Keywords
hardware; security; attack
Funding
- National Science Foundation [CCF 0811268, CNS 0953014, CCF 0424422]
- AFOSR MURI [FA9550-09-01-0539]
Ask authors/readers for more resources
In previous work Hicks et al. proposed a method called Unused Circuit Identification (UCI) for detecting malicious backdoors hidden in circuits at design time. The UCI algorithm essentially looks for portions of the circuit that go unused during design-time testing and flags them as potentially malicious. In this paper we construct circuits that have malicious behavior, but that would evade detection by the UCI algorithm and still pass design-time test cases. To enable our search for such circuits, we define one class of malicious circuits and perform a bounded exhaustive enumeration of all circuits in that class. Our approach is simple and straight forward, yet it proves to be effective at finding circuits that can thwart UCI. We use the results of our search to construct a practical attack on an open-source processor. Our malicious backdoor allows any user-level program running on the processor to enter supervisor mode through the use of a secret knock. We close with a discussion on what we see as a major challenge facing any future design-time malicious hardware detection scheme: identifying a sufficient class of malicious circuits to defend against.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available