Improving the security of embedded software is the focus of CASA's Research Hub B, which includes work on protecting against hardware Trojans and developing side-channel resistance for future microprocessor designs. Hardware was long considered impregnable, but all hardware has firmware - that is, embedded software that controls its operation and may contain vulnerabilities leaving it open to attack. This area is critical to the discussions taking place in many countries about whether to ban Huawei from participating in building 5G networks and how to ensure that foreign-built hardware doesn't incorporate deliberately-inserted backdoors - "hardware Trojans".
History of hardware security
Hub leader Christof Paar noticed as long ago as 2007 that hardware security was under-researched; he is now building the research community he imagined was inevitable after seeing two researchers use only some sandpaper and a camera to extract the cryptographic keys embedded in an integrated circuit. Until that moment, "My gut feeling was that extracting information from a hardware circuit was very hard, and would need NSA-level labs filled with scanning electron microscopes and highly-trained physicists."
Integrated circuits (IC) are made up of logic gates and registers that can store bits. These elements and their interconnections are tiny – in modern ICs they measure only a few tens of nanometers, approximately 0.0001 of the thickness of a human hair. Taken together, these elements form a "netlist", which can be extracted - reverse-engineered - from the IC by using methods from experimental physics.
Interplay between hardware and software security
"Most security people are not well equipped to do this because they don't want to touch hardware," he says. "They're computer science or math people." Conversely, computer hardware researchers are often not interested in security topics. As we continue to become increasingly dependent on computer networks, however, ensuring the integrity of the underlying hardware is crucial.
A key question regarding hardware Trojans is understanding how they could be implemented in circuits while remaining undetected. Adding transistors or wiring ought to be easy to spot via microscope-based inspection or comparison to a master copy. In a 2013 paper, Paar's group studied how to implement hardware Trojans by instead changing the dopant polarity of existing transistors - that is, by altering the chip in extremely subtle ways, literally on the atomic level.
The 2013 paper led Paar to propose work aimed at protecting the Internet of Things against next-generation attacks on cryptographic functions, which was funded by ERC and has become an important part of the CASA research cluster.
Cognitive processes in hardware reverse engineering
In its first year, Hub B has produced three key papers related to hardware reverse engineering: In the first, the group created automated tools to analyze netlists, essential because of the size and complexity of modern chips. In the second, presented at the 2020 Symposium on Usable Privacy and Security, the group began to examine the cognitive processes reverse engineers engage in to solve problems, how manual and automated methods of reverse engineering interact, and which cognitive factors play a part. In the third, the researchers introduced a method of obfuscating circuit designs in order to make them more difficult to reverse engineer.
For the last of these, Paar is collaborating with the cognitive psychologist Nikol Rummel who is also a CASA principal investigator. The key idea is to consider netlist reverse engineering as a learning problem – a well-established research area within cognitive psychology. "The final goal is that if we can understand where humans have problems reverse engineering circuits and identify the problematic steps, we can build circuits and hardware designs that have a lot of these really complicated steps and make them harder to reverse-engineer. We call this 'cognitive obfuscation'." He adds, "This is research no one else does."
Implementation of secure algorithms
The hub also approaches hardware security from the point of view of ensuring that the implementation of secure algorithms installed to perform cryptographic functions or protect intellectual property is secure. This work, led by Amir Moradi, seeks both to understand how these implementations can be attacked and how to increase resistance to those attacks. These types of devices often leak information relating to their computation via side channels - for example, traces left by electrical activity or being timing how long it takes the device to react to a given input - that can be used to gain information that can help an attacker break in.
In a 2019 paper, which won the best paper award at CHES, Moradi and his co-authors were the first to identify flaws in the known countermeasures to these sorts of attacks. In a paper accepted for the IEEE Symposium on Privacy and Security 2021, the group propose an attack on state of the art schemes, for which they built their own prototype based on a mixture of electrical engineering, IT security, and physics.
An unusual feature of Moradi's group's approach is assuming that their adversary is super-strong, on the level of a nation-state funded security agency like the US's NSA. This approach raises the question of economics because security always has costs such as slowed performance and increased memory space. These overheads increase exponentially with the complexity of the security being implemented. The hardest problem they're trying to solve, therefore, is to turn this exponential relationship into a linear one. "It may not be possible," says Moradi. "We don't know yet."
Other projects of CASA
Hub B is one of four research hubs that make up the Cyber Security in the Age of Large-Scale Adversaries (CASA) cluster of excellence at the Horst Görtz Institute for IT Security (HGI) at Ruhr Universität Bochum (RUB). The other three are "Future cryptography", led by Eike Kiltz (Hub A); "Secure Systems" led by Thorsten Holz (Hub C); and "Usability", led by Angela Sasse (Hub D). CASA is funded by the German Research Foundation.
General note: In case of using gender-assigning attributes we include all those who consider themselves in this gender regardless of their own biological sex.
