阅读说明：本技术 面向fpga硬件后门检测的内嵌ron优化布局方法 (Embedded RON optimal layout method for FPGA hardware backdoor detection ) 是由 王坚 张海龙 李桓 杨鍊 陈哲 郭世泽 于 2019-04-25 设计创作，主要内容包括：本发明公开了一种面向FPGA硬件后门检测的内嵌RON优化布局方法。本发明可以得到一种环形振荡器网络的布局,从而给出适合于后门检测的环形振荡器数量,使得片上集成环形振荡器网络的开销得到了控制,同时,对于规模处于设定阈值以内的硬件后门,本发明具有良好的后门检测正确率。(The invention discloses an embedded RON optimal layout method for FPGA hardware backdoor detection. The invention can obtain the layout of the ring oscillator network, thereby providing the number of the ring oscillators suitable for back door detection, controlling the overhead of the on-chip integrated ring oscillator network, and simultaneously having good back door detection accuracy for the hardware back door with the scale within the set threshold.)

1. An embedded RON optimization layout method for FPGA hardware backdoor detection is characterized by comprising the following steps:

s1, measuring the coverage radius of RO in the RON of the original circuit;

and S2, optimizing and arranging the RO according to the coverage radius of the RO.

2. The embedded RON optimal layout method for FPGA hardware backdoor detection according to claim 1, wherein the specific steps of step S1 are as follows:

s11, placing an RO on the FPGA, making other circuits not exist around the RO, measuring the reference frequency of the RO for n times, and recording the initial measurement result as F₀Recording the initial measurement result F₀Has a mean value of mu₀Variance is sigma;

s12, generating a linear feedback shift register as a hardware back door simulation circuit;

s13, initializing i to 1;

s14, placing the hardware back door simulation circuit at a position which is i slices away from the RO, measuring the frequency of the RO for n times, and recording the measurement result as F_iRecording the measurement result F_iHas a mean value of mu_iVariance is sigma;

s15, when | mu₀-μ_iIf | ≧ σ, go to step S16, otherwise go to step S17;

s16, adding 1 to i, and returning to the step S14;

s17 passing through the initial measurement result F₀And measurement result F_iThe coverage radius of the RO is calculated.

3. The method for optimizing layout of embedded RON for FPGA hardware backdoor detection according to claim 2, wherein the calculation formula of RO coverage radius in step S17 is:

r＝max({i||μ₀-μ_i|≥σ})

in the above formula, r is the coverage radius of RO.

4. The embedded RON optimal layout method for FPGA hardware backdoor detection according to claim 3, wherein the specific steps of step S2 are as follows:

s21, when

x is the transverse distance of the circuit C, and y is the longitudinal distance of the circuit C;

s22, carrying out grid division on the circuit C through an inscribed regular hexagon of a circle with the radius r;

s23, arranging the RO at the circle center in the circuit boundary;

s24, when y/d_vIs 0 or 0.5d_vIf not, the step S25 is carried out, otherwise, the circle with the circle center outside the upper boundary of the circuit is translated downwards, the circle center is positioned at the upper boundary of the circuit, the RO is placed at the circle center, and the step S25 is carried out;

d_vthe line spacing of RO is taken as

S25, when 0<x-X_rWhen the distance is less than or equal to 0.5r, the step S27 is carried out, otherwise, the circle with the center at the right boundary of the circuit is translated leftwards to the inside of the circuit or removed, the RO is placed at the center of the circle, and the step S26 is carried out;

X_rthe abscissa of the rightmost column of non-edge RO takes the value of

s26, when y/d_vIs greater than 0 and less than 0.5d_vIf not, removing the circle with the center outside the right boundary of the circuit, translating other centers outside the right boundary to the upper left side, and placing the RO at the center;

s27, when

5. The embedded RON optimal layout method oriented to FPGA hardware backdoor detection according to claim 4, wherein the grid division in the step S22 specifically comprises:

and taking the lower left corner of the circuit as an origin, the left boundary of the circuit as a y axis, and the lower edge of the circuit as an x axis, horizontally placing a regular hexagon, namely the upper side and the lower side are horizontal, aligning the lower bottom edge with the x axis, placing the left vertex of the bottom edge at the origin, and determining the adjacent regular hexagon by taking the regular hexagon as a reference until the circuit is completely covered.

6. The method for optimizing layout of embedded RON facing FPGA hardware back-door detection according to claim 4, wherein the number and positions of the ROs arranged in step S23 are as follows:

setting a row of circles which are positioned in the circuit and are closest to the y axis as a first row, and sequentially increasing the number of the rows towards the right;

when RO is in odd columns, the position of the non-edge RO is (0.5r + m)_o·2d_h,0.5d_v+n_o·d_v)，m_o＝0,1,…,M_o-1，n_o＝0,1,…,N_o-1；

M_oThe number of odd columns of the non-edge RO is equal to

When RO is in even column, the position of non-edge RO is (2r + m)_e·2d_h,n_e·d_v)，m_e＝0,1,…,M_e-1，n_e＝0,1,…,N_e-1；

M_eThe number of even columns of non-edge RO is equal to

7. The method for optimizing layout of embedded RON for FPGA hardware backdoor detection according to claim 6, wherein the locations where ROs are placed in step S24 are:

8. the method for optimizing layout of embedded RON facing FPGA hardware back-door detection according to claim 6, wherein the circle center outside the right boundary in step S26 is translated to the left:

in the above formula, X_rThe abscissa of the rightmost column of non-edge ROs takes the value

9. The method for optimizing layout of embedded RON for FPGA hardware back-door detection according to claim 8, wherein the other circle centers in step S26 are translated to the following positions:

Technical Field

The invention relates to the technical field of hardware safety, in particular to an embedded RON optimal layout method for FPGA hardware backdoor detection.

Background

In recent years, security issues of network space have been increasingly emphasized, and attention to hardware security has been raised. The hardware backdoor is one of the most effective hardware attack means, such attacks can exist in different stages of the life cycle of a hardware circuit, malicious functions are added by modifying RTL codes, netlists and the like of the hardware circuit, and the consequences of information leakage, service denial and the like are generated when the circuit runs to a specific situation. An attacker of the hardware backdoor is designed elaborately, the activation difficulty is high and the scale is small, and the traditional circuit fault test can be avoided, so that the research on the detection of the hardware backdoor is very important.

A hardware back door detection method based on a Ring Oscillator Network (RON) is provided, wherein the ring oscillator network is formed by a plurality of Ring Oscillators (ROs) by utilizing the characteristic that the frequency of the Ring Oscillators (RONs) is sensitive to circuit signal inversion and is distributed at different positions of a circuit. The RON is integrated into the circuit, test vectors are input to the circuit, the frequency of each RO is measured, and the difference between the presence and absence of back gates can be analyzed.

Since RON is integrated on a circuit and is additionally introduced to the original circuit, it is necessary to control the overhead as much as possible. Most researchers in the conventional RON study directly use m × n ROs and place them on the circuit as a rectangular array of m rows and n columns, and very few studies use other RON layout structures, such as 32 ROs distributed on the diagonal of the circuit.

Disclosure of Invention

Aiming at the defects in the prior art, the embedded RON optimization layout method for FPGA hardware backdoor detection provided by the invention solves the problems of high RON overhead and low hardware backdoor detection rate.

In order to achieve the purpose of the invention, the invention adopts the technical scheme that: an embedded RON optimal layout method for FPGA hardware backdoor detection comprises the following steps:

s1, measuring the coverage radius of RO in the RON of the original circuit;

and S2, optimizing and arranging the RO according to the coverage radius of the RO.

Further: the specific steps of step S1 are:

s11, placing an RO on the FPGA with no other circuits around it, measuring the reference frequency of the RO n times,record the initial measurement as F₀Recording the initial measurement result F₀Has a mean value of mu₀Variance is sigma;

s12, generating a linear feedback shift register as a hardware back door simulation circuit;

s13, initializing i to 1;

s14, placing the hardware back door simulation circuit at a position which is i slices away from the RO, measuring the frequency of the RO for n times, and recording the measurement result as F_iRecording the measurement result F_iHas a mean value of mu_iVariance is sigma;

s15, when | mu₀-μ_iIf | ≧ σ, go to step S16, otherwise go to step S17;

s16, adding 1 to i, and returning to the step S14;

s17 passing through the initial measurement result F₀And measurement result F_iThe coverage radius of the RO is calculated.

Further: the calculation formula of the RO coverage radius in step S17 is:

r＝max({i||μ₀-μ_i|≥σ})

in the above formula, r is the coverage radius of RO.

Further: the specific steps of step S2 are:

s21, when

When the original circuit C is rotated by 90 degrees clockwise, the step S22 is carried out, otherwise, the step S22 is directly carried out;

x is the transverse distance of the circuit C, and y is the longitudinal distance of the circuit C;

s22, carrying out grid division on the circuit C through an inscribed regular hexagon of a circle with the radius r;

s23, arranging the RO at the circle center in the circuit boundary;

s24, when y/d_vIs 0 or 0.5d_vIf not, the step S25 is carried out, otherwise, the circle with the circle center outside the upper boundary of the circuit is translated downwards, the circle center is positioned at the upper boundary of the circuit, and the RO is placed at the circle centerProceeding to step S25;

d_vthe line spacing of RO is taken as

S25, when 0<x-X_rWhen the distance is less than or equal to 0.5r, the step S27 is carried out, otherwise, the circle with the center at the right boundary of the circuit is translated leftwards to the inside of the circuit or removed, the RO is placed at the center of the circle, and the step S26 is carried out;

X_rthe abscissa of the rightmost column of non-edge RO takes the value of

d_hThe column pitch of RO is 1.5 r;

s26, when y/d_vIs greater than 0 and less than 0.5d_vIf not, removing the circle with the center outside the right boundary of the circuit, translating other centers outside the right boundary to the upper left side, and placing the RO at the center;

s27, when

And rotating the circuit C by 90 degrees anticlockwise to the original position, and finishing the method, otherwise, directly finishing the method.

Further: the grid division in step S22 includes the specific steps of:

and taking the lower left corner of the circuit as an origin, the left boundary of the circuit as a y axis, and the lower edge of the circuit as an x axis, horizontally placing a regular hexagon, namely the upper side and the lower side are horizontal, aligning the lower bottom edge with the x axis, placing the left vertex of the bottom edge at the origin, and determining the adjacent regular hexagon by taking the regular hexagon as a reference until the circuit is completely covered.

Further: the number and positions of the arranged ROs in step S23 are:

setting a row of circles which are positioned in the circuit and are closest to the y axis as a first row, and sequentially increasing the number of the rows towards the right;

when RO is in odd columns, the position of the non-edge RO is (0.5r + m)_o·2d_h,0.5d_v+n_o·d_v)，m_o＝0,1,…,M_o-1，n_o＝0,1,…,N_o-1；

M_oThe number of odd columns of the non-edge RO is equal to

N_oIs the number of non-edge ROs of the odd column, and takes the value as

When RO is in even column, the position of non-edge RO is (2r + m)_e·2d_h,n_e·d_v)，m_e＝0,1,…,M_e-1，n_e＝0,1,…,N_e-1；

M_eThe number of even columns of non-edge RO is equal to

N_eIs the number of non-edge ROs of the even column, and takes the value of

Further: the positions where the RO is placed in step S24 are:

further: the circle center outside the right boundary in the step S26 translates leftward to:

in the above formula, X_rThe abscissa of the rightmost column of non-edge ROs takes the value

Further: in the step S26, the other circle centers are translated to the left upper direction:

the invention has the beneficial effects that: the invention can obtain the layout of the ring-shaped vibration network, thereby providing the number of ring-shaped oscillators suitable for back door detection, controlling the overhead of the on-chip integrated ring-shaped oscillator network, and simultaneously having good back door detection accuracy for the hardware back door with the scale within the set threshold value.

Drawings

FIG. 1 is a general flow chart of the present invention;

FIG. 2 is a flowchart of step S1 according to the present invention;

FIG. 3 is a flowchart of step S2 according to the present invention;

FIG. 4 is a schematic diagram of a ring oscillator according to the present invention;

FIG. 5 is a schematic diagram illustrating a hardware backdoor detection process according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of 3 other layout methods according to an embodiment of the present invention;

FIG. 7 is a bar graph of the number of ring oscillators required for the present invention and other 3 layout methods;

FIG. 8 is a schematic diagram of the back door inspection results of the present invention and other 3 layout methods.

Detailed Description

The following description of the embodiments of the present invention is provided to facilitate the understanding of the present invention by those skilled in the art, but it should be understood that the present invention is not limited to the scope of the embodiments, and it will be apparent to those skilled in the art that various changes may be made without departing from the spirit and scope of the invention as defined and defined in the appended claims, and all matters produced by the invention using the inventive concept are protected.

As shown in fig. 1, an embedded RON optimization layout method for FPGA hardware back-door detection is characterized by comprising the following steps:

and S1, measuring the coverage radius of the RO in the RON of the original circuit. As shown in fig. 2, the specific steps are as follows:

s11, placing an RO on the FPGA, making other circuits not exist around the RO, measuring the reference frequency of the RO for n times, and recording the initial measurement result as F₀Recording the initial measurement result F₀Has a mean value of mu₀Variance is sigma;

s12, generating a linear feedback shift register as a hardware back door simulation circuit, setting a back door prediction threshold t of RO, representing the proportion of the back door in the circuit which can be detected by the minimum RO, wherein the resource scale occupied by the linear feedback shift register isWherein S is the resource size occupied by the original circuit C;

s13, initializing i to 1;

s14, placing the hardware back door simulation circuit at a position which is i slices away from the RO, measuring the frequency of the RO for n times, and recording the measurement result as F_iRecording the measurement result F_iHas a mean value of mu_iVariance is sigma;

s15, when | mu₀-μ_iIf | ≧ σ, go to step S16, otherwise go to step S17;

s16, adding 1 to i, and returning to the step S14;

s17 passing through the initial measurement result F₀And measurement result F_iThe coverage radius of the RO is calculated. The calculation formula of the coverage radius is as follows:

r＝max({i||μ₀-μ_i|≥σ})

in the above formula, r is the coverage radius of RO.

And S2, optimizing and arranging the RO according to the coverage radius of the RO. As shown in fig. 3, the specific steps are:

s21, when

When the original circuit C is rotated by 90 degrees clockwise, the step S22 is carried out, otherwise, the step S22 is directly carried out;

x is the transverse distance of the circuit C, and y is the longitudinal distance of the circuit C;

s22, carrying out grid division on the circuit C through an inscribed regular hexagon of a circle with the radius r; the specific steps of grid division are as follows:

and taking the lower left corner of the circuit as an origin, the left boundary of the circuit as a y axis, and the lower edge of the circuit as an x axis, horizontally placing a regular hexagon, namely the upper side and the lower side are horizontal, aligning the lower bottom edge with the x axis, placing the left vertex of the bottom edge at the origin, and determining the adjacent regular hexagon by taking the regular hexagon as a reference until the circuit is completely covered.

S23, arranging the RO at the circle center in the circuit boundary; the number and positions of the arranged ROs are:

setting a row of circles which are positioned in the circuit and are closest to the y axis as a first row, and sequentially increasing the number of the rows towards the right;

when RO is in odd columns, the position of the non-edge RO is (0.5r + m)_o·2d_h,0.5d_v+n_o·d_v)，m_o＝0,1,…,M_o-1，n_o＝0,1,…,N_o-1；

M_oThe number of odd columns of the non-edge RO is equal to

No is the number of non-edge ROs in the odd number columns, and is taken as

When RO is in even column, the position of non-edge RO is (2r + m)_e·2d_h,n_e·d_v)，m_e＝0,1,…,M_e-1，n_e＝0,1,…,N_e-1；

M_eThe number of even columns of non-edge RO is equal to

N_eIs the number of non-edge ROs of the even column, and takes the value of

S24, when y/d_vIs 0 or 0.5d_vIf not, the step S25 is carried out, otherwise, the circle with the circle center outside the upper boundary of the circuit is translated downwards, the circle center is positioned at the upper boundary of the circuit, the RO is placed at the circle center, and the step S25 is carried out;

d_vthe line spacing of RO is taken as

The locations where the RO is placed are:

s25, when 0<x-X_rWhen the distance is less than or equal to 0.5r, the step S27 is carried out, otherwise, the circle with the center at the right boundary of the circuit is translated leftwards to the inside of the circuit or removed, the RO is placed at the center of the circle, and the step S26 is carried out;

X_rthe abscissa of the rightmost column of non-edge RO takes the value ofd_hThe column pitch of RO is 1.5 r;

s26, when y/d_vIs greater than 0 and less than 0.5d_vAnd when the center of the circle outside the right boundary is translated leftwards, the RO is placed at the center of the circle, and the center of the circle outside the right boundary is translated leftwards to:

in the above formula, X_rThe abscissa of the rightmost column of non-edge ROs takes the value

Otherwise, removing the circle with the center outside the right boundary of the circuit, translating other circle centers outside the right boundary to the left upper side, and placing the RO at the circle center; other circle centers are translated to the left upper part:

s27, when

And rotating the circuit C by 90 degrees anticlockwise to the original position, and finishing the method, otherwise, directly finishing the method.

Fig. 4 shows a layout diagram of ROs according to different circuit side length conditions, where the center of a square is the position of an edge RO, the center of a circle is the position of a non-edge RO, and a circle represents the coverage area of the center position RO, and fig. 4(a), fig. 4(b), fig. 4(c), and fig. 4(d) are tables showing the movement of the center of a circle under 4 different conditions.

The experiment was carried out with Xilinx Artix-7FPGA (XC7A35T-1FTG 256C). In the experiment, the invention uses 5 th order RO, applies 1000 test vectors to the circuit under test during the RO counting period, and calculates the frequency of the RO during this period. The frequency of each RO measurement is transmitted to the PC via the UART interface for back door detection.

In the experiment, the back door detection process is as shown in fig. 5, and the frequency measurement values of the ROs are subjected to Principal Component Analysis (PCA) to extract features, and input to the BP neural network for training and classification. The classification accuracy of the neural network is the accuracy of the back door detection. The invention collects data of 700 groups of back gate-free circuits and 700 groups of hardware-implanted back gate circuits for training the neural network, and then tests data of 300 groups of back gate-free circuits and 300 groups of hardware-implanted back gate circuits. In addition, when the coverage radius of the RO is measured by the present invention, setting the ratio of the back door simulation circuit to 1% indicates that a hardware back door having a ratio higher than 1% can be effectively detected.

The experiment was summarized in Table 1 using 10 test circuits provided by the widely accepted Trust-Hub website.

TABLE 1 Experimental test Circuit

In the experiment, in addition to the layout method proposed by the present invention, we also selected 3 other methods presented in the literature as comparison, which are: low density, 8 ROs arranged as a rectangular array of 4 rows and 2 columns; high density, 12 RO arrays are arranged as a rectangular array of 4 rows and 3 columns; x-type, 32 ROs are laid out on the diagonal of the circuit. Three layouts are shown in fig. 6.

Figure 7 shows the number of ring oscillators required in each test circuit for the 4 scenarios. The number of ROs used by different test circuits under the scheme of the present invention is different, and other schemes are fixed. Overall, our scheme requires a higher number of ROs than the low density version, much lower than the X version, while our method requires the same number of ROs in 5 circuits, less in 3 circuits, and more in 2 circuits compared to the high density version.

Fig. 8 shows the detection accuracy of the back gate for different test circuits under 4 schemes. It can be seen that for most test circuits, the back gate detection rate of the present invention is improved. Compared with the low-density layout and the X-type layout, the back door detection rate is higher. Compared with the high-density type, the invention obtains higher detection rate in 9 test circuits.