No description available.

La mondialisation et la déverticalisation des métiers du semi-conducteur a mené cette industrie à sous-traiter certaines étapes de conception et souvent la totalité de la fabrication. Au cours de ces étapes, les circuits intégrés (CIs) sont vulnérables à des altérations malignes : les chevaux de Troie matériels (HTs). Dans les applications sécuritaires, il est important de garantir que les circuits intégrés utilisés ne soient pas altérés par de tels dispositifs. Afin d'offrir un niveau de confiance élevé dans ces circuits, il est nécessaire de développer de nouvelles techniques de test pour détecter les HTs, aussi légers et furtifs soient-ils. Cette thèse étudie les menaces et propose deux approches originales de test post-fabrication pour détecter des HTs implantés après synthèse. La première technique exploite des capteurs de courant incorporés au substrat (BBICS), originalement conçus pour identifier les défauts transitoires dans les CIs. Dans notre cas, ils fournissent une signature numérique obtenue par analyse statistique permettant de détecter tout éventuel HT, même au niveau dopant. La deuxième proposition est une méthode non intrusive pour détecter les HTs dans les circuits asynchrones. Cette technique utilise la plateforme de test du circuit et ne requiert aucun matériel supplémentaire. Elle permet la détection de HTs dont la surface est inférieure à 1% de celle du circuit. Les méthodes et les techniques-,- mises au point dans cette thèse-,- contribuent donc à réduire la vulnérabilité des CIs aux HTs soit par adjonction d'un capteur (BBICS), soit en exploitant les mécanismes de test s'il s'agit de circuits asynchrones. / The world globalization has led the semiconductor industry to outsource design and fabrication phases, making integrated circuits (ICs) potentially more vulnerable to malicious modifications at design or fabrication time: the hardware Trojans (HTs). New efficient testing techniques are thus required to disclose potential slight and stealth HTs, and to ensure trusted devices. This thesis studies possible threats and proposes two new post-silicon testing techniques able to detect HTs implanted after the generation of the IC netlist. The first proposed technique exploits bulk built-in current sensors (BBICS) -- which are originally designed to identify transient faults in ICs -- by using them as testing mechanisms that provide statistically-comparable digital signatures of the devices under test. With only 16 IC samples, the testing technique can detect dopant-level Trojans of zero-area overhead. The second proposition is a non-intrusive technique for detection of gate-level HTs in asynchronous circuits. With this technique, neither additional hardware nor alterations on the original test set-up are required to detect Trojans smaller than 1% of the original circuit. The studies and techniques devised in this thesis contribute to reduce the IC vulnerability to HT, reusing testing mechanisms and keeping security features of original devices.

No description available.

<div>The huge gamut of today’s internet-connected embedded devices has led to increasing concerns regarding the security and confidentiality of data. To address these requirements, most embedded devices employ cryptographic algorithms, which are computationally secure. Despite such mathematical guarantees, as these algorithms are implemented on a physical platform, they leak critical information in the form of power consumption, electromagnetic (EM) radiation, timing, cache hits and misses, and so on, leading to side-channel analysis (SCA) attacks. Non-profiled SCA attacks like differential/correlational power/EM analysis (DPA/CPA/DEMA/CEMA) are direct attacks on a single device to extract the secret key of an encryption algorithm. On the other hand, profiled attacks comprise of building an offline template (model) using an identical device and the attack is performed on a similar device with much fewer traces.</div><div><br></div><div>This thesis focusses on developing efficient side-channel attacks and circuit-level low-overhead generic countermeasures. A cross-device deep learning-based profiling power side-channel attack (X-DeepSCA) is proposed which can break the secret key of an AES-128 encryption engine running on an Atmel microcontroller using just a single power trace, thereby increasing the threat surface of embedded devices significantly. Despite all these advancements, most works till date, both attacks as well as countermeasures, treat the crypto engine as a black box, and hence most protection techniques incur high power/area overheads.</div><div><br></div><div>This work presents the first white-box modeling of the EM leakage from a crypto hardware, leading to the understanding that the critical correlated current signature should not be passed through the higher metal layers. To achieve this goal, a signature attenuation hardware (SAH) is utilized, embedding the crypto core locally within the lower metal layers so that the critical correlated current signature is not passed through the higher metals, which behave as efficient antennas and its radiation can be picked up by a nearby attacker. Combination of the 2 techniques – current-domain signature suppression and local lower metal routing shows >350x signature attenuation in measurements on our fabricated 65nm test chip, leading to SCA resiliency beyond 1B encryptions, which is a 100x improvement in both EM and power SCA protection over the prior works with comparable overheads. Moreover, this is a generic countermeasure and can be utilized for any crypto core without any performance degradation.</div><div><br></div><div>Next, backed by our physics-level understanding of EM radiation, a digital library cell layout technique is proposed which shows >5x reduction in EM SCA leakage compared to the traditional digital logic gate layout design. Further, exploiting the magneto-quasistatic (MQS) regime of operation for the present-day CMOS circuits, a HFSS-based framework is proposed to develop a pre-silicon EM SCA evaluation technique to test the vulnerability of cryptographic implementations against such attacks during the design phase itself.</div><div><br></div><div>Finally, considering the continuous growth of wearable and implantable devices around a human body, this thesis also analyzes the security of the internet-of-body (IoB) and proposes electro-quasistatic human body communication (EQS-HBC) to form a covert body area network. While the traditional wireless body area network (WBAN) signals can be intercepted even at a distance of 5m, the EQS-HBC signals can be detected only up to 0.15m, which is practically in physical contact with the person. Thus, this pioneering work proposing EQS-HBC promises >30x improvement in private space compared to the traditional WBAN, enhancing physical security. In the long run, EQS-HBC can potentially enable several applications in the domain of connected healthcare, electroceuticals, augmented and virtual reality, and so on. In addition to these physical security guarantees, side-channel secure cryptographic algorithms can be augmented to develop a fully secure EQS-HBC node.</div>