面向CGRCA配置比特流的硬件木马攻击防护方法  

A hardware Trojan attack protection method for CGRCA configuration bitstream

作　　者：刘敏[1] 严迎建[1] 南龙梅[1,2] Liu Min;Yan Yingjian;Nan Longmei(The PLA's Information Engineering University,Zhengzhou 450001,China;State Key Laboratory of Applied Integrated Circuits and Systems,Fudan University,Shanghai 200433,China)

机构地区：[1]解放军信息工程大学,河南郑州450001 [2]复旦大学专用集成电路与系统国家重点实验室,上海200433

出　　处：《电子技术应用》2019年第9期39-45,共7页Application of Electronic Technique

摘　　要：针对可重构设备配置比特流易遭受硬件木马攻击的问题,提出了基于认证加密硬件安全引擎的防护方法。首先,通过研究CGRCA的结构及配置过程,详细分析了系统面临的安全威胁,并给出面向未加密原始配置流的硬件木马攻击流程和植入方法。针对该攻击流程,研究提出基于改进CCM认证加密机制的防护方法,该方法对原始配置流进行部分加密和认证,硬件层面采用资源复用的双安全引擎进行解密和认证,确保配置比特流的完整性和真实性。仿真实验证明,该防护方法能以较小的面积和时间开销,抵御面向配置流的潜在硬件木马攻击威胁,实现对配置比特流的保护。A protection method based on authentication and encryption hardware security engine is proposed as the reconfigurable device configuration bitstream is vulnerable to hardware Trojan attacks.Firstly,the security threats of system are analyzed in detail and the possible hardware attack process and implantation method for unencrypted original configuration flow are proposed,via researching on the structure and configuration process of coarse-grained reconfigurable cryptographic array(CGRCA).Aiming at the attack process,a protection method based on advanced CCM authentication and encryption is proposed.The method partially encrypts and authenticates the original configuration bitstream in software,and uses a dual security engine for decryption and authentication on the hardware to ensure the integrity and authenticity of the configuration bitstream.The experimental results show that the protection method can protect the configuration bit stream by protecting the configuration flow from potential hardware Trojan attack threat with small area and time overhead.

关 键 词：硬件木马防护 粗粒度可重构密码阵列 配置比特流防护 硬件双安全引擎 

分 类 号：TN406[电子电信—微电子学与固体电子学]