LaserEscape: Detecting and Mitigating Optical Probing Attacks

Saleh Khalaj Monfared,Kyle Mitard,Andrew Cannon,Domenic Forte,Shahin Tajik
2024-08-31
Abstract:The security of integrated circuits (ICs) can be broken by sophisticated physical attacks relying on failure analysis methods. Optical probing is one of the most prominent examples of such attacks, which can be accomplished in a matter of days, even with limited knowledge of the IC under attack. Unfortunately, few countermeasures are proposed in the literature, and none has been fabricated and tested in practice. These countermeasures usually require changing the standard cell libraries and, thus, are incompatible with digital and programmable platforms, such as field programmable gate arrays (FPGAs). In this work, we shift our attention from preventing the attack to detecting and responding to it. We introduce LaserEscape, the first fully digital and FPGA-compatible countermeasure to detect and mitigate optical probing attacks. LaserEscape incorporates digital delay-based sensors to reliably detect the physical alteration on the fabric caused by laser beam irradiations in real time. Furthermore, as a response to the attack, LaserEscape deploys real-time hiding approaches using randomized hardware reconfigurability. It realizes 1) moving target defense (MTD) to physically move the sensitive circuity under attack out of the probing field of focus to protect secret keys and 2) polymorphism to logically obfuscate the functionality of the targeted circuit to counter function extraction and reverse engineering attempts. We demonstrate the effectiveness and resiliency of our approach by performing optical probing attacks on protected and unprotected designs on a 28-nm FPGA. Our results show that optical probing attacks can be reliably detected and mitigated without interrupting the chip's operation.
Cryptography and Security
What problem does this paper attempt to address?
### Problems Addressed by the Paper The paper primarily addresses the issue of optical probing attacks faced by integrated circuits (ICs). Specifically, it proposes **LaserEscape**, a fully digital and FPGA-compatible countermeasure designed to detect and mitigate optical probing attacks. #### Main Issues: 1. **Real-time Detection of Optical Probing Attacks**: Investigating whether it is feasible to confidently achieve real-time optical probing attack detection using fully digital components within an FPGA. 2. **Response to Optical Probing Attacks**: Determining how to take appropriate measures to deceive the attacker without interrupting the operation of the IC after detecting an optical probing attack. ### Solution Overview - **Detection Mechanism**: The paper employs a delay-based sensor (1LUTSensor) that utilizes internal FPGA resources to detect temperature changes caused by laser illumination. - **Response Mechanism**: Includes strategies such as Moving Target Defense and Gate Polymorphism to achieve real-time defense. - **Moving Target Defense**: Randomizes the location of sensitive registers through partial reconfiguration, moving them out of the attacker's probing range. - **Gate Polymorphism**: Implements functional transformations of logic gates within the FPGA to prevent attackers from extracting functionality or performing reverse engineering. ### Research Contributions - Proposes a new, reliable detection method combined with real-time response strategies to effectively counter optical probing attacks. - Conducted experimental validation on a 28-nanometer FPGA, demonstrating the effectiveness and robustness of the proposed method.