Abstract:Finite state machines (FSMs) regulate sequential circuits, including access to sensitive information and privileged CPU states. Courtesy of contemporary research on laser attacks, laser-based fault injection (LFI) is becoming even more precise where an adversary can thwart chip security by altering individual flip-flop (FF) values. Different laser models, e.g., bit flip, bit set, and bit reset, have been developed to appreciate LFI on practical targets. As traditional approaches may incorporate substantial overhead, state-based SPARSE and transition-based TAMED countermeasures were proposed in our prior work to improve FSM resiliency efficiently. TAMED overcame SPARSE's limitation of being too conservative, and generating multiple LFI resilient encodings for contemporary LFI models on demand. SPARSE, however, incorporated design layout information into its vulnerability estimation which makes its vulnerability estimation metric more accurate. In this paper, we extend TAMED by proposing a transition-based encoding CAD framework (TRANSPOSE), that incorporates spatial transitional vulnerability metrics to quantify design susceptibility of FSMs based on both the bit flip model and the set-reset models. TRANSPOSE also incorporates floorplan optimization into its framework to accommodate secure spatial inter-distance of FF-sensitive regions. All TRANSPOSE approaches are demonstrated on 5 multifarious benchmarks and outperform existing FSM encoding schemes/frameworks in terms of security and overhead.

Skip Finite Automaton: A Content Scanning Engine to Secure Enterprise Networks

Pre-decision Detection Engine for Signature-Based Network Intrusion Detection System

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

Identification of ICS Security Risks Toward the Analysis of Packet Interaction Characteristics Using State Sequence Matching Based on SF-FSM

Intrusion Detection And Simulation For High-Speed Networks

State Machine Based Malicious Packet Attack Detection and Security Situation Assessment

An Efficient Sampling And Classification Approach For Flow Detection In Sdn-Based Big Data Centers

StriFA: Stride Finite Automata for High-Speed Regular Expression Matching in Network Intrusion Detection Systems

Cache-Based Scalable Deep Packet Inspection with Predictive Automaton.

APFA: Asynchronous Parallel Finite Automaton for Deep Packet Inspection in Cloud Computing

Parallel Architecture for High Throughput DFA-Based Deep Packet Inspection

SPC-FA: synergic parallel compact finite automaton to accelerate multi-string matching with low memory.

TRANSPOSE: Transitional Approaches for Spatially-Aware LFI Resilient FSM Encoding

Step-FA: Step-Based Compact Finite Automaton for Accelerating Multi-String Matching

Feacan: Front-End Acceleration For Content-Aware Network Processing

StriD²FA: Scalable Regular Expression Matching for Deep Packet Inspection

A Memory-Efficient Parallel String Matching Architecture for High-Speed Intrusion Detection

Network Intrusion Detection System in Latest DFA Compression Methods for Deep Packet Scruting

Strid(2)Fa: Scalable Regular Expression Matching For Deep Packet Inspection

Another CDFA Based Multi-Pattern Matching Algorithm and Architecture for Packet Inspection.