基于PUF和混淆的FPGA系统安全主动防御技术研究

With the increasing use in various applications, Field Programmable Gate Array (FPGA) systems are facing increasingly serious security problems such as cloning, reverse engineering, and replay attacks. Several types of techniques have been proposed to resist these attacks, such as watermarking, fingerprinting, obfuscation and bitstream encryption. However, these techniques suffer from some drawbacks. For example, passive techniques such as watermarking and fingerprinting cannot effectively resist cloning attacks; current logic obfuscation techniques exist some vulnerabilities; bitstream encryption brings high cost and current up-front licensing model cannot satisfy the requirement of the FPGA market. To address these problems, this project tries to propose a Physical Unclonable Function (PUF) and obfuscation–based active defense technique for FPGA system security. The main research contents in this project are as follows. First, an obfuscation algorithm for maximizing the ambiguity is proposed to improve the security. Secondly, a glitch-based high security obfuscation technique is proposed to address the issue that the key of obfuscation cells can be broken by ingenious test attacks. Third, based on obfuscation, a lightweight active anti-cloning technique is proposed by employing the uniqueness of PUF, while this active anti-cloning technique can support the pay-per-device licensing model. Finally, we propose to change the key of obfuscation cells and the response of PUF to resist replay attacks. Thus, this project will help to resolve the security vulnerabilities of FPGA systems.

随着FPGA应用的普及，FPGA系统面临日益严重的安全问题，例如，克隆攻击、重演攻击和逆向工程。当前针对这些安全问题提出的水印、指纹、混淆和位流加密等防御技术都存在一些缺陷与不足，主要包括：被动性的水印和指纹技术难以有效抵抗克隆攻击；现有混淆技术存在安全性问题；位流加密技术代价高且预付许可模式不能满足FPGA市场需求。为解决这些问题，本项目拟提出一种基于物理不可复制功能（PUF）和混淆的主动性防御技术，主要研究内容如下：首先，提出一种最大化混淆输出的算法以提高混淆技术的安全性；其次，提出一种基于毛刺的逻辑混淆技术，以期从根源上解决混淆密钥易被测试的安全性问题；再次，基于混淆，利用PUF的唯一性提出一种轻量级主动反克隆技术，同时可支持按设备授权使用的许可模式；最后，提出同时改变混淆逻辑单元的密钥和PUF响应以抵抗重演攻击。本项目的研究成果将有助于解决FPGA系统的脆弱性问题。

随着FPGA应用的普及，FPGA系统面临日益严重的安全问题，例如：克隆攻击、重演攻击和逆向工程。但当前针对这些安全问题提出的水印、指纹、混淆和位流加密等防御技术都存在一些缺陷与不足。本项目围绕：主动性反克隆技术、高安全性逻辑混淆技术和轻量级抗重演攻击技术等展开研究，在FPGA安全方面取得了丰硕成果。提出了一种新的基于混沌的公开可验证IP水印检测方案，不仅能防止敏感信息泄漏而且能抵抗嵌入攻击，防止证明者、验证者或者可信第三方的欺骗。提出了一种基于轻量级加密架构（LEA-AES）的新的控制流完整性技术。提出了一种新颖的组合逻辑绑定技术，专门保护基于FPGA的嵌入式系统免受克隆攻击、重演攻击和逆向工程，并为FPGA市场提供按设备付费的许可模式。提出了交错RO PUF来提高灵活性和可靠性，并减少硬件开销。设计了一种循环神经网络（RNN）结构对基于电压过度缩放的轻量级认证机制（VOLtA）进行建模攻击，预测准确率甚至高达99.65%。提出了一种新颖的低成本DNU可自恢复的锁存器设计，与最新的DNU自恢复锁存器设计相比，该锁存器的延迟功率面积平均提高了约81.80％。本项目的研究成果在一定程度上解决了FPGA系统的脆弱性问题。