Modeling an Asynchronous Circuit
Dedicated to the Protection Against Physical Attacks

The number of connected devices that make up the IoT (Internet of Things) already exceeded 20 billion, and is constantly increasing. However, a study of Hewlett Packard¹¹1https://www8.hp.com/us/en/hp-news/press-release.html?id=1909050 indicates that 90% of the objects collect and thus potentially expose data, that 80% of the objects do not use identification and source authentication mechanisms, and that 70% do not use a mechanism of encrypting the transmitted data. These vulnerabilities open the way to DDoS (Distributed Denial-of-Service) attacks, which exploit over $100,000$ infected devices (e.g., cameras, video recorders, etc.) to overload various services and websites with a deluge of data. Therefore, strengthening the security of connected devices is a critical issue.

The SECURIOT-2 project²²2http://www.pole-scs.org/en/projects/securiot-2, led by Tiempo Secure, aims at developing a SMCU (Secure Micro-Controller Unit) that will bring to the IoT a level of security similar to banking transactions and transport (smart cards) and identification (electronic passports). Besides ensuring the necessary security services (key management, authentication, confidentiality and integrity of stored/exchanged data), the SMCU needs a power management scheme adequate with the low power consumption constraints of the IoT.

Given these constraints, a natural implementation of an SMCU is by means of asynchronous circuits, whose components are not governed by a clock signal, but operate independently, on an ”on-demand” basis. Compared to classical synchronous circuits, this functioning has the potential for lower power dissipation, more harmonious electromagnetic emission, and better overall timing performance.

In this paper, we study the so-called shield [26, 27], a particular asynchronous circuit designed and patented by Tiempo Secure for the protection of another (asynchronous) circuit against certain physical attacks (e.g., cutting a wire, setting a wire to a constant voltage, and introducing a short-circuit between two wires). The behavior of asynchronous circuits can be suitably modeled in the action-based setting, using the composition operators of process calculi, as witnessed by CHP [22], Tangram [5], Balsa [11], which are all inspired by CSP [7], and have been successfully applied to design asynchronous circuits, e.g., [3, 23, 25]. All these approaches are equipped with a compilation scheme [22], producing QDI (Quasi-Delay-Insensitive) circuits, the correct operation of which is independent of the delay in operators (or logical gates) and wires, except for certain wires that form isochronic forks [22]. An isochronic fork is a wire connecting an emitter to several receivers, which receive any signal with identical delays.

We consider the modeling and analysis of the shield at two abstraction levels. First, at circuit level, we take into account only the components of the circuit and their interconnection, without modeling the implementation details of these components. This level is appropriate for reasoning about the desired properties of the shield, namely the detection of physical attacks. The regular structure of the shield (serial pipeline) enables to apply inductive arguments to reduce all possible attack configurations to a finite set, which we analyzed exhaustively. Next, we undertake a gate level modeling, focusing on the implementation of a component in terms of logical gates. Here we explore a range of different modeling variants for gates, electric wires, and forks (isochronic or not), and analyze their respective impact on the faithfulness of the global circuit model, the size of the underlying state spaces, the expression of correctness properties, and the overall ease of verification. We also point out that certain modeling variants lead to deadlocks in the circuit.

In this study, we mainly use the modern LNT [14] language for concurrent systems, which offers a user-friendly syntax and a formal semantics inherited from process calculi, and has been shown to be close to industrial hardware description languages for asynchronous circuits [6]. For the modeling of attacks, we also use the synchronization vectors of EXP [21], which operate on networks of communicating automata. LNT and EXP are input languages of the CADP toolbox [13]³³3http://cadp.inria.fr for modeling and verification of asynchronous concurrent systems.

The paper is organized as follows. Section 2 describes the protection circuit and its behavior. Sections 3 and 4 are devoted to the analysis of the protection circuit at two abstraction levels (circuit-level and gate-level, respectively), in regard to its properties of detecting physical attacks. Both sections illustrate the approach on examples; the full models can be found in the appendices. Section 5 discusses related work and Section 6 gives concluding remarks and directions for future work.

To protect an integrated circuit against physical attacks, the patent [26, 27] suggests to add as a top layer a particular electric circuit, called shield in the sequel. Physical attacks to the circuit are generally meant to allow the attacker to probe for the sensitive information that is stored in the internal registers/wires of the circuit during its ordinary operation. These probing procedures will inevitably lead to a tampering with the shield as it constitutes the top layer of the accessible part of the circuit. Hence, proving that the shield is able to flag any tampering attempts amounts to proving that the circuit itself is able to detect a physical attack and to stop its normal operation and take an appropriate countermeasure (e.g., completely deactivate the circuit).

A shield is a serial composition of $n+1$ sequencers (see Fig. 1 or [27, Fig. 3]), or even a parallel composition of several series of sequencers (see [27, Figs. 9–11]). Each sequencer transmits a first signal, called request to its successor; when the last sequencer outputs a request, a second signal, called acknowledgment is transmitted through the series of sequencers in the opposite direction. If a sequencer is designed in such a way that any physical modification on the connections for the transmission of the request (respectively, the acknowledgment) blocks the transmission of the acknowledgment (respectively, the request), a physical attack can be detected by the absence of an acknowledgment for a request sent into the shield.

Figure 2 shows the gate-level design of a circuit presented as a possible implementation of a sequencer in the patent.⁴⁴4There are small differences with [27, Figs. 4–8]: (1) omission of the input RST to the Muller C element; (2) no distinction between links carrying 0 (dashed in [27]) and 1 (plain in [27]); (3) naming forks and highlighting them (in yellow); (4) explicit drawing of the fork Z after the inverter; and (5) labeling of the visible and internal wires. The intended evolution over time of the circuit [27, Figs. 4–8] is summarized by the table in Fig. 3. When considering only the externally visible wires, the behavior of a sequencer corresponds to the automaton shown in Fig. 3, where input (respectively, output) transitions are depicted with plain (respectively, dotted) arrows. Initially, the output G of the Muller C element [24] and the two inputs R_PRED and A_SUCC are DOWN. When input R_PRED goes UP, output R_SUCC goes UP as well. As a reaction, input A_SUCC is expected to go UP, triggering output R_SUCC to go DOWN. When A_SUCC goes DOWN, output A_PRED goes UP. Finally, R_PRED goes DOWN, bringing the circuit back to its initial state. This cycle is related to the so-called four-phase handshake protocol, frequently used in the design of asynchronous circuits [22]. Note that there is no constraint on reaction delays of the circuit: a change of an input should be eventually followed by the corresponding output change. Similarly, the environment of the circuit should respect the protocol by reacting to a change of an output by changing an input as specified by the protocol.

For a more precise study of a sequencer, we refine the model of a sequencer by representing the internal operation of all the electric wires and gates according to Fig. 2: one binary wire, three forks, one inverter, one AND gate, one NOR gate, and one Muller C element. Intuitively, each of them can be considered as a process, which reacts on its input(s) by (possibly) producing some output. However, there are various possibilities with respect to the degree of synchronization and possible propagation delays. This section aims at exploring these possibilities, discussing the respective advantages in terms of ease of modeling, size of the corresponding state space, and practicality for verification.

A major choice when modeling a gate is whether the model represents only transitions (i.e., changing voltage, as in the protocol of Fig. 3) or rather current state of a wire. Considering only transitions yields smaller models and corresponding state spaces, but might seem less intuitive because it requires stronger assumptions (e.g., synchronous communication).

Process calculi, that were initially designed for concurrent systems, are natural candidates for describing asynchronous circuits.

CSP${}_{\_}M$, a machine-readable dialect of CSP, was used in [19] to model various asynchronous circuits (C element, $n$-way mutual exclusion element, tree arbiter) and verify them using the FDR tool. The CSP operators were shown to be suitable for asynchronous circuits, in particular multi-way synchronization facilitates the modeling of isochronic forks. A general model for asynchronous circuits and its translation to CSP is proposed in [32], together with a compositional verification approach suitable for FDR. This makes possible a modeling at three levels (Balsa, handshake expansion, and gate-level), and was applied to the design of realistic circuits, such as the AMULET processor [31].

A modeling style for asynchronous circuits in CCS was proposed in [29] and illustrated on distributed arbiters. In [20] it is shown how to represent DI (Delay-Insensitive) asynchronous circuits in CCS. A circuit $C$ was defined as DI if its composition with a FRW (Foam Rubber Wrapper) making the communications on input and output wires arbitrarily long is equivalent to $C$ modulo the MUST-testing equivalence, provided by the Concurrency Workbench [9].

The modeling and verification (by equivalence checking) of asynchronous designs using Circal is discussed in [2]. It is also shown how the diagnostic facility of the Circal system helps in determining the forks that are required to be isochronic.

Besides process calculi, a number of other formalisms have been used to model asynchronous circuits at gate-level: Petri nets [34], signal transition graphs [33], XDI [30], Receptive Process Theory [18], stable events [17], and complete trace structures [10].

We do not consider here the verification of security properties, because the main focus of the present paper is the faithful modeling of an asynchronous circuit regardless of its purpose.

In this paper, we used the LNT language to formally model an asynchronous circuit at circuit- and gate-level, investigating also various modeling styles for wires and gates. Analyzing these models using the CADP toolbox, we found that they can provide the designer with valuable information, such as the necessity to ensure isochrony of forks. For circuit-level analysis, we used an induction proof to extend results of our attack analysis to a shield of arbitrary size. Obtaining a comparable result for gate-level models is challenging, due to the necessity of stubs. Last, but not least, we believe that, due to their extensibility and state space size, these models provide a challenging benchmark.