The releases of Intel SGX and AMD SEV mark the transition of hardware-based enclaves from research prototypes to mainstream products. These two paradigms of secure enclaves are attractive to both the cloud providers and tenants, since security is one of the key pillars of cloud computing. However, it is found that current hardware-defined enclaves are not flexible and efficient enough for the cloud. For example, although SGX can provide strong memory protection with both confidentiality and integrity, the size of secure memory is tightly restricted. On the contrary, SEV enables enclaves to use more memory but has critical security flaws due to no memory integrity protection. Meanwhile, both types of enclaves have relatively long booting latency, which makes them not suitable for short-term tasks like serverless workloads. After an in-depth analysis, we find that there are some intrinsic tradeoffs between security and performance due to the limitation of architectural designs. In this article, we investigate a novel hardware-software co-design of enclaves to meet the requirements of cloud by placing a part of the logic of the enclave mechanism into a lightweight software layer, named Enclavisor, to achieve a balance between security, performance, and flexibility. Specifically, our implementation is based on AMD’s SEV and, Enclavisor is placed in the guest kernel mode of SEV’s secure virtual machines. Enclavisor inherently supports memory encryption with no memory limitation and also achieves efficient booting, multiple enclave granularities, and post-launch remote attestation. Meanwhile, we also propose hardware/ software solutions to mitigate the security flaws caused by the lack of memory integrity. We implement a prototype of Enclavisor on an AMD SEV server. The experiments on both micro-benchmarks and application benchmarks show that enclaves on Enclavisor can have close-to-native performance.

In the face of an increasing attack landscape, it is necessary to cater for efficient mechanisms to verify software and device integrity for detecting run-time modifications in next-generation systems-of-systems. In this context, remote attestation is a promising defense mechanism that allows a third party, the verifier, to ensure a remote device’s configuration integrity and behavioural execution correctness. However, most of the existing families of attestation solutions suffer from the lack of software-based mechanisms for the efficient extraction of rigid control-flow information. This limits their applicability to only those cyber-physical systems equipped with additional hardware support. This paper proposes a multi-level execution tracing framework capitalizing on recent software features, namely the extended Berkeley Packet Filter and Intel Processor Trace technologies, that can efficiently capture the entire platform configuration and control-flow stacks, thus, enabling wide attestation coverage capabilities that can be applied on both resource-constrained devices and cloud services. Our goal is to enhance run-time software integrity and trustworthiness with a scalable tracing solution eliminating the need for federated infrastructure trust.

Due to the concern on cloud security, digital encryption is applied before outsourcing data to the cloud for utilization. This introduces a challenge about how to efficiently perform queries over ciphertexts. Crypto-based solutions currently suffer from limited operation support, high computational complexity, weak generality, and poor verifiability. An alternative method that utilizes hardware-assisted Trusted Execution Environment (TEE), i.e., Intel SGX, has emerged to offer high computational efficiency, generality and flexibility. However, SGX-based solutions lack support on multi-user query control and suffer from security compromises caused by untrustworthy TEE function invocation, e.g., key revocation failure, incorrect query results, and sensitive information leakage. In this article, we leverage SGX and propose a secure and efficient SQL-style query framework named QShield. Notably, we propose a novel lightweight secret sharing scheme in QShield to enable multi-user query control; it effectively circumvents key revocation and avoids cumbersome remote attestation for authentication. We further embed a trust-proof mechanism into QShield to guarantee the trustworthiness of TEE function invocation; it ensures the correctness of query results and alleviates side-channel attacks. Through formal security analysis, proof-of-concept implementation and performance evaluation, we show that QShield can securely query over outsourced data with high efficiency and scalable multi-user support.

The releases of Intel SGX and AMD SEV mark the transition of hardware-based enclaves from research prototypes to mainstream products. These two paradigms of secure enclaves are attractive to both the cloud providers and tenants, since security is one of the key pillars of cloud computing. However, it is found that current hardware-defined enclaves are not flexible and efficient enough for the cloud. For example, although SGX can provide strong memory protection with both confidentiality and integrity, the size of secure memory is tightly restricted. On the contrary, SEV enables enclaves to use more memory but has critical security flaws due to no memory integrity protection. Meanwhile, both types of enclaves have relatively long booting latency, which makes them not suitable for short-term tasks like serverless workloads. After an in-depth analysis, we find that there are some intrinsic tradeoffs between security and performance due to the limitation of architectural designs. In this article, we investigate a novel hardware-software co-design of enclaves to meet the requirements of cloud by placing a part of the logic of the enclave mechanism into a lightweight software layer, named Enclavisor, to achieve a balance between security, performance, and flexibility. Specifically, our implementation is based on AMD’s SEV and, Enclavisor is placed in the guest kernel mode of SEV’s secure virtual machines. Enclavisor inherently supports memory encryption with no memory limitation and also achieves efficient booting, multiple enclave granularities, and post-launch remote attestation. Meanwhile, we also propose hardware/ software solutions to mitigate the security flaws caused by the lack of memory integrity. We implement a prototype of Enclavisor on an AMD SEV server. The experiments on both micro-benchmarks and application benchmarks show that enclaves on Enclavisor can have close-to-native performance.

In the face of an increasing attack landscape, it is necessary to cater for efficient mechanisms to verify software and device integrity for detecting run-time modifications in next-generation systems-of-systems. In this context, remote attestation is a promising defense mechanism that allows a third party, the verifier, to ensure a remote device’s configuration integrity and behavioural execution correctness. However, most of the existing families of attestation solutions suffer from the lack of software-based mechanisms for the efficient extraction of rigid control-flow information. This limits their applicability to only those cyber-physical systems equipped with additional hardware support. This paper proposes a multi-level execution tracing framework capitalizing on recent software features, namely the extended Berkeley Packet Filter and Intel Processor Trace technologies, that can efficiently capture the entire platform configuration and control-flow stacks, thus, enabling wide attestation coverage capabilities that can be applied on both resource-constrained devices and cloud services. Our goal is to enhance run-time software integrity and trustworthiness with a scalable tracing solution eliminating the need for federated infrastructure trust.

Security still remains an afterthought in modern Electronic Design Automation (EDA) tools, which solely focus on enhancing performance and reducing the chip size. Typically, the security analysis is conducted by hand, leading to vulnerabilities in the design remaining unnoticed. Security-aware EDA tools assist the designer in the identification and removal of security threats while keeping performance and area in mind. Stateof-the-art approaches utilize information flow analysis to spot unintended information leakages in design structures. However, the classification of such threats is binary, resulting in negligible leakages being listed as well. A novel quantitative analysis allows the application of a metric to determine a numeric value for a leakage. Nonetheless, current approximations to quantify the leakage are still prone to overlooking leakages. The mathematical model 2D-QModel introduced in this work aims to overcome this shortcoming. Additionally, as previous work only includes a limited threat model, multiple threat models can be applied using the provided approach. Open-source benchmarks are used to show the capabilities of 2D-QModel to identify hardware Trojans in the design while ignoring insignificant leakages.

Confidential computing services enable users to run or use applications in Trusted Execution Environments (TEEs) leveraging secure hardware, like Intel SGX or AMD SEV, and verify them by performing remote attestation. Typically this process is very rigid and not always aligned with the trust assumptions of the users regarding the hardware identities, stakeholders and software that are considered trusted. In our work, we enable the users to tailor their trust boundaries according to their security concerns and remotely attest the different TEEs specifically based on those.

Security still remains an afterthought in modern Electronic Design Automation (EDA) tools, which solely focus on enhancing performance and reducing the chip size. Typically, the security analysis is conducted by hand, leading to vulnerabilities in the design remaining unnoticed. Security-aware EDA tools assist the designer in the identification and removal of security threats while keeping performance and area in mind. Stateof-the-art approaches utilize information flow analysis to spot unintended information leakages in design structures. However, the classification of such threats is binary, resulting in negligible leakages being listed as well. A novel quantitative analysis allows the application of a metric to determine a numeric value for a leakage. Nonetheless, current approximations to quantify the leakage are still prone to overlooking leakages. The mathematical model 2D-QModel introduced in this work aims to overcome this shortcoming. Additionally, as previous work only includes a limited threat model, multiple threat models can be applied using the provided approach. Open-source benchmarks are used to show the capabilities of 2D-QModel to identify hardware Trojans in the design while ignoring insignificant leakages.

This paper highlights the progress toward securing teleoperating devices over the past ten years of active technology development. The relevance of this issue lies in the widespread development of teleoperating systems with a small number of systems allowed for operations. Anomalous behavior of the operating device, caused by a disruption in the normal functioning of the system modules, can be associated with remote attacks and exploitation of vulnerabilities, which can lead to fatal consequences. There are regulations and mandates from licensing agencies such as the US Food and Drug Administration (FDA) that place restrictions on the architecture and components of teleoperating systems. These requirements are also evolving to meet new cybersecurity threats. In particular, consumers and safety regulatory agencies are attracted by the threat of compromising hardware modules along with software insecurity. Recently, detailed security frameworks and protocols for teleoperating devices have appeared. However, a matter of intelligent autonomous controllers for analyzing anomalous and suspicious actions in the system remain unattended, as well as emergency protocols from the point of cybersecurity view. This work provides a new approach for the intraoperative cybersecurity of intelligent teleoperative surgical systems, taking into account modern requirements for implementing into the Surgical Remote Intelligent Robotic System LevshAI. The proposed principal security model allows a surgeon or autonomous agent to manage the operation process during various attacks.

Air-gapped workstations are separated from the Internet because they contain confidential or sensitive information. Studies have shown that attackers can leak data from air-gapped computers with covert ultrasonic signals produced by loudspeakers. To counteract the threat, speakers might not be permitted on highly sensitive computers or disabled altogether - a measure known as an ’audio gap.’ This paper presents an attack enabling adversaries to exfiltrate data over ultrasonic waves from air-gapped, audio-gapped computers without external speakers. The malware on the compromised computer uses its built-in buzzer to generate sonic and ultrasonic signals. This component is mounted on many systems, including PC workstations, embedded systems, and server motherboards. It allows software and firmware to provide error notifications to a user, such as memory and peripheral hardware failures. We examine the different types of internal buzzers and their hardware and software controls. Despite their limited technological capabilities, such as 1-bit sound, we show that sensitive data can be encoded in sonic and ultrasonic waves. This is done using pulse width modulation (PWM) techniques to maintain a carrier wave with a dynamic range. We also show that malware can evade detection by hiding in the frequency bands of other components (e.g., fans and power supplies). We implement the attack using a PC transmitter and smartphone app receiver. We discuss transmission protocols, modulation, encoding, and reception and present the evaluation of the covert channel as well. Based on our tests, sensitive data can be exfiltrated from air-gapped computers through its built- in buzzer. A smartphone can receive data from up to six meters away at 100 bits per second.

This paper presents AirKeyLogger - a novel radio frequency (RF) keylogging attack for air-gapped computers.Our keylogger exploits radio emissions from a computer’s power supply to exfiltrate real-time keystroke data to a remote attacker. Unlike hardware keylogging devices, our attack does not require physical hardware. Instead, it can be conducted via a software supply-chain attack and is solely based on software manipulations. Malware on a sensitive, air-gap computer can intercept keystroke logging by using global hooking techniques or injecting malicious code into a running process. To leak confidential data, the processor’s working frequencies are manipulated to generate a pattern of electromagnetic emissions from the power unit modulated by keystrokes. The keystroke information can be received at distances of several meters away via an RF receiver or a smartphone with a simple antenna. We provide related work, discuss keylogging methods and present multi-key modulation techniques. We evaluate our method at various typing speeds and on-screen keyboards as well. We show the design and implementation of transmitter and receiver components and present evaluation findings. Our tests show that malware can eavesdrop on keylogging data in real-time over radio signals several meters away and behind concrete walls from highly secure and air-gapped systems.

Spatial field digital modulation (SFDM) communication system is a special index modulation (IM) technique with low hardware complexity and physical layer security potential. However, the deployment of the SFDM system is always complicated and time-consuming. To solve the problems, an adaptive SFDM system without phase measurement is proposed and implemented in this paper. We design a system architecture fit for self-adjustment and propose the corresponding adaptive algorithm. The state isolation and the BER performance are measured under an indoor channel, which verifies its validity.

The goal of this project is to use hardware components built-in manufacturing faults as mobile phone IDs. We assessed the applicability of several I/O-related cell phone components, including sensors. Through this process, the focus was on creating hardware issue samples that could then be categorised using the device s speaker and microphone. In our technique, an audio sample was created by playing a known audio file via a mobile phone s speakers and then recording the sound using the same device. The impact of important variables on sample accuracy was examined using a variety of different sample groups. After collecting the samples, the frequency responses were extracted and classified. Data were categorised using a variety of classifiers, with certain label and sample group configurations achieving an accuracy of over 94.4\%. The conclusions of this article suggest that speaker and mike production faults may be exploited for device authentication.

Since criminality is rising in the 21st century, people want to secure their property and belongings. So, everyone in this situation needs a secure system with cutting-edge technology. Therefore, a person may go out without worries. This project aims to acquire a home security system that can apply a phone call to the client’s GSM (Global System for Mobile) cell phone device and send a message in the shortest amount of time. Our Home security system has been followed by the latest technology at a low cost. In this study, we used the PIR (Passive Infra-Red) movement sensor, the Arduino sensor as the core for movement identification, and the GSM module for dialing the system user, which was used to develop the hardware for this system. This framework uses the Arduino IDE for Arduino and Putty for participating in programming analysis in the GSM unit. The PIR sensor has a crucial function used in this system for the security of any unauthorized individuals and automatically generates calls when neighboring circles intrude and are detected by the PIR sensor. The Integrated Home Safety framework can promptly examine and sense a human’s movement.

An intrusion detection system (IDS) is a crucial software or hardware application that employs security mechanisms to identify suspicious activity in a system or network. According to the detection technique, IDS is divided into two, namely signature-based and anomaly-based. Signature-based is said to be incapable of handling zero-day attacks, while anomaly-based is able to handle it. Machine learning techniques play a vital role in the development of IDS. There are differences of opinion regarding the most optimal algorithm for IDS classification in several previous studies, such as Random Forest, J48, and AdaBoost. Therefore, this study aims to evaluate the performance of the three algorithm models, using the NSL-KDD and UNSW-NB15 datasets used in previous studies. Empirical results demonstrate that utilizing AdaBoost+J48 with NSL-KDD achieves an accuracy of 99.86\%, along with precision, recall, and f1-score rates of 99.9\%. These results surpass previous studies using AdaBoost+Random Tree, with an accuracy of 98.45\%. Furthermore, this research explores the effectiveness of anomaly-based systems in dealing with zero-day attacks. Remarkably, the results show that anomaly-based systems perform admirably in such scenarios. For instance, employing Random Forest with the UNSW-NB15 dataset yielded the highest performance, with an accuracy rating of 99.81\%.

Understanding the temperature dependence of acoustic and photoacoustic (PA) properties is important for the characterization of materials and measurements in various applications. Ultrasound methods have been developed to estimate these properties, but they require careful consideration of multiple variables and steps to obtain reliable results. This study aimed to develop an automated system for simultaneous characterization of acoustic and PA properties of materials. The system was designed to minimize operator errors, ensuring robust temperature control and reproducibility for acoustic measurements. This was made possible through the integration of a commercially available PA imaging system with a custom-built platform specifically tailored for ultrasound-based acoustic characterization. This platform consisted of both hardware and software modules. The system was evaluated with NaCl solutions at different concentrations and a gelatin/agar cubic phantom prepared with uniformly distributed magnetic nanoparticles serving as optical absorbers. Results obtained from the NaCl solution samples exhibited a high Lin s concordance coefficient (above 0.9) with previously reported studies. In the ultrasound/PA experiment, temperature dependences of the speed of sound and PA intensity revealed a strong Pearson s correlation coefficient (0.99), with both measurements exhibiting a monotonic increase as anticipated for water-based materials. These findings demonstrate the accuracy and stability of the developed system for acoustic property measurements.

Internet of Things (IoT) has become extremely prominent for industrial applications and stealthy modification deliberately done by insertion of Hardware Trojans has increased widely due to globalization of Integrated Circuit (IC) production. In the proposed work, Hardware Trojan is detected at the gate level by considering netlist of the desired circuits. To mitigate with golden model dependencies, proposed work is based on unsupervised detection of Hardware Trojans which automatically extracts useful features without providing clear desired outcomes. The relevant features from feature dataset are selected using eXtreme Gradient Boosting (XGBoost) algorithm. Average True Positive Rate (TPR) is improved about 30\% by using Clustering-based local outlier factor (CBLOF) algorithm when compared to local outlier factor algorithm. The simulation is employed on Trust-HUB circuits and achieves an average of 99.83\% True Negative Rate (TNR) and 99.72\% accuracy which shows the efficiency of the detection method even without labelling data.

Hardware Trojans (HT) are minuscule circuits embedded by an adversary for malicious purposes. Such circuits posses stealthy nature and can cause disruption upon activation. To detect the presence of such circuits, appropriate test vectors need to be applied. In this regard, the genetic algorithm (GA) seems to be the most promising technique due to its exploration capability. However, like most of the existing techniques, GA also suffers from exploring the huge search space. In this article a GA based methodology is proposed incorporating the information about potential inputs into it. Experimental results analysis signifies that the identification of the relevant inputs for GA provides an optimal solution. The significance of proposed methodology is endorsed by applying the proposed GA technique on different ISCAS ’85 benchmark circuits. A noteworthy improvement on run time is observed while simultaneously providing improved test set quality than the state-of-the art technique.

Recently, hardware Trojan has become a serious security concern in the integrated circuit (IC) industry. Due to the globalization of semiconductor design and fabrication processes, ICs are highly vulnerable to hardware Trojan insertion by malicious third-party vendors. Therefore, the development of effective hardware Trojan detection techniques is necessary. Testability measures have been proven to be efficient features for Trojan nets classification. However, most of the existing machine-learning-based techniques use supervised learning methods, which involve time-consuming training processes, need to deal with the class imbalance problem, and are not pragmatic in real-world situations. Furthermore, no works have explored the use of anomaly detection for hardware Trojan detection tasks. This paper proposes a semi-supervised hardware Trojan detection method at the gate level using anomaly detection. We ameliorate the existing computation of the Sandia Controllability/Observability Analysis Program (SCOAP) values by considering all types of D flip-flops and adopt semi-supervised anomaly detection techniques to detect Trojan nets. Finally, a novel topology-based location analysis is utilized to improve the detection performance. Testing on 17 Trust-Hub Trojan benchmarks, the proposed method achieves an overall 99.47\% true positive rate (TPR), 99.99\% true negative rate (TNR), and 99.99\% accuracy.

There have been reports of threats that cause electromagnetic information leakage by inserting Hardware Trojans (HT) into the signal traces around components on the printed circuit board (PCB). In this threat, the HT insertion is assumed not only at the manufacturing stage but also during the in-transit or in the field after shipment, and the threat may extend to devices that are not considered to be threatened by HT insertion implemented inside conventional ICs. This paper discusses the detection method for the HT insertion, which is implementable on a PCB without external measurement equipment. Additionally, we validate the method in more practical situations, detecting the HT on populated PCBs. The method employs an on-chip touch sensor to measure the changes in electrical characteristics caused by HT insertion. Specifically, HT insertion is detected by observing the change in capacitance and insulation resistance associated with HT insertion using the on-chip sensor, and detecting the difference from the measurement result when HT is not inserted to signal traces. In the experiment, we build an evaluation environment, which emulates a populated PCB, based on the HT insertion method reported in previous studies and observe the change in capacitance and insulation resistance on the connected signal trace using a microprocessor equipped with a constant current source and an analog-digital converter that constitute the onchip sensor. Then, we show that HT insertion on the signal trace can be detected from the output values of the on-chip sensor before and after HT insertion.

This work proposes a novel hardware Trojan detection method that leverages static structural features and behavioral characteristics in field programmable gate array (FPGA) netlists. Mapping of hardware design sources to look-up-table (LUT) networks makes these features explicit, allowing automated feature extraction and further effective Trojan detection through machine learning. Four-dimensional features are extracted for each signal and a random forest classifier is trained for Trojan net classification. Experiments using Trust-Hub benchmarks show promising Trojan detection results with accuracy, precision, and F1-measure of 99.986\%, 100\%, and 99.769\% respectively on average.

In recent years, with the globalization of semiconductor processing and manufacturing, integrated circuits have gradually become vulnerable to malicious attackers. In order to detect Hardware Trojans (HTs) hidden in integrated circuits, it has become one of the hottest issues in the field of hardware security. In this paper, we propose to apply Principal Component Analysis (PCA) and Support Vector Machine (SVM) to hardware Trojan detection, using PCA algorithm to extract features from small differences in side channel information, and then obtain the principal components. The SVM detection model is optimized by means of cross-validation and logarithmic interval. Finally, it is determined whether the original circuit contains a hardware Trojan. In the experiment, we use the SAKURA-G FPGA board, Agilent oscilloscope, and ISE simulation software to complete the experimental work. The test results of five different HTs show that the average True Positive Rate (TPR) of the proposed method for HTs can reach 99.48\%, along with an average True Negative Rate (TNR) of 99.2\%, and an average detection time of 9.66s.

In order to visually present all kinds of hardware Trojan horse detection methods and their relationship, a method is proposed to construct the knowledge graph of hardware Trojan horse detection technology. Firstly, the security-related knowledge of hardware Trojan horse is analyzed, then the entity recognition and relationship extraction are carried out by using BiLSTM-CRF model, and the construction of knowledge graph is completed. Finally, the knowledge is stored and displayed visually by using graph database neo4j. The combination of knowledge graph and hardware Trojan security field can summarize the existing detection technologies, provide a basis for the analysis of hardware Trojans, vigorously promote the energy Internet security construction, and steadily enhance the energy Internet active defense capability.

Outsourcing Integrated Circuits(ICs) pave the way for including malicious circuits commonly known as Hardware Trojans. Trojans can be divided into functional and parametric Trojans. Trojans of the first kind are made by adding or removing gates to or from the golden reference design. Trojans of the following type, the golden circuit is modified by decreasing connecting wire’s thickness, exposing the chip to radiation, etc. Hardware Trojan detection schemes can be broadly classified into dynamic and static detection schemes depending on whether or not the input stimulus is applied. The proposed method aims to detect functional Trojans using the static detection method. The work proposes a generic, scalable Trojan detection method. The defender does not have the luxury of knowing the type of Trojan the circuit is infected with, making it difficult for accurate detection. In addition, the proposed method does not require propagating the Trojan effect on the output, magnifying the Trojan effect, or any other voting or additional algorithms to accurately detect the Trojan as in previous literature. The proposed method analyses synthesis reports for Trojan detection. Game theory, in addition, aids the defender in optimal decisionmaking. The proposed method has been evaluated on ISCAS’85 and ISCAS’89 circuits. The proffered method detects various types of Trojans of varying complexities in less time and with 100\% accuracy.

The paper presents a Tbps-class anonymity router that supports both an anonymity protocol and IP by leveraging a programmable switch. The key design issue is to place both the compute-intensive header decryption function for anonymity protocol forwarding and the memory-intensive IP forwarding function on the processing pipes of a switch with satisfying its hardware requirements. A prototype router on a programmable switch achieves Tbps-scale forwarding.