New York University

Polytechnic University

Lucent Technologies Inc.

University of Kentucky Research Foundation

Agere Systems Guardian Corp.

Ramesh Karri

Jeyavijayan Rajendran

Ozgur Sinanoglu

Farshad Khorrami

Youngok Pino

Prashanth Krishnamurthy

Vinayaka Jyothi

Sateesh Kumar Addepalli

Malathi Veeraraghavan

Charles Eugene Stroud

Shianling Wu

Vivekananda Vedula

David Hely

Nilanjan Mukherjee

Arunshankar Dhandayuthapany

Nikhil Joshi

Brian Douglas

Jerry Backer

Haobo Wang

An aspect of behavior of an embedded system may be determined by (a) determining a baseline behavior of the embedded system from a sequence of patterns in real-time digital measurements extracted from the embedded system; (b) extracting, while the embedded system is operating, real-time digital measurements from the embedded system; (c) extracting features from the real-time digital measurements extracted from the embedded system while the embedded system was operating; and (d) determining the aspect of the behavior of the embedded system by analyzing the extracted features with respect to features of the baseline behavior determined.

Anomaly detection in real-time multi-threaded processes on embedded systems and devices using hardware performance counters and/or stack traces

The goal of detecting modifications, such as unauthorized modifications for example, of the code and/or behavior of an embedded device (e.g., unexpected/unauthorized remote reprogramming, re-flashing), changes to code at run-time (e.g., code injection, software parameter changes due to run-time reconfiguration commands), execution of unauthorized code, activation of hardware Trojans, and other attacks on the hardware and/or software of embedded devices (or more generally, for determining an aspect of behavior of an embedded device and/or an embedded system) is solved by (1) injecting at least one of (A) code and/or (B) inputs into the embedded system to cause the embedded system, when functioning as desired, to exhibit an identifiable baseline behavior determined from a sequence of patterns (also referred to as 'fiduciary markers') in observable side channel emissions of the embedded system; (2) measuring side channel emissions generated by the embedded system when the at least one of (A) code and/or (B) inputs is injected; (3) extracting features from the measured side channel emissions; and (4) determining the aspect of the behavior of the embedded system by analyzing the extracted features with respect to features of the baseline behavior.

Determining an aspect of behavior of an embedded device such as, for example, detecting unauthorized modifications of the code and/or behavior of an embedded device

An exemplary system, method and computer-accessible medium for determining a starting point of a header field(s) in a network packet(s) can be provided, which can include, for example receiving the network(s) packet, determining a header location of the header field(s) in the network packet(s), determining a delimiter location of a delimiter(s) in the network packet(s), and determining the starting point of the header field(s) based on the header and delimiter locations. The header location can be determined using a header finder module. The delimiter location can be determined using a delimiter finder module. The header and delimiter locations can be determined using a plurality of comparators arranged into a plurality of sets.

System, method and computer-accessible medium for network intrusion detection

An exemplary system, method and computer-accessible medium can be provided which can include, for example, generating a super control dataflow graph(s) (CDFG) by applying a plurality of electronic system level ESL design constraints associated with an integrated circuit, determining an upper bound(s) number and a lower bound(s) number based on a number of CDFGs in the super CDFG(s)&#x2014;with each number being one metric of a capability of the integrated circuit to resist reverse engineering attack&#x2014;, and inserting a component(s) into a register transfer level netlist to effectuate a modification of the upper bound(s) and the lower bound(s).

System, method and computer-accessible medium for security-centric electronic system design

Exemplary systems, methods and computer-accessible mediums can secure split manufacturing of an integrated circuit by modifying a previous location of at least one pin to a further location of the at least one pin based on a fault analysis procedure. A determination of the further location can include an iterative procedure that can be a greedy iterative procedure. The modification of the location of the at least one partition pin can be performed by swapping at least one further partition pin with the at least one partition pin.

System, method and computer-accessible medium for providing secure split manufacturing

An exemplary system for wrapping an intellectual property core (IP) bus master(s), can include, for example, a plurality of IP cores associated with the IP core bus master(s), and a wrapper module connected to a serial input of the IP core bus master(s) and a serial output of the IP core bus master(s), where the wrapper module can be configured to capture and shift a plurality of values of a system bus for a plurality of bus transfers associated with the IP core bus master(s) and the IP cores. The wrapper module can be further configured to modify a wrapper control logic and a wrapper boundary register of the IP core bus master(s). A plurality of terminals can be included, which can be coupled to the IP core bus master(s), and a plurality of wrapper cells can be included, which can be associated with the plurality of terminals.

System, method and computer-accessible medium for low-overhead security wrapper for memory access control of embedded systems

Exemplary systems, methods and computer-accessible mediums can encrypting a circuit by determining at least one location to insert at least one gate in the circuit using a fault analysis, and inserting the at least one gate in at least one section of the at least one location. The determination can include an iterative procedure that can be a greedy iterative procedure. The determination can be based on an effect of the particular location on a maximum number of outputs of the circuit.

Systems, processes and computer-accessible medium for providing logic encryption utilizing fault analysis

An exemplary system, method and computer-accessible medium for detecting the presence of a Trojan(s) in a circuit(s), can include, for example, receiving information related to a property(s) configured to determine the presence of the Trojan(s), and determining the presence of the Trojan(s) based on the property(s) and a design(s) of the circuit(s) using a bounded model checking tool.

System, method and computer-accessible medium for security verification of third party intellectual property cores

Exemplary systems, methods and computer-accessible mediums can be provided that can, for example, determine a camouflaging location(s) of the logic gate(s) using a fault analysis procedure, and can camouflage the logic gate(s) at the location(s) based on the determination. The camouflaging procedure can be performed by replacing the logic gate(s) at the camouflaging location(s) with a further camouflaged gate, which can have a dummy contact(s) or a vias.

System, method and computer-accessible medium for fault analysis driven selection of logic gates to be camouflaged

Exemplary systems, methods and computer-accessible mediums for encrypting at least one integrated circuit (IC) can include determining, using an interference graph, at least one location for a proposed insertion of at least one gate in or at the at least one IC, and inserting the gate(s) into the IC(s) at the location(s). The interference graph can be constructed based at least in part on an effect of the location(s) on at least one further location of the IC(s).

System, method and computer-accessible medium for facilitating logic encryption

A ring oscillator (RO) based Design-For-Trust (DFTr) technique is described. Functional paths of integrated circuit (IC) are included in one or more embedded ROs by (1) selecting a path in the IC, based on path selection criteria, that has one or more unsecured gates, and (2) embedding one or more ROs on the IC until a stop condition is met. An input pattern to activate embedded RO is determined. Further, a golden frequency which is a frequency at which the embedded RO oscillates, and a frequency range of the embedded RO are determined. A Trojan in the IC may be detected by activating the embedded RO (by applying the input pattern), measuring a frequency at which the embedded RO oscillates, and determining whether or not a Trojan is present based on whether or not the measured frequency of the RO is within a predetermined operating frequency range of the RO.

Ring oscillator based design-for-trust

Advanced Encryption Standard (AES) is an encryption algorithm for securing sensitive unclassified material by U.S. Government agencies and, as a consequence the de facto encryption standard for commercial applications worldwide. Performing concurrent error detection (CED) for protection of such a widely deployed algorithm is an issue of paramount importance. We present a low-cost CED method for AES. In this method, we make use of invariance properties of AES to detect errors. For the first time, the invariance properties of the AES, which are for the most part used to attack the algorithm, are being used to protect it from fault attacks. Our preliminary ASIC synthesis of this architecture resulted in an area overhead of 13.8% and a throughput degradation of 16.67%.

Invariance based concurrent error detection for the advanced encryption standard

A call signaling protocol that uses simplified messaging to set up, confirm set up, tear down, and confirm tear down of a connection. The available capacity of communications links is tracked so that it can be quickly determined whether or not a link can handle a call. Segments (e.g., time slots, wavelengths, etc.) of a link having enough available capacity are allocated by a separate operation. Connection state information is also tracked. The simple messages and information used by the signaling protocol permits it to be easily implemented in hardware. Such an implementation enables high-speed, high-capacity, call signaling.

Growing community of inventors

New York, NY, United States of America

Ramesh Karri