A Methodology to Distribute On-Chip Voltage Regulators to Improve the Security of Hardware Masking

Abstract

Hardware masking is used to protect against side-channel attacks by splitting sensitive information into different parts, called hardware masking shares. Ideally, a side-channel attack would only work if all these parts were completely independent. But in real-world VLSI implementations, things are not perfect. Information from a hardware masking share can leak to another, making it possible for side-channel attacks to succeed without needing data from every hardware masking share. The theoretically supposed independence of these shares often does not hold up in practice. The effectiveness of hardware masking is reduced because of the parasitic impedance that stems from power delivery networks or the internal structure of the integrated circuit. When the coupling effect and noise spread among the hardware masking shares powered by the same power delivery network, side-channel attacks can be carried out with fewer measurements. To address this, we propose a new method of distributing on-chip voltage regulators to improve hardware masking security. The benefits of distributed on-chip voltage regulators are evident. Placing the regulators close to the load minimizes power loss due to resistive losses in the power delivery network. Localized regulation allows for more efficient adjustments to the varying power demands of different chip sections, improving overall power efficiency. Additionally, distributed regulators can quickly respond to power demand changes, maintaining stable voltage levels for high-performance circuits, leading to improved control over noise. We introduce a new DLDO voltage regulator that uses random clocking and randomizing limit cycle oscillations to enhance security. Our simulations show that with these distributed DLDO regulators, the t-test value can be as low as 2.019, and typically, a circuit with a t-test value below 4.5 is considered secure.

1. Introduction

The privacy and security of modern computing devices have become crucial, as these devices are increasingly integrated into our daily lives. Cryptographic algorithms are therefore implemented to secure and protect the privacy of data. Lightweight encryption and decryption are used to achieve fast and power-efficient performance, but side-channel attacks still pose a threat to the security of these cryptographic devices. Attackers can obtain critically sensitive values of an encryption algorithm to reveal sensitive information via physical leakage signatures. To prevent private data leakage, various countermeasures have been developed [1,2]. These countermeasures against side-channel attacks can generally be classified into two main strategies: (i) shuffling and (ii) hiding the private data. Masking-based countermeasures fall under the shuffling category, where an n-bit secret is divided into N shares, akin to multi-party computation.

The hiding countermeasures require strict conditions such as aligned signal propagation and balanced routing to achieve acceptable protection. However, meeting these strict conditions is challenging due to the parasitic effects of advanced technology nodes in various conditions [3]. A well-performing preprocessing and machine learning approach has the potential to extract information from an encryption device that incorporates inadequate security measures. Among the array of countermeasures available, hardware masking is commonly effective in thwarting different attack methods, thanks to its resilient design supported by theoretical foundations [4].

Masking involves partitioning the critically sensitive information into a set of $d+1$ shares, a configuration commonly used in dth-order Boolean masking. In this arrangement, the sensitive information is the combined result of Boolean addition applied to each of these shares. The computations within each share are not concealed, and standard dth-order hardware masking can be overcome by a more advanced $(d+1)$th-order side-channel attack. The success of effective masking rests on the fundamental assumption that the shares constituting a masking operation are independent. This assumption’s significance cannot be underestimated, as any deviation from independence can result in information leakage due to correlation among the shares. Such leaks can lead to a dth-order attack becoming successful against an encryption device protected by dth-order hardware masking. While dth-order hardware masking enhances security by splitting sensitive data into multiple hardware masking shares, any compromise in the independence of these shares can expose the system to serious security vulnerabilities [5]. Hardware masking can be implemented either in software or hardware. The software-based approach to hardware masking tends to be inherently sequential and can incur substantial costs due to lengthy execution times and extensive code size [6]. In contrast, hardware-based masking capitalizes on its inherent parallelism, making it exceptionally adaptable. This characteristic suits it well for applications demanding high-performance capabilities.

Challenges in implementing hardware masking practically arise from issues like parasitic impedances, transistor variations, and interconnection modifications caused by aging, temperature shifts, and manufacturing processes, making it difficult to maintain the assumption of independent masking shares. The distance between theory and hardware masking practice arises from the persistent Hamming distance leakage due to shared integrated circuit components among hardware masking shares; interdependent leakage caused by chip manufacturing techniques; and the propagation of glitches through logic gates and between hardware masking shares. The literature extensively explores the interdependence of hardware masking shares and applicable mitigation strategies [4,5,7,8,9,10,11,12,13].

Despite numerous countermeasures against side-channel attacks, few specifically address the vulnerabilities associated with hardware masking. While voltage fluctuations in the power delivery network (PDN) have been well explored, the security implications of noise on hardware masking are often overlooked [14,15]. Many studies [16,17,18] focus on using voltage regulators to conceal power signatures from potential adversaries. In contrast, our work emphasizes enhancing the security of hardware masking by dividing sensitive information into masking shares. We specifically utilize a proposed Digital Low Dropout Regulator (DLDO) to improve security, whereas previous works [17,18] have employed buck, LDO, and switch capacitor voltage regulators to obscure leakage signatures. To our knowledge, only a few studies [19,20,21] have examined the security vulnerabilities of hardware masking within the application-specific integrated circuit (ASIC) design flow, without considering on-chip voltage regulators. Thus, we propose a lightweight integration of countermeasures to enhance hardware masking security through voltage regulators. This approach can be applied to any hardware masking implementation across various encryption algorithms.

The advantages of distributed on-chip voltage regulators can be listed in the aforementioned advantages. By positioning the voltage regulators near the load, the power loss from resistive losses in the power delivery network is minimized. Localized regulation can more efficiently adjust to the varying power demands of different chip sections, enhancing overall power efficiency. Distributed regulators can quickly respond to changes in power demand, maintaining control of the voltage levels for high-performance circuits. We leverage the benefits of distributed on-chip voltage regulators and carefully manage the noise they generate.

Firstly, to our knowledge, this is the first time that a proposed Digital Low Dropout Regulator (DLDO) has been utilized to enhance the security of hardware masking by introducing random delays and amplitudes of limit cycle oscillation. Secondly, we validate the methodology to distribute on-chip voltage regulators into quadrants on the power delivery network, demonstrating that the security of hardware masking improves as the on-chip voltage regulators are placed at a close distance to the hardware masking shares. Thirdly, we propose a security evaluation with test vector leakage assessment (TVLA) for each quadrant of the power delivery network to assess the impact of various voltage regulator topologies and placement strategies.

In addition to the previous contributions, the pre-silicon evaluation framework is proposed since the evaluation framework in pre-silicon is not common [22]. The vulnerabilities due to the effects are determined and eliminated in this framework. On the other hand, during the post-silicon phase, accessing comprehensive design details might not be feasible, particularly when employing third-party components. As a result, pinpointing the origin of leakage can pose difficulties. Furthermore, the tasks of identifying, confirming, and addressing side-channel leaks necessitate specialized expertise and costly equipment.

2. Distributed On-Chip Voltage Regulators

An off-chip voltage source, whether from a battery or an external voltage converter, is connected to the on-chip global power grid through a pad on the integrated circuit. Modern systems typically incorporate both off-chip and on-chip voltage converters. The global power grid’s voltage is then regulated and adjusted to various levels for different load circuits via a local power grid. This power grid consists of orthogonal metal lines linked by vias. Because of the complex routing between loads and voltage regulators, the resistive effects of the power grid become significant. This results in an IR drop, causing voltage drops within the same power distribution grid to be correlated. On-chip voltage regulators are strategically placed to manage this correlation and keep it within acceptable bounds. The approach outlined in the preceding sections is designed to reduce the correlation between load circuits, thereby enhancing the security of on-chip circuits, particularly those used for cryptographic functions.

A simplified power delivery network (PDN) can be observed in Figure 1. An external power source is the main power source of the integrated circuit where the parasitic resistances due to the external effects are lumped in $R_{External}$. The voltage is regulated with an on-chip voltage regulator to obtain a stable voltage level for the integrated circuit. The parasitic resistances are represented as $R_s$, $R_1$, $R_2$, and $R_3$. The parasitic capacitances are $C_1$, $C_2$, and $C_3$. The $C_{decap}$ is added to provide better on-chip voltage regulation. The voltages to Share 1 and Share 2, $V_1$ and $V_2$, decrease from the desired voltage levels due to the parasitic effects on the power delivery network. The internal parasitic elements are due to the internal metal layers, internal structures of transistors, and capacitances between internal layers. The external parasitic effects are due to the external metal layers, which carry power from the external power source and integrated circuit. The effect of inductive parasitics may be added series to the parasitic resistances for further analyses but this simplified power delivery network is sufficient to represent the details.

The aforementioned sections describe a methodology to decrease the correlation between load circuits to improve the security of the on-chip circuits, which are designed to improve the security of the cryptographic circuits.

2.1. Proposed Algorithm

Welch’s t-test [23] is used to determine if a circuit’s behavior differs under two distinct inputs, such as a fixed input versus a random one. The test statistic is given by

$$\begin{array}{c}\hfill t(X,Y)={\displaystyle \frac{E\left(X\right)-E\left(Y\right)}{\sqrt{\frac{{\sigma }_X^2}{N_X}+\frac{{\sigma }_Y^2}{N_Y}}}},\end{array}$$

(1)

where X and Y represent two random distributions, E(X) and E(Y) are their expected values, and ${\sigma }_X$ and ${\sigma }_Y$ are the standard deviations of X and Y, respectively. This hypothesis testing method assesses the similarity between X and Y. If the computed t-test value is less than 4.5, the test provides a 99.99% confidence interval, indicating that X is statistically different from Y. Consequently, t-test values below 4.5 are generally considered to show no significant leakage [5,7,19].

The iterative process of partitioning the PDN into quadrants is shown in Figure 2. Each quadrant has a dedicated on-chip voltage regulator in the center of the quadrant. The voltage fluctuations are minimized to obtain the $max|t-score|$ under 4.5. To describe the iterative progress in Figure 2, the power grid is divided into four quadrants at the first round of iteration as can be observed in Figure 3.

2.2. Proposed Digital Low Dropout Voltage Regulators

The schematic of the proposed Digital Low Dropout Regulator (DLDO) is shown in Figure 4. In this design, $V_{ref}$ and $Pseudo$ $clk$ serve as the inputs, while $V_{out}$ is the output. Figure 5 and Figure 6 detail the schematic and operational principles of the bi-directional shift register used in conventional DLDOs. The bi-directional shift register in this context includes a multiplexer and a D flip-flop (DFF) in each stage. The digital controller adjusts the value $Q_i$ as depicted in Figure 6. The DLDO setup features N parallel PMOS transistors and a feedback control mechanism for output voltage regulation. In conventional DLDOs, a bi-directional shift register is employed. Here, $M_i$ denotes the ith PMOS transistor, and $Q_i$ represents the output from the digital controller, with ith indicating the activation stage of the digital controller. The shift register toggles the state of one of the power transistors based on $V_{cmp}$ at each rising edge of the $pseudo$ $clk$ cycle. $Q_N$ represents the Nth output signal of the digital controller as illustrated in Figure 4. During step $k+1$, if $V_{cmp}$ is high, $Q_{n+1}$ ($Q_n$) is activated on (off) with the bi-directional shift register shifting to the right. Conversely, if $V_{cmp}$ is low, the shift register moves to the left as shown in Figure 6 [24]. Each $M_n$ is linked to $Q_n$, and due to the bi-directional activation scheme, the transistors $M_1$ through $M_n$ experience high usage. The limit cycle reduction technique from [25] is applied in a randomized behavior. This technique connects four parallel PMOS transistors to $V_{out}$, randomizing limit cycle operations for more efficient, reliable, and secure voltage regulation.

A new DLDO with a $pseudo$ $clk$ and randomly gated PMOS at limit cycle reduction is proposed. The $pseudo$ $clk$ signal is generated with different frequencies at the operation of the DLDO, leading to frequency modulation at the digital controller. The frequency of the digital controller changes randomly between 50 Mhz and 2 Ghz in the time domain operation of DLDO. The frequency change in the time domain creates delays in the sampling of the output voltage, leading to different limit cycle values at the output of the DLDO. The random delays create noise in the output of the DLDO without affecting the efficiency. Another randomization stage is added with the limit cycle reduction circuit. Four PMOS transistors are gated randomly during the operation of the DLDO. The $\beta$ value is changed randomly between one and four at the regular operation of DLDO. This change creates a random limit cycle reduction at the output of the DLDO, leading to noise which can improve the security. The effect of the security improvement is discussed in the analysis section.

2.3. Proposed Pre-Silicon Leakage Detection Framework

The proposed analysis framework consists of two stages: dynamic analyses and security analyses. The layout netlist contains the switching circuits with countermeasures and other circuits. The 32 nm PTM technology is used for the framework. We collect 100 k power traces with constant input and random input to the circuit, where the operation of the circuit is dependent on the variation in the input. We analyze a 16 × 16 resistive PDN with ideal voltage regulators and the proposed DLDO with Finesim. The TVLA method is utilized for the security analyses which contains the calculation of t-score, i.e., fixed vs. random t test. The flowchart of the proposed pre-silicon leakage detection framework is summarized in Figure 7.

3. Power Grid Analyses

The proposed methodology to distribute voltage regulators and the proposed DLDO are analyzed with the hardware masking. The second-order hardware masking circuits are analyzed on a 16 × 16 resistive PDN with the grid resistance 5 $\mathsf{\Omega }$.

3.1. Distribution of Ideal Voltage Regulators

The proposed distribution of voltage regulators framework is applied to the second-order hardware masking. One of the hardware masking shares is located at the bottom left, and the other hardware masking share is located on the top right of the PDN as can be observed in Figure 8. The ideal voltage regulator is located at the center of the PDN, and the $max|t-score|$ is 8.302, which is higher than the desired security level, i.e., 4.5. Therefore, the PDN is divided into quadrants. All the quadrants except the bottom left quadrant satisfy the security level defined in the t-test. The bottom left quadrant is also divided into quadrants. The seven ideal voltage regulators satisfy the required security level. The $max|t-score|$ is reported in Figure 8, where the required security is satisfied in (c). The minimum $max|t-score|$ is 2.321, and the maximum $max|t-score|$ is 3.258.

3.2. Distribution of Conventional DLDO Voltage Regulators

The proposed distribution of voltage regulators framework is applied to the second-order hardware masking with the conventional DLDO. The one hardware masking share is located at the bottom left, and the other hardware masking share is located on the top right of the PDN as can be observed in Figure 9. The $max|t-score|$ reduces with four conventional DLDO voltage regulators placed on the center of the quadrants. The seven conventional DLDO voltage regulators satisfy the required security level as compared to the ideal voltage regulators distributed on the PDNp; the required voltage regulator remains the same as the ideal voltage regulator. The use of conventional DLDO has a similar effect to the ideal voltage regulators. The minimum $max|t-score|$ reduces to 2.019, which implies that the conventional DLDO has contributed to the security of the hardware masking.

3.3. Distribution of Proposed DLDO Voltage Regulators

The proposed distribution of voltage regulators framework is applied to the second-order hardware masking with the proposed DLDO. The one hardware masking share is located at the bottom left, and the other hardware masking share is located on the top right of the PDN as can be observed in Figure 10. The $max|t-score|$ reduces significantly with four proposed DLDO voltage regulators placed in the center of the quadrants. The four proposed DLDO voltage regulators satisfy the required security level as compared to ideal voltage regulators and conventional DLDO distributed on the PDN; the required voltage regulator reduces from seven to four. The effect of the noise which was generated with the frequency modulation and limit cycle oscillation randomization reduced the number of voltage regulators to satisfy the required security level.

The comparison of the other methods is given in

Table 1. The comparison of this work with other methods is based on the implementation used and the minimum number of traces required for leakage, defined as the number of traces needed for the t-test to exceed the threshold of 4.5.

	ASIC/FPGA	Implementation	Minimum Number of Traces for the Leakage (Higher Is Better)
[7]	ASIC	PDN	1 k
[20]	ASIC	PDN	18 k
[21]	ASIC	X	X
[30]	ASIC	PDN	80 k
This work	ASIC	PDN	>100 k

, where X means that there are no corresponding results published in the work. This work focuses on the utilization of on-chip voltage regulators on the PDN in application-specific integrated circuits (ASICs). The implementation of this work focuses on the PDN on ASIC; thus the focus of comparison of this table is based on the PDN. There are different topologies used in the literature. The common topologies are top–bottom topology and daisy chain topology [27,28,29]. Seven conventional DLDOs are distributed according to the proposed topology, top–bottom, and daisy chain, where the details can be observed in Figure 11. The $max\left(\right|t-score\left|\right)$ for top–bottom topology is 5.061, the $max\left(\right|t-score\left|\right)$ for daisy chain topology is 3.904, and the $max\left(\right|t-score\left|\right)$ for the proposed topology is 2.605 in

Table 2. The comparison of this work with other methods is based on the topology where seven conventional DLDOs are distributed.

	$\mathit{Max}$$\left(\right|\mathit{t}-\mathit{Score}\left|\right)$
Top–bottom [27,28]	5.061
Daisy chain [29]	3.904
This work	2.605

, where a $max\left(\right|t-score\left|\right)$ below 4.5 is considered to be no significant leakage, and the lower values for the $max\left(\right|t-score\left|\right)$ are considered secure. The $max\left(\right|t-score\left|\right)$ is the lowest for this work compared to other distribution methodologies.

4. Conclusions

A new methodology to distribute the voltage regulators is proposed to improve the security of the PDN. A new and efficient DLDO is proposed to improve the security of the PDN. The framework is tested on the second-order hardware masking on the 16 × 16 PDN. The seven ideal voltage regulators and conventional DLDO voltage regulators are distributed on the 16 × 16 grid PDN, satisfying the security requirements of the PDN as can be understood by comparing the $max|t-score|$ values within the PDN. The proposed framework with the proposed DLDO voltage regulator reduces the required number of voltage regulators by three. The proposed method to distribute the on-chip voltage regulators proved its effectiveness with the ideal voltage regulators, conventional DLDO voltage regulators, and proposed DLDO voltage regulators, with the $max|t-score|$ becoming as low as 2.019 with the 16 × 16 grid PDN.