Design-Agnostic Distributed Timing Fault Injection Monitor with End-to-End Design Automation

Hijacking the clock signal is the most intuitive way to trigger a timing violation since the setup time and the hold time requirements are relative to the clock edge. In a highly optimized design, shifting the clock signal forward/backward will likely violate the setup/hold time requirement [10], [11], [12], [13]. Clock glitches and abnormal clock patterns can be induced through external clock pins, software/firmware control of the clock generator, physical interference, or hardware trojans. More advanced attacks have been demonstrated recently, in which dynamic voltage and frequency scaling of a CPU/GPU is exploited to disrupt the timing [14].

Apparently, a wide variety of clock glitches can be induced in practice. Without losing generality, we categorize all possible clock glitches into four major classes with twelve types of waveforms (Fig. 2) to illustrate the coverage of our FIA sensor. While these elemental glitches may or may not form a valid FIA when used alone, real-world clock glitches are likely a temporal-spatial combination of the elemental glitches and will be detected if our sensor covers all the basic elements.

The other entry point for timing FIAs is the data input to the register. If the clock edge remains the same but the data arrives too late, a setup time violation will happen. Similarly, a hold time violation can be triggered when the data changes too fast after the clock edge. An attacker can hack the delay of logic gates and thus the data arrival time, by altering the chip’s operating conditions, as shown in Fig. 3.

Generally, chip-level FIA mitigations follow three directions: logic checking, adaptive design, and anomaly detection.

The key principle of our FIA monitor is to track the clock pulse width with a clock replica circuit. The clock replica circuit locks its pulse width to that of the normal system clock. Since any clock signal naturally exhibits jitter and variations from noise and uncertainties, we introduce a programmable acceptance window, as shown in Fig. 4. Under normal operations, the system clock falls within this acceptance window. If the clock’s pulse width is shorter (longer) than the programmed minimum (maximum) threshold, the replica circuit reports an attack has been detected.

This clock pulse width monitoring scheme is effective regardless of whether the attacker hijacks the clock signal or alters the data path delay. If an FIA is mounted by altering the clock signal, the system clock’s pulse width will differ from the locked pulse width and the attack can be detected. If the attacker targets timing violations by glitching the voltage, temperature, and EM conditions, the distributed clock replica’s pulse width will be affected by the attack and deviate from the actual clock (Fig. 5), thus raising alerts. The only possible way to bypass the monitor is to change the delay of the gates and then match that delay with the pulse width of the clock accordingly. However, since the delay and the clock match in this case, there are no timing violations in the first place.

We employ digital delay lines to realize the clock replica and the acceptance window, as shown in Fig. 6. The clock is first passed into the main configurable delay line to produce a pulse $\text{P}_{\text{Min}}$, which determines the minimum acceptable delay $\text{D}_{\text{Min}}$. A second configurable delay line is used to further delay the rising edge of the clock, creating $\text{P}_{\text{L}}$. $\text{D}_{\text{L}}$, derived from $\text{P}_{\text{L}}$, will be calibrated by an FSM to be the same as the clock’s pulse width. Similarly, the maximum acceptable clock uncertainty is $\text{D}_{\text{Max}}$, which is set by $\text{P}_{\text{Max}}$, the output of the last configurable delay line.

With the three pulses generated by the configurable delay lines, FIAs can be detected in the same cycle as the fault is injected (Fig. 7). The values of $\text{D}_{\text{Min}}$, $\text{D}_{\text{L}}$, and $\text{D}_{\text{Max}}$ are sampled at the falling edge of the clock signal to produce $\text{R}_{\text{Min}}$, $\text{R}_{\text{L}}$, and $\text{R}_{\text{Max}}$. Under normal operations, the clock’s negative edge comes after $\text{D}_{\text{Min}}$ but before $\text{D}_{\text{Max}}$. Therefore, $\text{R}_{\text{Min}}$ should be 0 while $\text{R}_{\text{Max}}$ needs to be 1. Any other combination of $\text{R}_{\text{Min}}$ and $\text{R}_{\text{Max}}$ values indicates that the clock pulse width diverges from the expected value and an alert is raised.

A single FIA monitor is able to detect nine out of twelve types of clock glitches because the monitor only locks and monitors the positive pulse width of the clock. The remaining three glitch types affect the negative pulse width of the clock while leaving the positive pulse width intact, as illustrated in Fig. 8b. To capture these glitches, another copy of the monitor can be inserted to track the negative phase of the clock. With this dual-monitor setup, all types of glitches can be captured. The placement of these monitors is flexible; they are not required to be deployed in pairs. Each monitor can work independently to detect most types of clock glitches as well as voltage, EM, and temperature glitches. Alternately placing the monitors for the positive and the negative clock phases across the chip in a checkerboard fashion is a possible scheme for increasing comprehensive coverage with low overheads.

To ensure that the FIA monitor is synthesizable, the delay lines are constructed using only standard cells. This standard-cell-only design enables automatic place and route with software and guarantees that the monitor is technology-agnostic.

The main configurable delay line is broken down into three stages in order to provide a wide delay tuning range while maintaining a small footprint (Fig. 9). The coarse stage counts the cycles of a ring oscillator (RO). Once the pre-defined cycle number ($\text{Conf}_{\text{c}}$) has been reached, the coarse stage outputs 1, and the medium stage takes over. The medium stage is a path-selection delay line with thermometer-coded control bits [32]. When the control bits are all one, the input needs to propagate through all the stages to reach the output port. If the control code is all zero, on the other hand, the input travels through the first stage and goes directly to the output. Note that the two delay lines to tune the acceptable window also have the same structure. The fine stage is built from standard-cell-based varactors with sub-gate-delay resolution. Such varactors work on the principle that the capacitance at a logic gate’s port (NAND, NOR, etc.) depends on the voltage at other ports. By holding other ports at 0 or 1, the delay, which is affected by the loading capacitance, can be tuned at a high precision.

Here, both the coarse stage and the fine stage can be bypassed for two purposes: to increase the maximum locking frequency and to reduce power consumption. The coarse stage and the fine stage have a relatively large delay offset, i.e., the inherent delay when the control code is 0. When all control bits are 0, skipping these two stages can further reduce the delay and increase the upper bound of the frequency range at the cost of resolution loss. As for the power consumption, the coarse stage (RO plus the counter) dominates the total power usage. Bypassing the coarse stage prevents the RO from oscillating and, therefore, reduces the power consumption.

Real-time delay-locking is implemented on-chip as a Finite State Machine (FSM) to eliminate off-chip calibration. The FSM automatically configures the delay line to lock to the pulse width of the clock. As shown in Fig. 10, it determines the configurations for the three delay stages step by step. The FSM starts with all configurations reset to zero and then sequentially calibrates coarse, medium, and fine stages. The coarse stage tuning can be completed in one cycle: the FSM times the system clock’s pulse width with the ring oscillator inside the coarse stage. The configuration for the coarse stage is exactly the ring oscillator cycles it takes for the system clock to rise and fall back to zero again.

To tune the medium or the fine stage, the FSM linearly searches for the delay configuration. The FSM increments the delay control bits by one until $R_{L}$ becomes one, which indicates that the pulse width of the replica is longer than that of the system clock. Then, the FSM will decrease the control bits to reduce the delay. At this point, the locked delay is the maximum delay that is less than the clock’s pulse width. Therefore, the linear search is completed if the pattern “010” is found on $R_{L}$. On the other hand, if the minimum configuration (i.e., all zeros) is already too large, the FSM will sequentially try bypassing the coarse and fine stages to reduce the delay offset of the configurable delay line. If the FSM still cannot lock to the clock, it terminates and reports an error.

The initial locking process above is performed once right after the system powers up or resets. The monitor starts FIA detection after this initial phase. The FSM then switches into the Full Range Linear Tracking mode. In this mode, the FSM dynamically matches the delay configurations to the clock signal using the finest step. Temporal Majority Voting is used to low-pass filter $R_{L}$ for better stability. The purpose of this mode is to tolerate and track the slow drifting of the clock due to clock source drifts, environmental changes, or device aging. Otherwise, the clock signal may drift out of the acceptance window without any FIAs, which will trigger false alerts.

Clock drift is not the only source of potential false alerts. The coarse, medium, and fine stages in the fully synthesized delay line will not match perfectly to have a monotonic relation with the digital delay calibration bits. This is an intentional design choice because the automatic placement and routing procedure inevitably introduces delay mismatches unless significant efforts are made to match the layout. Indeed, the tuning range of a finer stage is designed to be greater than one step in the coarser stage. As shown in Fig. 11a, when the finer tuning stage reaches the maximum value and returns to zero, the coarser stage will increase by one. Because of the mismatch, the delay will decrease even if the overall configuration bits are increasing. This delay drop could cause the clock edge to fall out of the tolerance window and trigger a false alert. To overcome this issue, programmable configuration skips are introduced to ensure that the delay monotonously increases as the configuration bits increase. Fig. 11b demonstrates one example in which one medium step and nine fine steps are skipped after each coarse step increase while six fine steps are skipped for each medium step increase. Specifically, when the coarse configuration increments by one, the medium bits and the fine bits start from one and nine, respectively, instead of zero. This scheme guarantees that false alerts are minimized even with the presence of mismatches between the delay tuning ranges.

The workflow for designing the delay line is summarized in Fig. 13. The framework needs to decide which delay cells to use for the medium and the fine stages, as well as how many of these cells to use. The coarse stage is fixed to be the RO-counting topology because this topology’s area scales sublinearly with the delay tuning range. The delay line generator iterates through all pairs of medium and fine cells in the user-specified delay cell list. For each pair of cells, Python generates an evaluation netlist and invokes the spice simulator to determine the cell’s delay when the control bit is 0 and 1. The resolution of the cell is calculated as the delay difference when the cell is turned on and off. The cell with the greater delay difference is assigned as the medium stage, with the other as the fine stage. Since the delay tuning range of the finer stage must be greater than one delay tuning step in the coarse stage, the number of cells to use in each stage is straightforward: the ratio between the two stages’ resolution is rounded up to be the number of cells in the finer stage. The user may specify an additional margin to ensure that the finer stage’s range is enough considering the variations. If a $50\%$ margin is used, the number of cells in the finer stage becomes 1.5 times the resolution of the coarser stage divided by the finer stage’s resolution, rounded up to the nearest integer.

While the coarse stage’s topology is fixed, the framework still has to optimize the number of stages in RO. A shorter RO leads to a smaller coarse step, which reduces the number of medium cells. However, since the delay line needs to cover the user-specified delay tuning range, a smaller coarse step means that a larger counter must be used. To optimize under this tradeoff, the framework first simulates the period of the RO with the smallest number of stages. This period is also the smallest coarse step, which determines the maximum number of counter bits. Then, the framework increases the number of stages in the RO by two at a time, calculates the number of cells in each stage, and evaluates the total area of the delay line. As shown in Fig. 14, the counter’s footprint dominates the total area in the beginning. As the number of stages in the RO increases, the counter becomes smaller, and the medium stage eventually dominates the total area.

Once the framework determines the RO design, it performs post-layout simulations to evaluate the current design built from the two selected delay cells. It executes standard EDA tools with Tcl scripts to place and route the delay line and obtains the post-layout netlist. Spice simulations are run on the post-layout netlist by Python to extract the delay tuning range and the resolution of each stage. The framework first verifies that the tuning range of the finer stage indeed covers one tuning step of the coarser stage and then examines whether the resolution and the tuning range pass the user-specified requirements. If all constraints are met, the framework records the area and optionally power data of the current topology. Otherwise, the framework tries to fine-tune the design and discard the current circuit if the fine-tuning attempt fails. In either case, the framework finishes evaluating the selected pair of delay cells and moves to the next.

After exhaustively searching for all designs that meet the specifications, the framework decides the one with the smallest area. The framework also supports optimization based on power consumption when the monitor’s power is a concern. To enable this function, the user must define the frequency at which the monitor’s power should be evaluated. The framework can combine the area and the power consumption with programmable weights as the cost function for optimization.

After obtaining the optimized configurable delay line, the framework attaches the auto-calibration FSM to it and completes the monitor design. The number of control bits in each stage is parameterized so the framework can reuse the FSM for any delay line design without modifying the code. From this step, the framework follows the standard backend flow to generate the monitor layout. The user can then instantiate the monitor design wherever FIA protection is desired.

We evaluated the automated framework with four specifications in 65nm CMOS, shown in the first four rows of Table I. To demonstrate technology scalability, we also generated two designs with a 28nm CMOS PDK, with more details in Section VI. The first row is a scenario demanding both a wide frequency range and a high resolution. For comparison, the second row showcases that by lowering the resolution requirement, higher frequencies can be achieved without bypassing the fine stage. The design is also slightly smaller than the first scenario. The third and fourth rows demonstrate the use cases for low and high frequencies, respectively. The low-frequency scenario does not require the fine stage, while the counter-based coarse stage is omitted when only high frequencies are targeted. In all scenarios, the path-selection-based delay line is chosen as the medium stage because of its small overhead in terms of delay offset and footprint.

The design shown in the first row of Table I is fabricated and verified in 65nm LP CMOS. The design is automatically placed and routed by industry-standard software without any manual adjustment or optimization. Each chip contains ten monitors, and each monitor takes a footprint of $30\mu m\times 50\mu m$ (Fig. 15), or equivalently $355,000F^{2}$ if calculated with the feature size (F) of 65nm.

Fig. 16a showcases the locking process of the configurable delay line. In this particular case, the clock frequency is $250MHz$, and the locking process takes 15 cycles, or $60ns$. Depending on the pulse width of the clock, it takes from 7 to 26 cycles for the monitor to lock to the clock: 1 cycle for the coarse stage, 3 to 9 cycles for the medium stage, and 3 to 17 cycles for the fine stage. The lower bound of the medium and the fine stage is determined by the length of the “010” pattern, and the number of possible configurations in each stage decides the upper bound.

Fig. 16b summarizes the range and the resolution of the three delay tuning stages. The tuning step is extrapolated from the maximum and the minimum delay for each stage, assuming that the delay increase is linear. While the fine stage has the finest resolution, the offset of the fine stage is the greatest. Therefore, the option to bypass the fine stage is implemented. With this option, the total tuning range of the configurable delay line is $400ps$ to $257ns$ at $1.2V$, or equivalently $2MHz$ to $1.26GHz$. The lower frequency limit can be reduced by increasing the number of configuration bits in the coarse stage. As the coarse stage is based on counting the ring oscillator cycles, this change incurs almost no overhead.

In total, fifty DUTs are tested, and the locking frequency results are shown in Fig. 17 and Fig. 18. The locking frequency range shows minimum variations across fifty DUTs. The temperature also does not significantly affect the frequency range. The locking frequency does change with the supply voltage. This dependency is anticipated as the monitor is expected to reflect the logic gates’ delay at different voltages.

The miss rates of the monitor for each clock glitch type with different acceptance window configurations are listed in Fig. 19b. Clock glitches of the 12 types are injected into the normal $250MHz$ clock using the on-chip $2GHz$ arbitrary pattern generator. The glitch width is set to be $500ps$. A conceptual diagram for this testing setup is shown in Fig. 19a. A pair of monitors is tested in order to detect every type of clock glitch, as explained in Section III. When the acceptance window is less than or equal to $400ps$, all 12 types of clock glitches can be accurately detected. At $500ps$ or larger, the monitor cannot distinguish clock glitches of type $\text{T}_{\text{5-12}}$ from clock jitters. $\text{T}_{\text{1-4}}$, on the other hand, can still be detected by the monitor. $\text{T}_{\text{3-4}}$ merges three clock pulses into a longer clock phase. These glitches can always be identified because the acceptance window will never exceed one pulse width of the clock. $\text{T}_{\text{1-2}}$ involves splitting a clock pulse into three segments. Such changes can be detected as long as any of the modified clock edges falls out of the acceptance window.

To better demonstrate the monitor’s remarkable ability to detect pulse injection attacks on the clock, a fast pulse addition circuit is implemented on the chip. Fig. 20a depicts the principle of the adder circuit and how it interacts with the monitor. This testing circuit can inject pulses as short as $100ps$ into the clock signal. Again, our monitor can detect all of these glitches even when the acceptance window is greater than the injected pulse width, as shown in Fig. 20b.

The testing results prove that our monitor can detect all 12 types of glitches, provided that the acceptance window setting is reasonable. Since real-world clock glitch attacks can always be viewed as a combination of these 12 types, our monitor is able to detect FIAs based on clock glitches precisely.

Besides the clock signal, FIAs can also be mounted by altering the delay of the logic gates. These alternations can be achieved by manipulating the operating environment of the chip, such as the supply voltage, the temperature, or even EM signals. The monitor is evaluated to determine if it can detect these physical fault injection attacks. The clock frequency is $100MHz$ in all of the tests below.

The monitor is tested across a wide range of temperatures and voltages. The power consumption at each tested point is depicted in Fig. 24 and Fig. 25. The monitor is able to function across the automotive temperature range, which is $-40$ to $125^{\circ}C$. It can be inferred from the figure that the tuning frequency is insensitive to the environment temperature. The monitor is also validated under a versatile of voltages, from $0.5V$ to $1.4V$. The average power of the fifty DUTs is $0.487mW$ at $1.2V$, $25^{\circ}C$, when they are locked to a $250MHz$ clock. Fig. 25b shows the power breakdown at various locking frequencies. The coarse stage dominates the power consumption at lower frequencies because it contains a counter triggered by an active RO. After the coarse stage is bypassed at $833MHz$, the delay window logic consumes the majority of the power.