[Paper Review] COMA: Communication and Obfuscation Management Architecture

Kimia Zamiri Azar, Farnoud Farahmand+6 more|arXiv (Cornell University)|Sep 1, 2019

Physical Unclonable Functions (PUFs) and Hardware Security20 citations

TL;DR

COMA proposes a novel architecture for secure key management and communication in obfuscated ICs fabricated in untrusted foundries. By eliminating on-chip key storage, using PUF-based dynamic keys, and introducing two hybrid encryption modes (DCC for security, LCC for performance), COMA reduces area overhead by 14% compared to FORTIS while enabling unique chip authentication and activation-as-a-service for IoT and 2.5D systems.

ABSTRACT

In this paper, we introduce a novel Communication and Obfuscation Management Architecture (COMA) to handle the storage of the obfuscation key and to secure the communication to/from untrusted yet obfuscated circuits. COMA addresses three challenges related to the obfuscated circuits: First, it removes the need for the storage of the obfuscation unlock key at the untrusted chip. Second, it implements a mechanism by which the key sent for unlocking an obfuscated circuit changes after each activation (even for the same device), transforming the key into a dynamically changing license. Third, it protects the communication to/from the COMA protected device and additionally introduces two novel mechanisms for the exchange of data to/from COMA protected architectures: (1) a highly secure but slow double encryption, which is used for exchange of key and sensitive data (2) a high-performance and low-energy yet leaky encryption, secured by means of frequent key renewal. We demonstrate that compared to state-of-the-art key management architectures, COMA reduces the area overhead by 14%, while allowing additional features including unique chip authentication, enabling activation as a service (for IoT devices), reducing the side channel threats on key management architecture, and providing two new means of secure communication to/from an untrusted chip.

Motivation & Objective

• Address the critical security challenge of key leakage in obfuscated ICs fabricated in untrusted foundries.
• Eliminate the need to store the obfuscation unlock key within the untrusted chip to prevent side-channel and physical attacks.
• Enable dynamic, one-time activation keys that change per use, turning the key into a moving target against replay and brute-force attacks.
• Secure communication channels to and from the untrusted chip using two distinct cryptographic modes: a high-security double-encryption (DCC) and a high-performance, low-energy leaky encryption (LCC) with frequent key renewal.
• Support unique device identification and activation-as-a-service for IoT and 2.5D integrated systems, enhancing trust and scalability.

Proposed method

• Employ a PUF (Physically Unclonable Function) to generate unique, unpredictable secret keys per chip, eliminating hard-coded private keys.
• Use a TRNG (True Random Number Generator) to seed a PRNG (Pseudorandom Number Generator) for generating dynamic session keys, ensuring unpredictability.
• Implement two secure communication modes: DCC (Double-Encryption Communication) for high-security key and data exchange, and LCC (Low-Communication Cost) for high-throughput, low-energy transfer.
• Integrate public-key cryptography for secure PUF response readout, preventing software-based key extraction attacks.
• Design the architecture to support two deployment models: R-COMA (remote activation with key stored externally) and 2.5D-COMA (trusted chip in package for key management).
• Apply side-channel attack (SCA) hardening by limiting the use of secret-key cryptography to protected, short-lived operations and using public-key encryption only once per session.

Experimental results

Research questions

• RQ1 How can the obfuscation unlock key be securely managed without storing it on the untrusted chip?
• RQ2 What mechanisms can ensure that the activation key is unique and changes per activation, even for the same device?
• RQ3 How can communication between the untrusted chip and the key management system be secured against eavesdropping and tampering?
• RQ4 What are the performance and area trade-offs of using dual-mode encryption (DCC and LCC) in a key management architecture?
• RQ5 How does COMA improve upon existing solutions like FORTIS in terms of security, scalability, and resistance to side-channel and fault attacks?

Key findings

• COMA reduces area overhead by 14% compared to FORTIS, with the lightweight COMA2 variant using only 8.7K gates, achieving 0.43% area overhead on large benchmarks like Virtex-7.
• The DCC mode provides ultra-high security through double encryption and AEAD, but incurs higher energy cost due to AEAD and PRNG operations during initialization.
• The LCC mode achieves significantly lower energy consumption for subsequent message exchanges after initialization, growing at a much slower rate than DCC due to reduced reliance on AEAD and PRNG.
• COMA enables unique chip authentication via PUF-based key generation, eliminating the risk of key duplication or software-based key faking present in FORTIS.
• COMA is resilient to side-channel and fault attacks: secret keys are not reused, and PUF health checks can detect attempts to replace the PUF with a deterministic function.
• COMA supports activation-as-a-service for IoT and 2.5D systems by enabling remote, on-demand key delivery without persistent key storage, enhancing security and operational flexibility.