111 citations · 474 across the 32 of their papers we have counts for
32 papers
Evil from Within: Machine Learning Backdoors through Hardware Trojans
Alexander Warnecke, Julian Speith, Jan-Niklas Möller +2
Backdoors pose a serious threat to machine learning, as they can compromise the integrity of security-critical systems, such as self-driving cars. While different defenses have bee…
RIS-Jamming: Breaking Key Consistency in Channel Reciprocity-based Key Generation
Guyue Li, Paul Staat, Haoyu Li +6
Channel Reciprocity-based Key Generation (CRKG) exploits reciprocal channel randomness to establish shared secret keys between wireless terminals. This new security technique is ex…
Explainability as a Requirement for Hardware: Introducing Explainable Hardware (XHW)
Timo Speith, Julian Speith, Steffen Becker +3
In today's age of digital technology, ethical concerns regarding computing systems are increasing. While the focus of such concerns currently is on requirements for software, this…
Analog Physical-Layer Relay Attacks with Application to Bluetooth and Phase-Based Ranging
Paul Staat, Kai Jansen, Christian Zenger +2
Today, we use smartphones as multi-purpose devices that communicate with their environment to implement context-aware services, including asset tracking, indoor localization, conta…
Anti-Tamper Radio: System-Level Tamper Detection for Computing Systems
Paul Staat, Johannes Tobisch, Christian Zenger +1
A whole range of attacks becomes possible when adversaries gain physical access to computing systems that process or contain sensitive data. Examples include side-channel analysis,…
How Not to Protect Your IP -- An Industry-Wide Break of IEEE 1735 Implementations
Julian Speith, Florian Schweins, Maik Ender +3
Modern hardware systems are composed of a variety of third-party Intellectual Property (IP) cores to implement their overall functionality. Since hardware design is a globalized pr…
Reconfigurable Intelligent Surface for Physical Layer Key Generation: Constructive or Destructive?
Guyue Li, Lei Hu, Paul Staat +4
Physical layer key generation (PKG) is a promising means to provide on-the-fly shared secret keys by exploiting the intrinsic randomness of the radio channel. However, the performa…
IRShield: A Countermeasure Against Adversarial Physical-Layer Wireless Sensing
Paul Staat, Simon Mulzer, Stefan Roth +5
Wireless radio channels are known to contain information about the surrounding propagation environment, which can be extracted using established wireless sensing methods. Thus, tod…
Mirror Mirror on the Wall: Wireless Environment Reconfiguration Attacks Based on Fast Software-Controlled Surfaces
Paul Staat, Harald Elders-Boll, Markus Heinrichs +2
The intelligent reflecting surface (IRS) is a promising new paradigm in wireless communications for meeting the growing connectivity demands in next-generation mobile networks. IRS…
An Exploratory Study of Hardware Reverse Engineering Technical and Cognitive Processes
Steffen Becker, Carina Wiesen, Nils Albartus +2
Understanding the internals of Integrated Circuits (ICs), referred to as Hardware Reverse Engineering (HRE), is of interest to both legitimate and malicious parties. HRE is a compl…
ARMORY: Fully Automated and Exhaustive Fault Simulation on ARM-M Binaries
Max Hoffmann, Falk Schellenberg, Christof Paar
Embedded systems are ubiquitous. However, physical access of users and likewise attackers makes them often threatened by fault attacks: a single fault during the computation of a c…
The Unpatchable Silicon: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
Maik Ender, Amir Moradi, Christof Paar
The security of FPGAs is a crucial topic, as any vulnerability within the hardware can have severe consequences, if they are used in a secure design. Since FPGA designs are encoded…
Promoting the Acquisition of Hardware Reverse Engineering Skills
Carina Wiesen, Steffen Becker, Nils Albartus Christof Paar +1
This full research paper focuses on skill acquisition in Hardware Reverse Engineering (HRE) - an important field of cyber security. HRE is a prevalent technique routinely employed…
SPFA: SFA on Multiple Persistent Faults
Susanne Engels, Falk Schellenberg, Christof Paar
For classical fault analysis, a transient fault is required to be injected during runtime, e.g., only at a specific round. Instead, Persistent Fault Analysis (PFA) introduces a pow…
Keys from the Sky: A First Exploration of Physical-Layer Security Using Satellite Links
Pascal Zimmer, Roland Weinreich, Christian T. Zenger +2
In this paper, we investigate physical-layer security (PLS) methods for proximity-based group-key establishment and proof of location. Fields of application include secure car-to-c…
Intelligent Reflecting Surface-Assisted Wireless Key Generation for Low-Entropy Environments
Paul Staat, Harald Elders-Boll, Markus Heinrichs +3
Physical layer key generation is a promising candidate for cryptographic key establishment between two wireless communication parties. It offers information-theoretic security and…
An Exploratory Analysis of Microcode as a Building Block for System Defenses
Benjamin Kollenda, Philipp Koppe, Marc Fyrbiak +3
Microcode is an abstraction layer used by modern x86 processors that interprets user-visible CISC instructions to hardware-internal RISC instructions. The capability to update x86…
Physical Design Obfuscation of Hardware: A Comprehensive Investigation of Device- and Logic-Level Techniques
Arunkumar Vijayakumar, Vinay C. Patil, Daniel E. Holcomb +2
The threat of hardware reverse engineering is a growing concern for a large number of applications. A main defense strategy against reverse engineering is hardware obfuscation. In…
A Look at the Dark Side of Hardware Reverse Engineering -- A Case Study
Sebastian Wallat, Marc Fyrbiak, Moritz Schlögel +1
A massive threat to the modern and complex IC production chain is the use of untrusted off-shore foundries which are able to infringe valuable hardware design IP or to inject hardw…
Hardware Reverse Engineering: Overview and Open Challenges
Marc Fyrbiak, Sebastian Strauß, Christian Kison +4
Hardware reverse engineering is a universal tool for both legitimate and illegitimate purposes. On the one hand, it supports confirmation of IP infringement and detection of circui…
Insights into the Mind of a Trojan Designer: The Challenge to Integrate a Trojan into the Bitstream
Maik Ender, Pawel Swierczynski, Sebastian Wallat +3
The threat of inserting hardware Trojans during the design, production, or in-field poses a danger for integrated circuits in real-world applications. A particular critical case of…
Stealthy Opaque Predicates in Hardware -- Obfuscating Constant Expressions at Negligible Overhead
Max Hoffmann, Christof Paar
Opaque predicates are a well-established fundamental building block for software obfuscation. Simplified, an opaque predicate implements an expression that provides constant Boolea…
Reverse Engineering x86 Processor Microcode
Philipp Koppe, Benjamin Kollenda, Marc Fyrbiak +4
Microcode is an abstraction layer on top of the physical components of a CPU and present in most general-purpose CPUs today. In addition to facilitate complex and vast instruction…
Interdiction in Practice -- Hardware Trojan Against a High-Security USB Flash Drive
Pawel Swierczynski, Marc Fyrbiak, Philipp Koppe +2
As part of the revelations about the NSA activities, the notion of interdiction has become known to the public: the interception of deliveries to manipulate hardware in a way that…