LaserEscape: Detecting and Mitigating Optical Probing Attacks

TL;DR

LaserEscape is a novel, FPGA-compatible countermeasure that detects and mitigates optical probing attacks on integrated circuits using digital sensors and real-time reconfigurability, enhancing physical security without disrupting operation.

Contribution

It introduces the first fully digital, FPGA-compatible method for detecting and responding to optical probing attacks through real-time sensors and dynamic reconfiguration techniques.

Findings

Successfully detects optical probing in real time

Effectively mitigates attacks without operational interruption

Demonstrated on 28-nm FPGA with high resiliency

Abstract

The security of integrated circuits (ICs) can be broken by sophisticated physical attacks relying on failure analysis methods. Optical probing is one of the most prominent examples of such attacks, which can be accomplished in a matter of days, even with limited knowledge of the IC under attack. Unfortunately, few countermeasures are proposed in the literature, and none has been fabricated and tested in practice. These countermeasures usually require changing the standard cell libraries and, thus, are incompatible with digital and programmable platforms, such as field programmable gate arrays (FPGAs). In this work, we shift our attention from preventing the attack to detecting and responding to it. We introduce LaserEscape, the first fully digital and FPGA-compatible countermeasure to detect and mitigate optical probing attacks. LaserEscape incorporates digital delay-based sensors to reliably detect the physical alteration on the fabric caused by laser beam irradiations in real time. Furthermore, as a response to the attack, LaserEscape deploys real-time hiding approaches using randomized hardware reconfigurability. It realizes 1) moving target defense (MTD) to physically move the sensitive circuity under attack out of the probing field of focus to protect secret keys and 2) polymorphism to logically obfuscate the functionality of the targeted circuit to counter function extraction and reverse engineering attempts. We demonstrate the effectiveness and resiliency of our approach by performing optical probing attacks on protected and unprotected designs on a 28-nm FPGA. Our results show that optical probing attacks can be reliably detected and mitigated without interrupting the chip's operation.