Abstract: An exemplary method and system are disclosed that can detect the presence or absence hardware differences among fabricated integrated circuits, including those associated with hardware trojans (HT), using cluster-ing-based analysis and/or harmonics-based analysis of side-channel evaluation. The exemplary method and system has been demonstrated to achieve detection of hardware differences as small as 0.19% of the total circuits with 100% accuracy while being tolerant to manufacturing variations among hardware instances.

Abstract: A method of receiving one or more signals emanated from a monitored device, signal processing, based on a software model and a hardware-software (HW/SW) interaction model of the monitored device, one or more signals to determine if an anomaly exists in one or more signals, and responsive to determining that an anomaly exists based on the signal processing, transmitting an indication of the anomaly.

Abstract: A system for detecting hardware Trojans in a computerized device includes a digital circuit having switching components operating pursuant to at least one clock frequency and positioned within an interrogation range of an incident carrier wave. A modulated backscatter response is reflected from the digital circuit upon arrival of the incident carrier wave in the presence of the switching operations. A detection device is positioned to receive the modulated backscatter response. A computer connected to the detection device identifies harmonics of a respective clock frequency of the digital circuit from the backscatter response and identifies characteristics of the harmonics indicating a presence or an absence of a hardware Trojan connected to the digital circuit.

Abstract: A method of receiving one or more signals emanated from a monitored device, signal processing, based on a software model and a hardware-software (HW/SW) interaction model of the monitored device, one or more signals to determine if an anomaly exists in one or more signals, and responsive to determining that an anomaly exists based on the signal processing, transmitting an indication of the anomaly.

Abstract: Aspects of the disclosed technology provide a method including receiving one or more signals emanated from a monitored device; signal processing, based on a software model and a hardware-software (HW/SW) interaction model of the monitored device, the one or more signals to determine if an anomaly exists in the one or more signals; and responsive to determining, based on the signal processing, that an anomaly exists, transmitting an indication of the anomaly.

Abstract: Aspects of the disclosed technology provide a method comprising executing different first and second instructions a first and second number of times, respectively, in repeated alternations. The method further comprises measuring spectra of signals emanating as a result of the processor executing the first and second instructions. The method also includes analyzing data indicative of the spectra of the signals to determine side-channel candidate side-band pairs that each have a lower and upper sideband at first and second frequencies, respectively, that are separated by approximately twice the respective alternation frequency. Finally, the method includes identifying a side-channel carrier frequency at a frequency approximately at a midpoint between a side-channel candidate side-band pair's first and second frequency.

Abstract: Aspects of the disclosed technology provide a method comprising executing different first and second instructions a first and second number of times, respectively, in repeated alternations. The method further comprises measuring spectra of signals emanating as a result of the processor executing the first and second instructions. The method also includes analyzing data indicative of the spectra of the signals to determine side-channel candidate side-band pairs that each have a lower and upper sideband at first and second frequencies, respectively, that are separated by approximately twice the respective alternation frequency. Finally, the method includes identifying a side-channel carrier frequency at a frequency approximately at a midpoint between a side-channel candidate side-band pair's first and second frequency.

Abstract: Aspects of the disclosed technology provide a method comprising executing, at a first processor and over a predetermined time period, first and second instructions in repeated alternations, wherein each alternation comprises executing the first instruction a predetermined number of times followed by executing the second instruction the predetermined number of times. Further, the method comprises measuring, via a measuring apparatus, a side-channel signal that results from the first processor executing the first and second instructions in repeated alternations. Additionally, the method comprises filtering, by a second processor, a spectral component of the measured side-channel signal, and analyzing, by the second processor, the filtered spectral component of the measured side-channel signal to determine power spectral density within a frequency range of the filtered spectral component.

Abstract: Aspects of the disclosed technology provide a method including receiving one or more signals emanated from a monitored device; signal processing, based on a software model and a hardware-software (HW/SW) interaction model of the monitored device, the one or more signals to determine if an anomaly exists in the one or more signals; and responsive to determining, based on the signal processing, that an anomaly exists, transmitting an indication of the anomaly.

Abstract: Aspects of the disclosed technology provide a method comprising executing, at a first processor and over a predetermined time period, first and second instructions in repeated alternations, wherein each alternation comprises executing the first instruction a predetermined number of times followed by executing the second instruction the predetermined number of times. Further, the method comprises measuring, via a measuring apparatus, a side-channel signal that results from the first processor executing the first and second instructions in repeated alternations. Additionally, the method comprises filtering, by a second processor, a spectral component of the measured side-channel signal, and analyzing, by the second processor, the filtered spectral component of the measured side-channel signal to determine power spectral density within a frequency range of the filtered spectral component.

Abstract: A method of operating a data processing system having a main memory divided into memory pages that are swapped into and out of main memory when the main memory becomes short. The data processing system has an operating system that sends page store commands specifying memory pages to be stored in a swap file and page retrieve commands specifying memory pages to be retrieved from the swap file and stored in the main memory. The present invention provides a swap driver that utilizes compression code for converting one of the memory pages that is to be swapped out of main memory to a compressed memory page. The data processing memory includes a compressed page region that is used to store the compressed memory pages. A page table in the compressed page region specifies the location of each compressed page and the page address corresponding to that page.

Abstract: A method of operating a data processing system having a main memory divided into memory pages that are swapped into and out of main memory when the main memory becomes short. The data processing system has an operating system that sends page store commands specifying memory pages to be stored in a swap file and page retrieve commands specifying memory pages to be retrieved from the swap file and stored in the main memory. The present invention provides a swap driver that utilizes compression code for converting one of the memory pages that is to be swapped out of main memory to a compressed memory page. The data processing memory includes a compressed page region that is used to store the compressed memory pages. A page table in the compressed page region specifies the location of each compressed page and the page address corresponding to that page.