Maliciously intended hardware modifications in electronic circuits (a.k.a. hardware Trojans) have become the topic of intensified concern due to the lack of assurance mechanisms in the globalized integrated circuit supply chain. At the same time, wireless networks have become an indispensable part of modern electronic systems and their ability to communicate data (typically encrypted) over public channels makes them a prime candidate for such attacks. Motivated by the above observations, this project focused on investigating the risks posed by hardware Trojans to wireless networks, despite conventional security measures, as well as on developing remedies to improve the trustworthiness of the wide range of applications involving wireless communications, thereby fostering technology trustworthiness.

Specifically, during the five-year period of this project, we employed a synergistic approach that combines information theory with integrated circuit design and test practices, though which we sought to (i) model the risk induced by hardware Trojans in wireless networks, (ii) elucidate this risk by designing realistic hardware Trojan-based attacks on both the baseband processor and the radio-frequency front-end of such wireless networks, (iii) develop countermeasures for preventing insertion and facilitating detection of hardware Trojans in wireless networks, and (iv) demonstrate attack feasibility and countermeasure effectiveness using popular experimentation platforms enhanced with custom-designed Trojan-free and Trojan-infested Radio Frequency (RF) ICs.

Accordingly, along these four directions, the key research outcomes of this project are summarized as follows: (i) we identified various entry points in the design and implementation of the baseband and the radio-frequency front-end of protocol-compliant contemporary wireless networks, such as 802.11, which could be leveraged in order to stage hardware Trojan-based attacks capable of leaking secret information over the public wireless channel, (ii) we designed a number of hardware Trojans which we introduced in the implementation of the aforementioned wireless networks to implement attacks that leak the secret encryption key and, thereby, compromise the security of the wireless communication while remaining clandestine, (iii) we developed a number of solutions leveraging both machine learning and advanced statistical analysis and information theory principles in order to detect the presence of such attacks, and (iv) we built two experimentation platforms, around the popular USRP and WARP experimentation boards, including custom-designed chips and printed circuit boards, through which we demonstrated through extensive actual over-the-air measurements the feasibility of the proposed hardware Trojan attacks and the effectiveness of the developed countermeasures.

The above research outcomes were complemented by educational and outreach activities, which included development of a new educational module on wireless network security, training of two postdoctoral research associates, four Ph.D. students and one undergraduate student, as well as dissemination of the findings of this project to both the local academic community at UT Dallas and the general research community through numerous conference and journal publications, award-winning hardware demonstrations, presentations and tutorials.

Last Modified: 01/09/2021
Modified by: Yiorgos Makris