# Security of Electrical, Optical and Wireless On-Chip Interconnects: A Survey

Hansika Weerasena  University of FloridaGainesvilleFL32611USA
<EMAIL_ADDRESS>and  Prabhat Mishra  University of
FloridaGainesvilleFL32611USA<EMAIL_ADDRESS>
###### Abstract.

The advancement of manufacturing technologies has enabled the integration of
more intellectual property (IP) cores on the same system-on-chip (SoC).
Scalable and high throughput on-chip communication architecture has become a
vital component in today’s SoCs. Diverse technologies such as electrical,
wireless, optical, and hybrid are available for on-chip communication with
different architectures supporting them. Security of the on-chip communication
is crucial because exploiting any vulnerability would be a goldmine for an
attacker. In this survey, we provide a comprehensive review of threat models,
attacks and countermeasures over diverse on-chip communication technologies as
well as sophisticated architectures.

network-on-chip security, communication security

††ccs: Hardware Network on chip††ccs: Security and privacy Hardware security
implementation

##  1\. Introduction

The number and complexity of computing devices are increasing rapidly and
expected to grow to 75.44 billion devices in 2025 (noa, [n. d.]). Most of
these devices are IoT devices, edge computing devices, and portable devices.
System-on-Chip (SoC) is the backbone of each devices to implement increasingly
complex functionalities. A typical SoC consists of different heterogeneous
Intellectual Property (IPs) cores such as a processors, memories, controllers,
converters, etc. For example, an automotive SoC may have around one hundred
IPs to support the required functionality. SoCs may also include numerous
computing cores, popularly known as multipocessor SoC (MPSoC), to support
parallel computation and muti-programming workloads. For example, Altra®
multicore server processor has 128 cores (Ampere, 2022).

On-chip communication architecture in an MPSoC helps to communicate cache
coherence protocol related messages between processors and memories. In a
typical IoT SoC, on-chip communication is responsible for communication
between multiple IP cores including processor, memory, converters,
peripherals, DSPs, memories, peripheral controllers, gateways to networks on
other chips, etc. Historically computation was the limiting factor while on-
chip communication was not given much attention. With SoC having 100s of IP
cores and modern processors having 100s of cores, on-chip communication has
become the performance bottleneck. This has led to the development of fast,
low-power and scalable on chip communication. To achieve different energy and
performance goals, diverse communication technologies and different
architectures are explored in designing suitable on-chip communication
fabrics. There are also many applications that requires fast communication
across many cores. For example, Deep Neural Networks accelerators engage with
high data flows across 100+ small processing elements (Chen et al., 2019).

Figure 1. Evolution of on-chip communication. Bus-topology, adhoc mix of buses
and ring-based NoC (Lahiri et al., 2001).

###  1.1. On-chip Communication Basics

Topology of a network defines the physical layout of the components of the
network. The topology has a direct impact on network performance. After
introduction of SoC architectures in 90’s, the communication was primaily
based on bus topology (Figure 1.a) and ad-hoc mixes of buses (Figure 1.b)
(Lahiri et al., 2001). For small SoCs with typically around 20 IPs, buses
provide simple and low-cost communication. Bus-based architectures have an
inherent advantage, once the bus arbitration is done, the full bandwidth of
the wires can be utilized and data transfer timing is predictable. Bus-based
architectures are the most widely used on-chip communication topology for
small-scale SoCs. When the SoCs become more sophisticated, the concept of
route packets are used instead of wires (Dally and Towles, 2001). This leads
to the introduction of Network-on-Chip (NoC). NoC isolates and manages the
communication requirement of the whole SoC. Figure 1.c shows a NoC with ring
topology. Some topolgoies such as mesh topology can be used across every
technology used in on-chip communication while some topologies are tightly
coupled with underline technology. There are multitudes of other topologies
that can be chosen by evaluating design requirements such as power,
performance, heat dissipation, connectivity, cost etc. Some interesting 3-D
typologies have been proposed by (Pavlidis and Friedman, 2007) by stacking
IPs. The main architectural difference is that a 3-D NoC will have vertical
links to communicate across layers. 3-D NoCs have less average hop counts for
communication which leads to the improvement in performance and power
consumption.

Early NoC architectures are based on electrical (copper) interconnects that
connect IPs together. Due to inherent technology limitations in electrical
interconnects, it does not scale for large SoCs with 100+ IPs. The multi-hop
communication structure of electrical interconnects increases the average
latency and power consumption. There are studies Shacham et al. (Shacham et
al., 2007) to show that electrical interconnects are unable to scale up to
adequate performance with acceptable area and power overheads in relatively
large SoCs. In recent years, there are two technology alternatives namely
wireless and optical interconnects adapted from traditional computer network
domain to address scalability issues in electrical NoCs. These two
technologies together with electrical interconnects can be used in a hybrid
manner to address specific design, power, performance, and cost goals. For
example, DNN accelerators tend to use wireless over multicast/broadcast for
spatial reuse.

In wireless NoCs, the copper wired links in Electrical NoCs are replaced by
wireless medium. The inherent multicast/broadcast nature of wireless
transmission provides advantages in NoC that use many multicast messages.
Optical communication technologies has been used in traditional computer
networks to achieve higher data transmission rates. Optical NoCs provide high
throughput data transmission while reducing power consumption at the same
time. Optical NoCs encode data as light and use waveguides to transfer data
throughout the chip (Bashir et al., 2019). The data transfer through optical
interconnects does not need any repeaters or buffers which results in low
power consumption and low latency (Shacham et al., 2007).

###  1.2. Security Vulnerabilities and Challenges

We can discuss security of NoC from multiple perspectives. The NoC can be used
by the attacker who is sitting outside of the boundary of NoC to access and
modify transferred data. Therefore, NoC is used to detect and secure attack on
SoC architectures. For example, FlexNoC (Arteris, 2009) provides Resilience
Package having hardware based data protection to protect SoC. However, the
components of the NoC itself can be malicious that can lead to attacks.
Complex and large MPSoCs have made it easier for an attacker to hide malicious
implants inside an SoC.

Sophisticated SoC design has led to significant increase in design and
verification complexity. Reusable hardware IP based SoC design has become
industry norm to reduce cost and meet critical time-to-market constraints.
Typically only few IPs are designed in-house for any SoC design while others
are outsourced from third-party vendors. For example, FlexNoc interconnect is
used by four out of the top five Chinese fabless companies to facilitate their
on-chip communication (JS et al., 2015). These third-party IPs may come with
malicious implants, such as Hardware Trojans(HTs), due to the long and
potentially untrusted supply chain. These malicious implants can be inserted
into the RTL or netlist with the intention of launching attacks (Mishra et
al., 2017).

On-chip communication is responsible for sharing the resources and critical
information. Exploiting attack vectors on a NoC will be a goldmine to any
attacker. When we consider a practical scenario, a cloud computing
infrastructure that provides virtual machines under the same hardware has to
guarantee that it will not leak critical information to other tenants using
the same hardware infrastructure. Therefore, the communication infrastructure
across different users of the same hardware should be secured. Securing on-
chip communication has it’s own unique challenges as follows.

Diverse Architectures and Technologies:  NoCs will have a mixture of different
architectures and technologies. Security attacks can be innovative to exploit
the underline property or design limitation of the architectures and
technologies. For example, inherent broadcasting property of wireless NoC
makes it easier for an attacker to gather the messages than in an electrical
NoC. Therefore, it is difficult to have security countermeasures that are
generic across all the technologies and architectures. More importantly,
countermeasures also have the advantage of utilizing the underline properties
of the technology to defend against attacks.

Resource-constrained Environment: On-chip communication inherits many
similarities from traditional computer networking domain. Although there are
well established security countermeasures in traditional computer networks,
they cannot be applied directly to NoCs due to resource-constrained nature of
NoC-based SoCs. Specifically, area, power, and real-time execution
requirements are the three main constraints in NoCs. For example, Advanced
Encryption Standard (AES) is widely used for encryption in computer networks
(Daemen and Rijmen, 1999), however, it can introduce unacceptable overhead in
terms of power, area and performance in resource-constrained NoCs. Therefore,
the security countermeasures should focus on the trade-off between security
and performance.

###  1.3. Major Differences with Existing Surveys

There are existing surveys on Network-on-chip technologies, architectures and
security. (Bjerregaard and Mahadevan, 2006) describes the fundamental
concepts, system-level modeling, and design of NoCs. A comprehensive study on
wireless NoC covers the topology, routing, flow control, antenna and
reliability (Wang and Jin, 2014). Werner et al. (Werner et al., 2017) presents
a detailed review of existing optical NoC architectures. Details on optical
interconnection technologies and underline basic physics can be found in
(Bashir et al., 2019). (Charles et al., 2021) provides a extensive survey on
network on chip attack and countermeasures which focus only on security of
electrical NoCs. A recent survey (Sarihi et al., 2021b) explores security on
wired, wireless as well as 3-D NoCs. However, it has two major limitations. It
does not discuss security attacks and countermeasures on optical on-chip
interconnects or bus based architectures. Moreover, it does not describe
technology-specific attacks rather focus more on countermeasures.

This paper makes three major contributions compared to existing surveys.
First, it provides a comprehensive survey of all the existing communication
technologies namely electrical, wireless and optical. Next, this paper
provides equal emphasis on threat models, attacks as well as their
countermeasures. Finally, the paper provides an executive summary of basic
architectures and technologies in on-chip communication which is essential to
understand the attacks and countermeasures.

###  1.4. Survey Outline

There are various ways of classifying security attacks and countermeasures.
Our survey considers classification in two layers as shown in Figure 2. First,
the attacks are categorized under the technologies which are Electrical,
Wireless and Optical NoCs. Even though some attacks are possible in multiple
technologies, the primary discussion would be on the technology specified in
the published literature. Next, we discuss the following six security concepts
for each communication technology.

Figure 2. NoC security survey for three communication technologies under six
security concepts.

Confidentiality : Confidentiality during communication ensures that there is
no unauthorized disclosure of secret information. Eavesdropping, snooping and
utilization of side channel or covert channel for leaking sensitive data are
some common attacks on confidentiality. Encryption is the most widely used
solution to ensure confidentiality under eavesdropping or snooping attacks.

Integrity : Integrity ensures no unauthorized modification or destruction of
information. Message tampering and message removal attack are some of the
common attacks on integrity. Message authentication code is the most popular
solution against these attacks.

Authenticity : Authenticity ensures that the data received by the receiver is
originated from intended sender. Spoofing attack is the most common attack
while various signature schemes can be used to defend against spoofing
attacks.

Availability : Availability of the system ensures that data and the system are
available for users whenever they need them. Denial-of-Service (DoS) is the
most common attack on availability. Traditional DoS attacks can be further
categorized into bandwidth or resource consumption DoS attacks.

Anonymity: Anonymity ensures that there is no unauthorized disclosure of
information about communicating parties (source and destination).

Freshness : Freshness ensures that message passing in the system are up-to
date. Replay attack is the main attack violating data freshness.

The remainder of the survey is organized as follows. Section 2 describes
fundamentals of on-chip communication architecture under different
communication technologies. Section 3-5 provide a comprehensive survey of NoC
security for electrical, wireless and optical NoCs, respectively.
Specifically, it covers threat models, attacks and countermeasures for each
technology. Finally, Section 6 concludes the survey.

##  2\. On-Chip Communication Architectures

On-chip communication architecture separates the communication layer from
other IPs which has allowed for diverse technologies and architectures with
different performance goals. Understanding of fundamental building blocks of
NoC architecture is essential to review their security. This section gives an
overview of communication protocol and existing architectures under different
technologies.

###  2.1. Networking Models and Communication Protocols

Bus-based communication protocols are simple and have few primitives such as
master, slave, arbiter, decoder, bridge, etc. Bus architectures use a
communication protocol in which one device or process (known as the master)
has total control one or more other devices or processes (known as slaves).
Bus has a master who initiates communication session and a slave who listens
and responds to incoming transfers. Bus arbiter controls the access for a
shared bus through an arbitration scheme such as Time Division Multiple
Access. The decoder determines the intended recipients. More sophisticated
hierarchical bus architectures have bridges to connect two buses together. A
bus architecture enables the transfer of the following three types of
information.

  * •

Address: carries address of the destination node

  * •

Data: carries data between destination and the source

  * •

Control: carries control message requests and acknowledgements before
transfers.

When a source wants to send a message through bus, it must first use the bus
arbiter to acquire the bus. Once the bus is acquired, the address of the
destination will be placed on the address line. Once the address is received,
the corresponding decoder will read the data on data line. The data transfer
to other way will happen similarly.

Figure 3. NoC with 4x4 mesh topology. Each IP is connected to NoC via a
network interface followed by a router. Node S is sending packets to D via
NoC. A typical router micro-architecture of a NoC router.

Most of the definitions of NoC networking model is based on electrical NoCs so
there are minor deviations from the basic networking concepts in other
technologies. Figure 3 shows a simple mesh topology for NoC-based SoC. A
typical NoC have the following basic components.

  * •

Node: Any IP or cluster of IPs that have bus for internal communication.

  * •

Link: Connects two nodes physically. Link may have one or more logical or
physical channels.

  * •

Network Interface: IPs and NoC communicates through network interface. It may
include conversion of data between two mediums. It decouples communication
from computation.

  * •

Router: It forwards data according to pre-defined routing protocols.

A packet is the basic unit of transfer in a NoC. The idea of communication in
a NoC is to route packets through a series of nodes between the source and
destination nodes. The packet is further subdivided into basic flow control
units, called flits, and the flits are transferred between the routers. A
typical NoC protocol uses two types of packets, control and data packets.
Figure 4 shows the structure of a data packet. As shown in Figure 3, the
following steps will be followed when the source node (S) wants to request
data from the destination node (D). First, the node S generates a control
packet requesting data from the node D with necessary headers and injects to
the network interface of S. Then, the network interface of S will divide the
message into a head flit, multiple body flits, and a tail flit. The network
interface injects the flits to the neighbouring router. The flits will hop
from one router to the next (uses X-Y routing in this example) until it
reaches the destination router. The final router will inject flits to the
network interface of D. Then, the network interface of D will collect all the
flits and provide D with the assembled message. Finally, D will generate a
data packet and inject it to the network interface of D. Similar steps will
commence and S will receive the data as the response.

Figure 4. Packet contains headers and packet data. Packet is divided into a
head flit, multiple body flits and a tail flit. Flits have their own headers.

####  2.1.1. Routing Protocol :

Routing protocol defines the path of moving data from source to destination.
There are some basic characteristics in a routing protocol:

Circuit versus Packet Switching : In circuit switching, first a path is
established and dedicated to a session followed by the data transfer through
it. In case of packet switching, the individual packets are forwarded
independently per hop. Therefore, in packet switching each packet have routing
information including the source and destination in their headers.

Deterministic versus Adaptive Routing : Deterministic routing considers only
the source and destination for deciding the route path. Adaptive routing
considers other factors such as link utilization and congestion on deciding
the next hop of the route. XY routing is the most commonly used routing in
mesh based electrical NoCs. XY routing is simple, it basically takes all the X
links first followed by Y links. There are also adaptive routing algorithms
such as odd-even, west-first, north-last, and negative-first (Fang et al.,
2013).

Wormhole Routing : Wormhole routing looks at the incoming header flit and
immediately forwards it to next hop without waiting for all the flits to
arrive at the router. This mechanism is used to reduce buffer size and queuing
delay of NoC packets.

###  2.2. Electrical Interconnects

Figure 5. Common NoC topologies: ring, star, mesh and torus.

Electrical interconnects can be considered as the traditional on-chip
communication medium which most of the MPSoCs use today. Bus-based
architectures are simple and straightforward while there are many topologies
in NoCs. Figure 5 shows some of the commonly used 2-D topologies in electrical
NoCs which are namely ring, star, mesh and torus. 2-D Mesh is the most
commonly used topology in electrical NoCs. In a mesh topology, each node is
connected to four other nodes: North, South, East and West neighbours (Figure
3). Most electrical NoCs use the similar network model discussed in Section
2.1. Both NoC based and bus based electrical interconnects can be seen in
commercial designs. A typical NoC will use virtual channels for flow control.
Figure 3 shows the routing micro-architecture of a virtual channel based
router which is commonly used in electrical NoCs. The following are the main
components and their functionalities in electrical NoCs.

  * •

Input and Output Buffers: They are used to store flits for incoming and
outgoing communication. There are multiple buffers for multiple virtual
channels in a single port.

  * •

Route Computation Unit: It determines the output port for the flit according
to the routing protocol. Route computation will be done for the head flit. The
body flits and tail flit will follow the same route.

  * •

VC Allocator: It assigns a free virtual channel buffer at the downstream
router for the outgoing port.

  * •

Switch Allocator: It arbitrates between two or more flits that are going to
use the same output port via switch simultaneously.

  * •

Crossbar Switch: It allows flits to reach the output buffers according to
previous calculations. The crossbar switch is capable of supporting multiple
flits simultaneously.

IBM’s CoreConnect (Microelectronics, 1999) and ARM’s AMBA (Advanced Micro-
controller Bus Architecture) bus (ARM, 1999) can be considered as the most
popular bus-based communication architectures used in complex SoCs. Oracle
SPARC T5 (2013) has 16 multi-threaded cores and 8 L2 banks connected by a
Crossbar NoC. Similarly, Intel Single-Chip Cloud Computer (2009) has 24 tiles
with 2 cores connected through a mesh based NoC.

###  2.3. Wireless Interconnects

Inherent limitation of electrical NoC paved the way for wireless on-chip
communication. In wireless NoC, the copper links between nodes are replaced by
wireless links. wireless NoC topologies can be pure wireless with only
wireless communication or a hybrid of electrical and wireless connections.
Modern wireless NoCs (Ganguly et al., 2010; Wang et al., 2011) tend to use
hybrid wireless NoC architectures for three main reasons. (1) Electrical
multi-hop communication between nodes that are far away has higher packet
latency which can be reduced by introducing wireless links. (2) Electrical
communication between two neighbouring node is robust and faster than wireless
communication between them. (3) Limitation of channels in wireless medium
(Zhao and Wang, 2008) hinders scalability in fully wireless topologies.
Therefore, hybrid wireless NoC architectures use wireless links as the highway
for long distance communication between two IPs (Ganguly et al., 2010) while
electrical connections are used for short-distance communications.

Figure 7 shows a simple 4x4 wireless NoC architecture (Zhao et al., 2011) that
uses multi-channel wireless links for communication. Similar to router
connected to every node in mesh based electrical NoC, this architecture has
wireless routers with wireless transceivers and antennas. There is a low
bandwidth wired control network to support fast channel arbitration. The
transmission radius of a router defines average hops for a packet but
increasing transmission radius will increase channel arbitration time because
there will be more nodes fighting for limited number of channels. Recent work
has proposed multiple hybrid wireless NoC topologies (Bahn et al., 2007; Lee
et al., 2009; Kim et al., 2007; Ogras and Marculescu, 2006). Figure 7 shows an
example hybrid wireless NoC architecture by Wang et al. (Wang et al., 2011).
The network is divided into four subnets and there is a wireless hub placed in
the middle of each subnet. Wireless hubs have antennas and transceivers that
use frequency division multiple access (FDMA) for multi-channel communication.
There can be electrical interconnects similar to mesh-based NoC between the
nodes. Imagine a scenario where node 2 wants to send message to node 60.
First, the packet will use the electrical interconnection to reach the
wireless hub 1 taking the path Node1 -¿ NodeX -¿ wireless hub 1. Then, the
wireless hub uses wireless link to transfer packet to the wireless hub 4.
Finally, the packet will use the electric interconnect again to reach the node
60. Although Figure 7 has mesh based electrical topology, small-world based
topology (Ogras and Marculescu, 2006) allows subnets to be completely
independent and different topologies interconnected only by wireless hubs.

Traditional routing algorithms for electrical NoCs such as X-Y routing can be
used in wireless NoCs. However, there are routing algorithms that utilize
special characteristics of wireless NoC architectures such as location-based
routing (Zhao et al., 2011). There are different types of antennas used in
wireless NoC categorized as silicon integrated antennas, UWB antennas
(Wiesbeck et al., 2009), and CNT antennas (Ganguly et al., 2011). These
multiple topologies and diverse components raise different set of security
vulnerabilities in wireless NoCs. Although inherent characteristics of having
a shared medium of wireless communication supports broadcast/multicast message
passing, it affects negatively in terms of security and opens up new attack
vectors to adversaries.

Figure 6. McWiNoC: A wireless NoC topology with low-bandwidth electrical
control network (Zhao et al., 2011).

Figure 7. 10x10 hybrid wireless NoC topology with four subnets and wireless
nodes (Wang et al., 2011).

###  2.4. Optical Interconnects

Optical on-chip interconnects another promising alternative to address
bandwidth and energy limitations of electrical interconnects. optical NoCs
transfer data across the SoC as optical signals and the energy consumption of
the signals are relatively distance-independent. Figure 8 represents a simple
bus based optical interconnect with only a sender and a receiver. An off-chip
laser acts as the source of the optical signals in different wavelengths.
Waveguide can be represented as the duel of copper links in electrical NoC
which is responsible to carry optical signals. Unlike electrical links, the
waveguide supports parallel data transmission through dense wavelength-
division multiplexing. Microring resonator (MR) (Barrios et al., 2003;
Bogaerts et al., 2012) is the fundamental component inside modulators,
detectors and routers which is made out of mixture of circular and straight
waveguide. MR is capable of removing all or keep all the optical signals in
the waveguide which represents logical 0 and 1, respectively.

Figure 8. Basic optical data transfer where the sender modulates off-chip
laser in wave-guide (Werner et al., 2017).

When the sender wants to send a message, it will generate a packet which is
initially represented as an electric signal. The modulator is responsible for
electric to optical modulation. The MR inside the modulator will capture a
light of a particular wavelength on the waveguide and modulates it to
represent stream of logical 0s and 1s. At the receiver side, the detector will
continuously listen on the selected wavelength. Upon receiving data, MR inside
the detector will select the wavelength and remove it from the waveguide. Then
the signal is converted to electrical signal and amplified before sending into
the receiver. This optical bus can be considered as the fundamental building
box for many complex topologies of optical interconnects (Werner et al.,
2017). $\lambda$-Router (Li et al., 2016) and Folded Crossbar (Ramini et al.,
2013) are two optical only NoC architectures that route optical signals based
on their wavelengths. Amon (Werner et al., 2015) and QuT (Hamedani et al.,
2014) are two topologies that use a low bandwidth control network to agree
upon a set of wavelengths before actual collision-free optical transmission.
Similar to hybrid wireless NoCs, optical interconnects also have hybrid
architectures that uses optical links for long distance communication and
electrical links for short distance communication. Metor (Kirman et al., 2006)
is a hybrid optical NoC architecture that divides 8x8 NoC into four 4x4
clusters (Figure 10). Atac (Anders, 2014) uses a global optical crossbar that
supports 32 buses with 64 wavelengths on each (Figure 10). Compared to Metor,
it does not have fixed clusters, it uses a policy of using optical
interconnects only if the destination is more than four hops away. Otherwise,
the electrical NoC is used.

In 2013, optical interconnects were used in Intels Optical PCI-X motherboard.
In 2015, Sun et al. have fabricated processor chip containing 850 photonic
components that communicate using optical signals (Sun et al., 2015).
Practical photonic based on-chip interconnects are already in the path of
major MPSoC vendors. Technology specific components and processes in optical
interconnects have introduced new attack vectors to adversaries that will be
discussed in Section 5.

Figure 9. Metor (Kirman et al., 2006): 8x8 hybrid optical NoC with four 4x4
clusters.

Figure 10. Atac (Anders, 2014): hybrid optical NoC with global optical
crossbar.

##  3\. Electrical On-chip Communication Security

Electrical on-chip interconnects can be considered as traditional and widely
used technology of all. In this section, we will survey recent research
efforts on security of electrical NoCs. First, we discuss the threat models
and attacks on electrical NoCs. Next, we describe suitable countermeasures to
defend against these attacks.

###  3.1. Threat Models and Attacks

In this section, we explore threat models and attacks of electrical NoCs
categorized into previously defined security concepts. Some of the threat
models can be applied across other technologies as wireless.

####  3.1.1. Confidentiality

Side-channel attacks utilize the implementation of a computer system rather
than a software or hardware vulnerabilities to launch an attack. Some of the
side-channel attacks require deep understanding about the internal physical
implementation of the system. Timing information, electromagnetic signals and
power analysis are some of the avenues for side-channel attacks. Sharing of
multi-tenant application is more practical in cloud environments where same
physical hardware is shared by two different virtual machines. These
applications have concurrent network usage where they have to compete for the
shared resource in NoC such as links. Latency and throughput variation in such
scenarios can be used as a timing side channel to leak sensitive information.
An adversary can also use the timing channel as covert channel to bypass any
security mechanisms in NoC to leak sensitive data. We will first focus on
side-channel attacks on confidentiality. Wang and Suh (Wang and Suh, 2012)
talks about how to use side-channel and covert channel to hinder
confidentiality data flowing through NoC. The attacker can use timing channel
of the network interface to leak the sensitive information or use covert
channel to leak information to colluding malicious application. For example, a
program with high security profile would leak information to a lower security
profile program via covert channel. The specific threat model assumes
multiples security levels such as high and low security zones. Attacker is in
control of a software in multiple processing cores along with it’s placement
at scheduling. Attacking program is assumed to be in low security zone but it
can introduce packets to NoC which will affect timing characteristics of the
high security zone traffic. Furthermore, the attacker is assumed to know the
placement, scheduling, and traffic patterns of high security zone programs.
Attacker will use throughput and timing change of it’s own packets as the side
channel to leak sensitive information from high security traffic flow.

Sepulveda et al. talked about timing based side channel attack to steal
critical information communication through NoC. This attack is conducted by
infecting a component in SoC with a hardware Trojan. The attack uses the
performance degradation of the malicious IP to infer critical information in
concurrent process running in SoC. Imagine a scenario when a source and
destination are performing a symmetric key cryptographic function of such as
AES (Daemen and Rijmen, 1999). When the source requests a particular data, it
first looks at the local cache. If the requested data is not available, it
will use the NoC to access the shared L2 cache or main memory. Node A is the
attacker that lies in the routing path of this communication who is injecting
packets continuously to the NoC. The performance degradation caused by A
leaking information on crypto process will reduce the search-space for a
secret key. In 2016, Sepúlveda et al. (Sepúlveda et al., 2016) described about
a Denial of Service attack with minor changes to the threat model. Although
the attack is similar, the HT affected IP in the NoC is replaced by a
malicious program. Furthermore, the authors point out different ways how a
malicious software can infect an IP. Most common way can be considered as a
buffer overflow attack by a malicious program. The malicious program can leak
sensitive information as secret keys through timing-side channel as discussed
previously. Boraten and Kodi (Boraten and Kodi, 2018b) uses a similar threat
model where the adversary uses interference from contending applications to
launch timing side channel attack to steal sensitive information. The authors
further elaborate using of a covert channel to leak sensitive data captured
from timing side channel attack. They point out that protecting against side
channel attack is challenging since malicious application can hinder detection
by artificially inducing interference. Reinbrecht et al. (Reinbrecht et al.,
2016) proposes a a stronger adversary for side-channel attacks which can be
considered as an extension to previous attacks. This adversary uses
distributed timing side channel attack to leak sensitive information. This
attack has the advantages of reduced computation and storage requirements of
the adversary. They introduced two types of malicious IPs, (1) injectors which
inject traffic in high rate to increase congestion on NoC and (2) observers
who injects traffic in low rates while monitoring their performance
degradation. The attack described in the paper has three stages. The first
stage is infection where the malicious IP uses a malware to position injectors
and observers. At the calibration stage, the traffic injection rates will be
adjusted to avoid unnecessary throughput degradation. During execution and
cryptanalysis, the attack is conducted and a mathematical algorithm is used to
infer sensitive data from the distributed side-channel data.

Figure 11. Snooping of communication between S and D to colluding application
via malicious router (Ancajas et al., 2014).

Figure 12. HT inserted in router counting packets of communication between S
and D (Ahmed et al., 2020a).

Side-channel attacks and covert-channel attacks have been discussed in
traditional bus based architectures. Shao et al. (Shao et al., 2008) talks
about an attack where a run-time HT in bus can monitor communication between
the master and slave of the bus. The HT can be activated from an external
input. When HT is activated it will use power side channel to leak address
information on the bus.

The next six attacks on confidentiality share similar threat model with subtle
differences. The basic threat model is snooping by some malicious components
of NoC which is colluding with a local or remote malicious application. Local
colluding application can be considered as either colluding application or HT
compromised local IP. Remote colluding application resides outside the
boundary of SoC which can be considered to have higher processing power
compared to that of local counterpart. Ancajas et al. (Ancajas et al., 2014)
describe confidentiality violation via snooping in the presence of malicious
NoC. The authors highlight that this threat is critical when using muti-tenant
cloud computing using MPSoCs. The malicious NoC has embedded hardware Trojan
that is capable of activating covert backdoor which is working with a
colluding malicious application running on a normal processing core. Figure 11
shows an example scenario in a mesh NoC when malicious application is running
in node X in a compromised NoC when S and D are communicating. The attack has
four phases. At design phase, a third party NoC IP provider fabricate a HT
into the NoC. Then the colluding application running in the SoC use a dirty
cache bit to activate the HT when necessary. At attacking phase, a malicious
software request the compromised NoC to eavesdrop and duplicate packets of a
specific communication. The compromised NoC will use covert channels to
transfer duplicated classified information from legitimate communication
between S and D. Finally, the attacker will deactivate the HT after the
attack. The compromised NoC with HT have 4.62% area and 0.28% power overhead
compared to baseline NoC. The authors highlight the fact that HT is harder to
detect due to low overhead and HT being deactivated after an attack. Charles
et al. (Charles et al., 2022) talks about snooping attack when NoC is
malicious which uses similar threat model as (Ancajas et al., 2014) with the
exception of not using covert channels. Similar threat models are explored in
(Sepúlveda et al., 2017; Weerasena et al., 2021) where there is a malicious
router snooping packets inside NoC. Hussain and Guo (Hussain and Guo, 2017)
also talks about packet leaks in NoC where the NoC is a third-party IP. Here,
hardware Trojan in NoC is capable of changing destination and source of
request and response packets, respectively, to leak sensitive data. Charles
and Mishra (Charles and Mishra, 2020) also talks about a threat model in mesh
topology where NoC IP is compromised. Specifically, they assume that some
routers and IP cores in middle are malicious. The trusted IPs are introduced
as secure IPs. When two secure IPs are communicating, a malicious router in
middle can leak sensitive information to the malicious IP in the same chip
through NoC.

Raparti and Pasricha (Raparti and Pasricha, 2019) propose a harder to detect
threat model for data snooping attack on NoC. The HT is placed in the Network
Interface (NI) where NoC packets are generated from SoC data. There can be
multiple malicious NIs which snoop packets and send it to the malicious
program listening at a specific IP. The packetizer is the module which is
responsible for creating NoC packets adding header information like
destination ID, virtual channel ID, etc which is immediately followed by a set
of flits. The flits are stored in a circular buffer where pointer is used to
define the start and end of the buffer. The HT is capable of tampering with
these pointers to re-send the duplicate packet with new destination ID as the
IP with the malicious program. The authors point out that the area overhead of
this HT is only 1.3% compared to baseline NI.

Ahmed et al. (Ahmed et al., 2020a) proposed a lightweight and naive HT that
can leak traffic patterns to an adversary so that the adversary can do traffic
analysis. The HT is capable of the naive task of periodically counting number
of packets in a time window and leak that information to the adversary. The HT
can be in either router block or in an interconnection switch. For example
according to Figure 12, when source S is communicating with D, the router with
HT in the middle of the path will count the packets and send it to the
attacking application. The HT is a 16-bit counter and the count is packetized
every 5000 cycles. This is a passive attack where the data path and delay of
the original packets are not affected making the detection of HT close to
impossible. There maybe multiple such HT with counters. The area and power
overhead of HT with small counter is insignificant in a large MPSoC design so
they are hard to be detected. The adversary can use data mining techniques on
top of the collected data to arrive at information such as application running
on the system. This attack uses eavesdropping to extract user behaviors and
violates privacy of the user. Ahmed et al. (Ahmed et al., 2021a) talks about
what an remote access Hardware Trojan can do to the confidentiality of NoC
traffic. The authors highlight the severity of impact of the attack on multi-
tenant servers. remote access Hardware Trojan has a relatively small area
footprint compared to typical HT and can be used by a remote attacker to steal
confidential information. The HT can have a simple functionality as leaking
packet counts of a particular switch in a time window. After stealing
information, the HT will packetize and transfer the information to remote
attacker for further processing. Similar to (Ahmed et al., 2020a), the
attacker uses a ML technique, specifically an artificial neural network, to
infer properties of application running on the system and reverse engineer the
architectural design. The authors shows that it can reveal information such as
router micro-architecture, cache organization, processor platform, and NoC
configurations. Four remote access Hardware Trojans in a 64 mesh can
successfully reveal application running with an accuracy of 80%-98% in
different scenarios.

####  3.1.2. Integrity

Integrity of electrical NoC is less addressed compared to confidentiality.
Sepúlveda et al. (Sepúlveda et al., 2017) assumes that NoC IP is malicious.
The paper talks about 3 stages of the HT (1) Trojan design and insertion, (2)
malicious behaviour activation, and (3) execution of the attack. Network
interfaces are not considered malicious because integration of network
interface needs in house development. The malicious NoC contains of
compromised routers in both partially deactivated mode and fully deactivated
mode. The malicious router is capable of replacing a portion of incoming
packets using the information in malicious data register (Sepúlveda et al.,
2017). The HT to tamper and modify packets in router results in overheads of
1.3% , 0.1% and 0.3%. in area, power and performance, respectively. Apart from
attacking the integrity, the authors presents two other HTs in router to spoof
and launch replay attacks.

####  3.1.3. Availability

In this section, we review attacks on availability that utilize compromised
NoC components. JS et al. (JS et al., 2015) discuss about bandwidth denial of
service attack to disrupt availability of resources when running programs on
MPSoC. This attack directly affects the performance of the programs running on
MPSoC. Some application’s performance will heavily depend on specific IPs in
MPSoC. For example, a memory intensive task will heavily depend on memory
controller, the proposed DoS attack try to hinder the traffic flow to such
hotpots and cause application performance degradation. The authors show
proposed attack degrade packet latency in the rage of 14.5% to 72% depending
on the severity of the attack. The HT is inserted in the standard four-stage
virtual channel router with an activation method of software-hardware
collation, time based triggers and traffic characteristic based triggers. The
victim node selection of the HT will select a victim IP that has noticeable
drop by using heuristics such as high ingress/egress rate. Finally, the
traffic flow manipulation module of HT affects arbitration and allocation
stages of the packets to slow down and hinder performance. The HT will result
in negligible overhead of 4.32% and 0.014% in area and power, respectively. A
similar threat model is used in the discussion of (Fiorin et al., 2008).

Daoud and Rafla (Daoud and Rafla, 2018) propose a HT that results in DoS
attack by misrouting packets. The proposed attack will cause deadlocks and
virtual link failures. The HT can be implemented in malicious router with only
0.2% of additional overhead which can be considered insignificant to detect.
The HT has an inactive and waiting state which is even harder to detect. In
attacking state, the router will simply misroute the packet to incorrect
output port. For example, if the packet need to be switched to south output
port according to XY routing, the HT will direct it to the east output port.
The experimental results show that the attack will result in reduction of
number of received packets by the destination. Manju et al. (Manju et al.,
2020) also talks about DoS attack by misrouting the packets at routers and
attack selected set of nodes. The misrouting will also affect the flow control
and results in injection suppression which will eventually freeze the
communication in NoC. Similar to the threat model used in (Daoud and Rafla,
2018), this paper is also used threat model where router is malicious.
Furthermore, they assumed that there is only one such infected router to avoid
significant change in power consumption which will lead in detection of the
HT. HT inserted to the router in pre-silicon stage either by adversary having
access to design or by untrusted CAD tool. The HT will maliciously assign the
head flit of the packet to a wrong output port where the rest of the packet
will follow the misrouted path due to wormhole routing. The misrouted packet
counting cache coherence message will significantly degrade performance. When
running SPEC CPU benchmarks (Henning, 2000), the HT infected router in NoC
will result in only 80% delivery rate while 20% packets are lost in ping-pong
inside the NoC. The attack will also increase average packet latency by 87%
compared to the baseline without HT.

JYV et al. (JYV et al., 2018) propose a novel DoS attack on NoC that is
induced by a HT. Unlike the previous HT triggered by special timing and
external triggers, the proposed HT is triggered by special bit pattern in the
message. The paper discussed four HTs that can be integrated in the router
which can change flit count, address, head bit and tail bit. Once a flit
enters the router through buffer, the HT will modify a field/bit in the flit.
The router will react differently depending on the field changed by the HT.
For example, flit quantity Trojan can change the header field that represents
the number of flits in the packet. Mismatch between actual number of flits and
the value in the header field will result in abandoning the packets and re-
transmitting. HT changing tail and head bits results in 63% and 71% of
throughput reduction, respectively. Experimental results show that the effect
of address change and flit count change by HT results in more throughput
reduction. The results show similar trend in average packet latency, and total
number of packets received. Rather than having HTs at routers or network
interfaces, Boraten and Kodi (Boraten and Kodi, 2018a) introduce a novel DoS
attack on NoC via lightweight HTs at compromised links. This HT is capable of
inspecting the packets and injects faults to the systems so that the error
correction mechanism get triggered though error correction code. Errors will
inject into NoC where error detection mechanism is able to detect the error
and unable to correct it resulting in re-transmission. Single error correction
and double error detection is an example for such a simple error correction
code. Repetitive and frequent fault injection will result in DoS since
majority of the available bandwidth will be utilized by re-transmissions
resulting in back-pressure and network resource starvation. The proposed HT
has an externally controlled kill-switch to enable the attack and reduce the
chances of detection during verification process. A single HT in a link incur
less than 1% of the total power which makes the possibility of multiple
compromised links. Furthermore, experimental results show that even if all 48
links include a HT, they will have only 2% overhead compared to whole NoC. A
single HT can deadlock 81% of the injection ports and at least one link on 68%
of the routers in a small number of cycles.

All previously discussed attacks on availability utilize a compromised NoC.
For next few attacks, we focus on threat models where IPs are malicious.
Sudusinghe et al. (Sudusinghe et al., 2021) use a threat model of flooding
based DoS attack for their proposed countermeasure. The malicious IP targets a
critical component for SoC performance as memory controller. For example, a
node with malicious intent can flood packets to a node which is the
neighbouring node to a memory controller. This will make hot-spots around
frequently used and shared memory controller leading to a DoS. The authors
point out the increase in traffic rate of the routers in the path of
communication. This results in reduced performance, missed deadline, and
insufficient energy consumption.

Figure 13. Four scenarios of distributed DoS attack on NoC in the presence of
malicious IPs (Charles et al., 2020b).

The next set of efforts focus on threat models that use multiple malicious IPs
working collaboratively to launch attacks on availability instead of a single
compromised component. Charles et al. (Charles et al., 2019, 2020b) elaborates
distributed DoS (DDoS) attack on NoC. Multiple malicious IPs will flood the
NoC with useless packets to eat up the bandwidth and disrupt normal
communication. Most of the time these flooding will happen targeting critical
and shared IP such as memory controller to have higher impact on the attack.
Figure 13 shows several scenarios of DDoS attack in 3x3 mesh network where the
paths for flooding packets may or may not overlap. The flooded packets will
fill up buffers and eat up processing time of the routers in the path making
extremely high latency for legitimate packets. Several flooding based DoS
attack scenarios in mesh-based NoC has been implemented and evaluated in (Fang
et al., 2013). The authors present a novel congestion based attack model to
evaluate bandwidth based congestion attack on NoC. The authors have used two
scenarios of attack with two and four malicious nodes, respectively. They also
have explored different placement of the malicious IPs. The malicious node is
capable of generating constant bit rate traffic to the mesh based NoC. They
have evaluated the impact of these DoS attacks on XY-routing and four other
adaptive routing mechanisms namely odd-even, west-first, north-last and
negative-first. The experimental results show that XY routing performs better
in lower packet injection rates, and adaptive routing performs better at
higher rates. The experimental results also reveal higher degradation of
network performance with increasing number of malicious IPs flooding the
network.

Charles et al. (Charles et al., 2020a) discuss about a slightly different
threat model that uses multiple malicious IPs for DoS attack. IPs in SoC are
categorized into two zones as secure zone and non-secure zones considering the
trustworthiness of the IPs. In order to preserve integrity of the packets, a
message authentication code based authentication system is used. When a packet
traverses through the non-secure zone, the content of the packet can be
tampered by a malicious IP leading to failed message authentication code
verification. This will result in dropping of initial packets and re-
transmission of new packets. A malicious node can tamper either the request or
the response resulting in re-transmission. Tampering a large number of packets
in short interval can lead to a DoS attack. Tampering packets by multiple
malicious IPs can be recognized as a distributed DoS attack.

####  3.1.4. Authenticity

There are no recent efforts on explicitly attacking authenticity in electrical
NoCs. However, the confidentiality countermeasures with authenticated
encryption ensures authenticity which will be discussed in Section 3.2.

####  3.1.5. Anonymity

Anonymity in electrical mesh NoCs has been studied by (Charles et al., 2020a).
The threat model assumes that NoC is malicious. Specifically, there is a HT in
a compromised router which is capable of sniffing into the packets routing
through it. This HT can be triggered by a malicious program running in another
core. It can steal critical information from data when payload is not
encrypted. If payload is encrypted, it can gather packets that has same source
and destination. An intelligent attacker can use these gathered data to launch
complex cryptanalysis attacks. Sarihi et al. (Sarihi et al., 2021a) use a
similar threat model to (Charles et al., 2020a). Furthermore, they highlight
the fact that header information needs to be kept in plain-text in order for a
router to process the request fast without per hop costly decryption. This
leads to various kind of attacks such as differential cryptanalysis attacks by
collecting packets between the same endpoints.

####  3.1.6. Freshness

There are no recent efforts on attacking freshness in electrical NoCs.

###  3.2. Countermeasures

This section surveys effective countermeasures to defend against attacks
outlined in Section 3.1. Specifically, we discuss the countermeasures in the
following six major categories.

####  3.2.1. Confidentiality

We first review the countermeasures against side-channel attacks. Next, we
will survey countermeasures to defend against other types of attacks. Wang and
Suh (Wang and Suh, 2012) propose an efficient countermeasure against timing
side-channel attack to steal critical information. The solution is to use
multi-level security modeling of the SoC as IPs categorized into high and low
security zones. They propose a priority bandwidth allocation scheme for one-
way traffic from high security zone to low security zone. This ensures that
low priority traffic is not affecting the high priority traffic. So an
attacker cannot use throughput variations on high priority traffic to leak
sensitive information. Furthermore, the proposed solution ensures that the low
priority traffic will not be starved or lead to DoS by introducing static
lower bounds to low priority traffic bandwidth. The proposed countermeasure
can be implemented on routers with minimal power and area overhead while
successfully eliminating one-way side channel from high to low security zone
traffic. Furthermore, the authors propose two physical networks with spatial
or temporal network partitioning to fully eliminate timing side channel for
both directions.

Two mechanisms to avoid timing side channel attack by a malicious IP were
proposed by (Sepulveda et al., 2014). Both of these approaches focus on
dynamically allocating NoC resources. The first approach is random arbitration
at the router. Arbitration is one of the five main steps of a typical NoC
router that determines the input the router will serve as shown in 3. The
authors introduce randomness to the traditional deterministic arbitration. The
second approach is adaptive routing that mitigates timing side channel attack.
Both approaches introduce low area and power overhead. Sepúlveda et al.
(Sepúlveda et al., 2016) also proposed a security enhanced router for slightly
different threat model. It asumes that the secure router is capable of
mitigating timing side channel attack by a malicious program running in a
MPSoC. This mechanism ensures that side channel is not aware of the actual
communication. The allocator of this router dynamically allocates the number
of virtual channel for a particular input port. This is done by a modification
of memory management in a typical NoC router. Apart from the protection
against timing side channel attack, the proposed micro-architecture has added
advantage of better performance over a typical router. The secure router
micro-architecture has 8% and 9% power and area overhead, respectively.
Boraten and Kodi (Boraten and Kodi, 2018b) propose a non-inference based
adaptive routing mechanism to improve performance while securing against side
channel attack posed by the threat model in (Sepúlveda et al., 2011). This
mechanism spatially divides routers into security domains and dynamically
utilizes under-utilized routers through multiple adaptive routing algorithms.
There are a set of virtual channel allocation policies implemented to provide
security against inference between two security domains. The authors show that
this mechanism improves security and performance with only 1.84% power
overhead. A security enhanced architecture for distributed timing attack is
proposed by (Reinbrecht et al., 2016). Here, every router is equipped with a
traffic monitor. These monitors can recognize anomalies via bandwidth
monitoring. Once an anomaly is detected, it will send an alert message to the
neighbouring routers. After successful detection of a possible attack, the
routing algorithm of the sensitive path of the attack would change to bypass
the attack. Furthermore, the authors provide a mechanism to avoid false-
positives by introducing a confidence. Experimental results show reduction of
effectiveness of a distributed timing attack from 59.63% to 6.62%. Shao et al.
(Shao et al., 2008) provides a solution for power-side channel attacks on
traditional bus based architectures. The countermeasure is combined with a
novel bus arbiter and random number generator. When the bus arbiter receives a
request, it will send the random number generated by the random number
generator to both master and the slave of the communication. The master will
insert random dummy data with valid data. The slave can distinguish actual
data using the random number. The dummy data in middle will obfuscate power
values making it hard to correctly guess actual data values using power side
channel analysis.

So far, we have discussed countermeasures to defend against side-channel
attacks. Now we will focus on security countermeasures to defend against other
types of attacks. Ancajas et al. (Ancajas et al., 2014) proposed Fort-NoC
which is a solution for snooping eavesdropping attacks in a compromised NoC.
The solution uses a series of techniques to provide both reactive and
proactive multi-level protection. The data scrambling technique scrambles the
critical data at SoC firmware before handing it over to NoCs’ network
interface. This technique affects the backdoor activation of the HT and also
makes the leaked data incomprehensible to the attacker. The packet
certification technique simply adds an encrypted tag at the end of the packet
by the SoC firmware. The packets with invalid tags will be discarded making it
harder for covert communication initiated at compromised NoC. Node obfuscation
technique decouples and hides the source and destination of a given
communication. These three fort-NoC techniques have minimum performance
overhead of 3.8%, 2% and 001% in terms of packet latency. These methods
highlight that mult-level security can mitigate the snooping attack in
compromised NoC with low overhead.

Charles and Mishra (Charles and Mishra, 2020) propose a lightweight encryption
scheme using incremental cryptography. They highlight that most of the memory
request and response communication inside NoC differs by only few bits.
Incremental encryption compares two consecutive packets and encrypts only the
difference. The authors utilize this feature to minimize data bits needed for
encryption and decryption. They use Hummingbird-2 cipher (Engels et al., 2011)
as the encryption algorithm. The authors observed 57% (30% on average)
performance improvement over traditional routing mechanism with only 2%
overhead. Sepúlveda et al. (Sepúlveda et al., 2017) use traditional encryption
of counter-mode of the Advanced Encryption Standard (AES-CTR) to protect
against eavesdropping attacks. They use unique key for each of their
encryption and use linear feedback shift registers to generate initialization
vector for each instance. They use encryption of initialization vector and
counter to generate unique key for encryption. A lightweight encryption scheme
that utilizes two basic concepts of chaffing and winnowing(Rivest et al.,
1998) and all-or-nothing transform (Rivest, 1997) is proposed by Weerasena et
al. (Weerasena et al., 2021). All-or-nothing transform has a lightweight
quasi-group based implementation. Chaffing and winnowing process utilizes
inherent traffic characteristics of the NoC to speedup the overall encryption.
The implementation of the encryption scheme at network interface is fast and
lightweight compared to AES-CTR mode based countermeasure (Sepúlveda et al.,
2017). These results validate the fact that traditional security protocols do
not adapt well for resource-constrained NoC.

Although traditional authenticated encryption mitigates eavesdropping attacks,
they can introduce unacceptable overhead in resource constrained NoC. Charles
et al. (Charles et al., 2022) propose a lightweight digital watermarking
scheme to detect eavesdropping attacks. This solution replaces costly
authentication tag generation while maintaining confidentiality through
existing encryption scheme. A watermark will be embedded into every packet
stream. Both watermark encoding and decoding logic implemented on NI while
sender encodes and receiver decodes. The receiver will identify a packet
stream as invalid in case of an attack, or valid otherwise. Hussain and Guo
(Hussain and Guo, 2017) introduced another countermeasure to detect attacks
that will alter packet source and destination to leak packets. The proposed
lightweight authentication scheme generates tag by authenticating both source
and destination. The tag is scrambled with packet data. The tag inserted by
source processing element is verified by packet leak detection unit in
destination processing element. If the tag is altered or any of the address is
altered, the destination will detect the packet and invalidate it.

A two-tier protection mechanism is introduced by (Raparti and Pasricha, 2019)
to protect against eavesdropping attack. A snooping invalidation module is
presented as the first tier. This is implemented in output queue of every NI
which will discard packets with invalid header flits. Additional encoding
information provided by the processing element is used for the detection of
snoop packets. As second tier of protection will go after the source of the
attack where a malicious program running in a processing core. The detector
implemented at interface between NI and processing element needs to observe
traffic ratios for few hours to detect source of the attack. This two-tier
countermeasure protects NoC-based SoC from snooping attacks while reducing
application execution time.

A Simulated Annealing based randomized routing mechanism is proposed by (Ahmed
et al., 2020a) to overcome traffic analysis attack. Since a fully randomized
routing degrades performance of NoC, the authors used parameterized Simulated
Annealing that can balance between security against traffic analysis and
performance. The key idea of the countermeasure is to obfuscate traffic flows
so that the attacker cannot launch successful data mining techniques.
Simulated Annealing based randomized routing makes the path of the packet
unpredictable so that the features for the Machine Learning(ML) model is
obfuscated. This method reduces the user profile identification accuracy from
98% to 15%. An attack proposed by (Ahmed et al., 2021a) has the similar basic
intuition as (Ahmed et al., 2020a). Therefore, the solution presented by
(Ahmed et al., 2021a) to overcome ML-based attacks on eavesdropped data can be
used. The solution is routing obfuscation through adaptive routing mechanism.
This obfuscation will confuse the external adversary who conducts data mining
techniques on these data. Similar to previous works, this countermeasure has
configurablity to trade-off between security and performance.

Table 1. Summery of Attacks and countermeasures in electrical NoCs categorized
by security concepts.

| Security
---
Concept
Attack | Countermeasure |  | Overhead
---
Area—Power
Confidentiality |  | Timing side-channel & Covert channel
---
via Malicious Programs
| Priority bandwidth allocation with security
---
zones (Wang and Suh, 2012)
Minimal
Timing side channel via Malicious IP | Adaptive routing and random arbitration (Sepulveda et al., 2014) | 5-11% — 8-9%
Timing side channel via Malicious Program | Dynamic VCs per input port at router (Sepúlveda et al., 2016) | 9% — 8%
Non-inference based adaptive routing (Boraten and Kodi, 2018b) | NA — 1.84%
| Distributed timing side channel using
---
multiple malicious routers
| Traffic monitoring followed by adaptive
---
routing (Reinbrecht et al., 2016)
21.2% — 16.2%
Power side channel in bus architecture |  | Novel bus arbiter with random number
---
generator (Shao et al., 2008)
NA
Snoop in presence of Malicious Router and Colluding Program (Local or Remote) |  | Data scramble, Packet certification, Node
---
obfuscation at SoC firmware (Ancajas et al., 2014)
Minimal
Incremental encryption at NI (Charles and Mishra, 2020) | 2%
Encryption using AES-CTR (Sepúlveda et al., 2017) | NA
| Chaffing & Winnowing with All-or-nothing
---
transform (Weerasena et al., 2021)
Minimal
| Authenticating source and destination of
---
packets (Hussain and Guo, 2017)
3.4% — 2.6%
Digital watermarking to detect snooping (Charles et al., 2022) | NA
| Snoop in presence of Malicious Network
---
Interface and Colluding Program
Snooping Invalidation and Detection (Raparti and Pasricha, 2019) | 2.2 % — 5.5%
Eavesdropping using HT at router and ML to analyze traffic patterns. | Simulated annealing based randomized routing (Ahmed et al., 2020a) | NA
| Obfuscation through randomized routing (Ahmed et al., 2021a) | NA
Integrity | Message tamper via malicious router |  | Applying and Validation of message authentication
---
code at Network Interface. (Sepúlveda et al., 2017)
NA
Anonymity |  Complex cryptanalysis attacks by gathering packets via Malicious Router. | Tunnel based anonymous routing protocol (Charles et al., 2020a) | NA
| Anonymous routing protocol with encrypted
---
destination (Sarihi et al., 2021a)
1% — 10%
Availability | Bandwidth DoS via Malicious Router | Audit and Monitor at NoC Firmware (JS et al., 2015) | 12.37% — 9.34%
Monitoring and analysing traffic (Fiorin et al., 2008) | 7.6% — NA
DoS by Misrouting via Malicious Router | Localize and Detour at Routers (Daoud and Rafla, 2018) | 0.4% — 0.6%
Detect, Shield & Detour at Routers (Manju et al., 2020) | 2.78% — 3%
DoS via Malicious Router | Obfuscation at Routers (JYV et al., 2018) | 22.2% — NA
DoS via Multiple Malicious Links | Monitor & Obfuscate at Routers (Boraten and Kodi, 2018a) | 2% — 6%
DoS by Flooding via Malicious IP | ML based Detection (Sudusinghe et al., 2021) | 6% — 7%
Distributed DoS by flooding via Multiple Malicious IPs | Monitor, Detect & Localize at Router and IP (Charles et al., 2019, 2020b) | 6% — 4%
Hybrid Routing (Fang et al., 2013) | NA
| DoS by tampering packets via
---
Multiple Malicious IPs
Trust aware routing (Charles et al., 2020a) | 6% — NA

####  3.2.2. Integrity

Sepúlveda et al. (Sepúlveda et al., 2017) proposed a tunnel based solution
that protects electrical NoC against message modification attacks. The
solution assumes that the network interface is trustworthy. The authors use
SipHash-2-4 as the algorithm to generate the message authentication code.
Siphash (Aumasson and Bernstein, 2012) is popular for generating message
authentication code for shorter inputs. The proposed countermeasure generates
64-bit message authentication code and appends it to the message. The receiver
regenerates the tag from that end and compares the tag for possible tampering
of the message. Any mismatch between the two tags will indicate unauthorized
modification of the message content. Furthermore, the authors makes the
countermeasure configurable by controlling Siphash rounds.

####  3.2.3. Authenticity

Although there are no threat models solely focused on authentication in recent
literature, the solutions for confidentiality that provide authenticated
encryption also ensures authenticity. Although the SipHash-2-4 implementation
in (Sepúlveda et al., 2017) focuses on integrity, the inclusion of the source
field in hash calculation guarantees that the data in the source field is
authentic. Several other attempts to develop lightweight authenticated
encryption can be found in the literature. The packet certification technique
with an XoR cipher in (Ancajas et al., 2014) uses a tag to be validated by the
receiver. The sender will append a tag to the message which can only be
validated by the receiver. Another authentication scheme is proposed by
Boraten and Kodi (Boraten and Kodi, 2016). It is a reconfigurable packet
validation and authentication scheme by merging two robust error detection
schemes, namely, algebraic manipulation detection and cyclic redundancy check.
Intel’s TinyCrypt (Intel, 2016) is a cryptographic library targeting resource-
constrained IoT and embedded devices. It provides fundamental cryptographic
building blocks consisting of hash functions and message authentication codes
that can be used in ensuring authenticity in NoC.

####  3.2.4. Anonymity

A lightweight anonymous routing protocol to ensure anonymity inside NoC is
introduced by (Charles et al., 2020a). The proposed technique initiates a
tunnel between the sender and receiver through a three-way handshake. The
handshake uses per hop encryption and decryption to ensure a secure tunnel
creation. After the tunnel creation, a router in the path only knows about the
preceding and following routers. Therefore, the data transfer in tunnel
ensures anonymity. The proposed anonymous routing ensures anonymity with only
4% impact on performance while traditional onion routing implementation
introduces 1.5X performance degradation.

Sarihi et al. (Sarihi et al., 2021a) propose an anonymous routing mechanism in
NoC. This routing mechanism uses encrypted destination address and prevent any
malicious router in the middle collecting the packets of same flow. Instead of
plain-text source and destination, approximate routes and turns are embedded
into the packet with encrypted destination. Hummigbird-2 is used as the
lightweight encryption needed in the scheme. The packets in the NoC are
divided into secure and non-secure packets. Secure packet ensures that it’s
destination and source are not leaked to any unauthorized party through
proposed routing mechanism. This solution incurs minimal area overhead of 1%
and power overhead of 10%.

####  3.2.5. Availability

JS et al. (JS et al., 2015) proposes a bandwidth DoS runtime attack detection.
The authors present RLAN (Runtime Latency Audition for NoCs) which is an
auditor to monitor traffic characteristics of the system. RLAN does not need
any support form NoC. The countermeasure is implemented in the firmware module
that interfaces the NI with processing element. RLAN performs this in two
steps (1) RLAN will carefully inject selected packets to the network and the
NoC firmware will monitor anomalies in the packet transfer delays. (2) RLAN
will look for comparable latencies of two packets which has overlap in their
path (spatial similarity) in the same time frame (temporal similarity). RLAN
will generate packet by slightly altering the destination and source which
will have the same hop count as legitimate packet. Before sending the packet
for packetization, the RLAN will tag the packet with timestamp to establish
latency thresholds. An adequate sample size can be used to detect DoS attack
by comparing the latencies between a RLAN injected packet and its original
counterpart. RLAN has the overhead of 12.73%, 9.34% and 5.4% in area power and
network latency, respectively. A monitoring system to avoid bandwidth based
DoS attack is proposed by (Fiorin et al., 2008). The denial of service probe
collects traffic statistics of packets generated by processing elements. Any
unnatural condition in traffic flags a potential DoS attack. The authors point
out the requirement of effective way to minimize false positives for
incorrectly classifying normal anomalies as a DoS attack.

Daoud and Rafla (Daoud and Rafla, 2018) propose a method for real-time
detection and localization of DoS attack. They also provide a prevention
technique with new routing protocol which will avoid interaction with
malicious nodes by detouring traffic around. The detection of the attack is
straightforward as the downstream router can detect it by comparing it with
the XY routing protocol decision for routing path violation. Once the
downstream router detects a misrouted packet, it will inform the operating
system and neighbouring routers where they will flag the upstream router of
that packet as a malicious router. This can be visualized as the malicious
router is covered by a shield ring by neighbouring routers. The neighboring
routers of the malicious router will detour the packets avoiding any
interaction with the malicious router while transferring the packets. This
rerouting module has only 0.4% area overhead compared to the base router. The
countermeasure increases packet latency due to detouring of the packet and it
will incur 0.6% additional power overhead.

Manju et al. (Manju et al., 2020) describes Trojan aware routing mechanism for
DoS attacks. This mechanism is implemented in all the routers. Trojan aware
routing has 3 stages. The Trojan detection stage detects whether the
neighbouring/upstream router is Trojan infected by the current router. The
detection module of Trojan aware routing will detect violation of routing
protocol and indicates it using two flags (Boolean alert flag and direction
flag) in the current router. The dynamic shielding phase will create a virtual
shield surrounding the malicious router. The router who detects the Trojan
will send alert to the neighbouring routers of the malicious router so that
the neighbouring routers update their flags. The bypass routing stage is a
modified XY routing. At each router, it will look at the two flags and
activate detour if the next hop is a malicious router, otherwise the normal XY
routing will continue. Trojan aware routing shows reduction of 38% packet
latency compared to HT infected router and has only 7% increase of packet
latency compared to baseline NoC. Trojan aware routing has only 6% reduction
of throughput compared to baseline. In terms of hardware overhead, Trojan
aware routing has 2.78% of area and 3% of leakage power overhead.

Charles et al. (Charles et al., 2019, 2020b) present a mechanism to detect and
localize distributed DoS attacks by multiple malicious IPs by monitoring
communication patterns. At design time, the communication patterns are
analyzed and parameterized as packet arrival curve at each router and packet
latency curve at each IP. The routers will store packet arrival curve and use
it to detect a real-time violation by comparing it with upper-bound from the
curve. Once a router flags a detection of DDoS attack, the corresponding IP of
that router is responsible for localizing the attack. The IP will compare with
packet latency curve upper bound to determine abnormal latencies. Once it sort
out the delayed packet, the IP will communicate with the routers in the path
for congestion information and use that information to localize the malicious
IPs. The experimental results show that attack detection is faster when more
malicious IPs are available. Experimental results also reveal fast
localization time. The proposed approach has 6% and 4% area and power
overhead, respectively.

Fang et al. (Fang et al., 2013) talk about robustness of the DDoS attacks on
mesh-based NoC with different malicious IP numbers and placements. Among five
routing algorithms (XY routing and four adaptive routing), XY routing performs
better at traffic injection rates less than 0.65. However, the authors suggest
that for higher traffic injection rates adaptive routing algorithms perform
better. They also propose a set of design guidelines to elevate system
performance in a DoS attack scenario. They suggest a hybrid scheme of
deterministic routing and adaptive routing that will switch based on the
traffic injection rates.

Fang et al. (Fang et al., 2013) propose a heuristic for DoS attack initiated
by exploiting error correction mechanism in NoC. The threat detection
mechanism implemented in the router will detect threat by probing and
monitoring links with transient and frequent faults. The detector will examine
all incoming flits in terms of whether they are having a fault and whether the
fault is seen in similar locations earlier. After a successful detection, the
authors propose multiple link obfuscation techniques to mitigate the effects
of the proposed DoS attack. When an artificial fault in the packet is tagged
by the detection module, the mitigation module will look for the fault
location (whether the fault is in the header, payload or both). Next, it will
use either shuffle, scramble or invert bits to obfuscate the target of the
compromised link. The mitigation module may have to run multiple times to
choose correct obfuscation technique. The experiment results show successful
mitigation of the proposed attack with only 2% and 6% area and power overhead,
respectively. Finally, the authors proposed optimized algebraic manipulation
detection as a solution to maintain integrity in malicious links.

The authors in (JYV et al., 2018) propose a mitigation technique inside the
router that may have Trojan to alter header fields (no of flits, destination,
head flag bit, and tail flag bit) to cause DoS attacks. The basic idea is to
shuffle the bit fields among themselves and other fields to obfuscate
information. Furthermore, the authors propose a single bit error code
correction on top of the obfuscation to mitigate effects from Trojans.
Immediately after the flit enters the router, the shuffle encoder will shuffle
header fields. The shuffling pattern is determined by the last few bits of the
actual payload of the packet. For example, there will be eight shuffling
patterns determined by the last three bits of the payload. After the router
goes trough it’s all stages, the de-shuffler returns the header fields to the
normal bit pattern. Since the HT is inside the router, it cannot do meaningful
attack by bit alterations from shuffled bits. For example, the HT is unaware
of the position of the bits representing number of flits in the packet.
Experimental results show that the proposed methodology is able to recover 67%
and 45% in changing number of flits and destination address, respectively. The
mitigation technique has area overhead of 21% compared to baseline router.

Sudusinghe et al. (Sudusinghe et al., 2021) observe that the real benchmarks
in general purpose system may have unpredictable traffic patterns, and
therefore, simple statistical patterns would not adapt well for them. So they
propose a ML based approach for DoS attack detection. They have explored
several supervised ML approaches for the DoS detection. During the design
time, the data for both normal and attack scenarios are collected using known
applications. A ML model is trained and stored in a dedicated core for
security. At run-time, the probes are used to collect data from routers.
Separate physical NoC is used to send data to the security core for
prediction. The security core will predict the traffic pattern as attack or
normal scenario. They have used 20 distinct features for this ML detection.
Two physical NoCs have 6% and 7% area and power overhead, respectively. They
have compared performance of 12 different ML models - XGBoost algorithm
performs better with an accuracy of 99% in successfully detecting DoS attack
in 4x4 mesh based NoCs.

Charles et al. (Charles et al., 2020a) propose a trust aware routing mechanism
to overcome DoS attack in the presence of multiple malicious IPs. The authors
model trust of routers which calculates the trust based on feedback from
neighbouring routers and propagate the values through NoC. A neighbouring
router will keep on trusting of the upstream router if the packet was not
tampered and reduce it’s trust if packet is tampered. When a particular IP
wants to send data, an adaptive trust-aware routing algorithm will be used to
route the packets avoiding untrusted routers. This lightweight mechanism can
be integrated with any of the existing authentication protocol to mitigate DoS
attacks that exploits authentication checking.

####  3.2.6. Freshness

There are no recent efforts on attacks or defenses related to freshness in
electrical NoCs.

Table 1 shows the summary of the surveyed papers attacking confidentiality,
integrity, availability, authenticity and freshness in wireless NoCs and
corresponding countermeasures.The first column shows the main security
concept. The second column outlines the threat model. The second and third
columns provide the countermeasure and associated overhead in terms of area
and power.

##  4\. Wireless On-chip Communication Security

Wireless NoC is promising to mitigate the routing challenges associated with
multi-hop communication in electrical NoCs. However, wireless NoCs introduce
inherent vulnerabilities due to wireless communication. In this section, we
survey recent research efforts in securing wireless NoCs. First, we discuss
the threat models and attacks on wireless NoCs. Next, we describe the
countermeasures to defend against these attacks.

###  4.1. Threat Models and Attacks

The attacks on wireless NoCs follow the similar threat models as the
electrical NoC with subtle differences for wireless communication. In this
section, we explore the attacks on wireless NoCs in the following categories.

####  4.1.1. Confidentiality

Lebiednik et al. (Lebiednik et al., 2018a) consider multiple attacks in their
threat model and one of them is the eavesdropping attack. The authors consider
a single point of attack and avoids the scenarios where an unbound attacker
can disrupt the system. They assume that their HT cannot affect physical layer
since HT is placed in the digital circuit. Furthermore, since the chip is
covered with metallic box, the the Radio Frequency (RF) signals cannot be
leaked outside or attacker cannot inject RF signals from outside. Figure 14
shows typical wireless chip with metallic cover. The authors highlight that
the broadcasting nature of messages in wireless NoC makes it inherently
vulnerable to eavesdropping attack.

Figure 14. Wireless NoC based SoC with metallic cover hinders access to an
external attacker (Lebiednik et al., 2018a).

Pereñíguez-García and Abellán (Pereñíguez-García and Abellán, 2017) describes
multiple attacks in hybrid NoC. The target system has shared L3 banks
distributed in 16 nodes and private L2 cache at each node. The authors focus
on the broadcast cache coherence message communication between L2 and L3 for
all the attacks. They label L3 as sender and L2 as receivers while the
communication is done via wireless NoC. The authors assume an ideal condition
of all L2 and L3 nodes having wireless receivers and transceivers. The
electrical NoC assumed to be secure while wireless medium is not secure. In
proposed eavesdropping attack, the attacker captures messages over wireless
medium which can lead to leaking sensitive information such as passwords and
keys.

Vashist et al. (Vashist et al., 2019a) describe eavesdropping attack from both
external and internal adversaries. The attack is passive and hard to detect in
both cases. This is done by the attacker tuning into the unprotected wireless
channel. An external attacker need to have external receiver tuned to the
wireless band used inside wireless NoC with enough sensitivity. An internal
attacker will forward eavesdropped packet to a malicious IP.

####  4.1.2. Integrity

Pereñíguez-García and Abellán (Pereñíguez-García and Abellán, 2017) describe
unauthorized modification of packets in wireless medium in a hybrid wireless
NoC. The attacker changes the content of the message and forwards it to the
intended destination. The attacker is capable of full or partial modification
of the content compared to the real version of the message. The authors point
out the need for novel hashing mechanism with less than 30 cycles to harness
fast broadcasting of cache coherence messages via wireless NoCs.

####  4.1.3. Availability

We discussed the general attack model proposed by Lebiednik et al. (Lebiednik
et al., 2018a) earlier which also discusses about DoS attacks. The authors
point out that misconfiguration in media access control protocol can lead to
DoS attack. For example, two nodes transmitting in the same channel can cause
collision and corruption of messages. A rouge node can transfer packets out of
turn violating fundamental rule of collision-free media access control
protocol. Therefore, repetitive collision can eat-up bandwidth which can lead
to bandwidth DoS attack. The proposed attack can lead to throughput drop over
70% in the presence of a selfish node that unfairly consumes bandwidth.

DoS attacks on wireless NoC is first discussed by Ganguly et al. (Ganguly et
al., 2012). The threat model assumes HT in a processing core injecting dummy
packets into the network. These garbage packets will occupy majority of the
virtual channels and output ports of a switch. This will result in disturbance
of traffic in and out of the switch. Further propagation of this congestion to
neighbouring switches will result in DoS attack.

Persistent jamming-based DoS attacks by both internal and external attackers
have been studied in (Vashist et al., 2019a). During the attack period, the
proposed attack is capable of making interference on wireless communication.
This causes bit errors in contiguous bits known as burst errors. The attack
will continue for a long period of time resulting in long contiguous bit
errors that cannot be corrected by existing error correction codes. This will
result in re-transmission that can eventually lead to DoS attack. The internal
attack is initiated by a HT affected wireless interface.

Vashist et al. (Vashist et al., 2019b) also talks about persistent jamming
based DoS attacks. They highlight the fact that it is impractical to use
traditional channel-hopping technique as a countermeasure on wireless NoC due
to use of limited number of channels. This attack has similar effect of burst
errors as discussed in (Vashist et al., 2019a). Ahmed et al. (Ahmed et al.,
2021b, 2020b) also outline a similar threat model in wireless NoC for
persistent jamming based DoS. The attack was conducted on multicore-multichip
topology where two wireless interfaces are available in a chip for inter-chip
communication.

####  4.1.4. Authenticity

Lebiednik et al. (Lebiednik et al., 2018a) discuss spoofing attack on wireless
NoCs. Wireless being the broadcast medium, it is inherently vulnerable to
spoofing attacks. Malicious cores use this to impersonate other cores by
changing the source address of flits. The authors highlight that spoofing can
be used to get access to unauthorized regions of memory or steal unauthorized
information. Furthermore, the spoofing attack on authenticity can lead to
attack on availability by responding with wrong information to legitimate
signals by a rouge node. Lebiednik et al. (Lebiednik et al., 2018b) discussed
this attack in detail. The spoofing attacks are conducted from inside since
the chip package blocks external signals. The HT is in the digital circuit of
wireless NoC. The attacker sends spoof cache invalidations. The authors show
that even 10% such spoof invalidations can lead to 27% drop in NoC
performance.

Pereñíguez-García and Abellán (Pereñíguez-García and Abellán, 2017) also talks
about impersonation in hybrid wireless NoCs. The attacker simply tricks other
IPs of the wireless NoC that they are having legitimate communication with
actual IP while they are actually communicating with a malicious IP.

####  4.1.5. Anonymity

There are no recent efforts on attacking anonymity in wireless NoCs.

####  4.1.6. Freshness

Pereñíguez-García and Abellán (Pereñíguez-García and Abellán, 2017) describe
replay attack. The attacker will store a valid message exchanged over the
wireless NoC. Then the attacker will inject the same packet without
modification. The receiver will waste time or conduct an unwanted action for
such artificially delayed redundant messages.

###  4.2. Countermeasures

This section surveys countermeasures to defend against the attacks discussed
in Section 4.1 categorized by security concepts.

####  4.2.1. Confidentiality

Lebiednik et al. (Lebiednik et al., 2018a) propose a set of hardware solutions
against multiple attacks including eavesdropping attack. The solution for
eavesdropping attack is included as a module in the network interface. The
authors use stream ciphers as the low cost solution for eavesdropping attack
and highlight the fact that Advanced Encryption Standard (AES) (Daemen and
Rijmen, 1999) is not suitable for resource-constrained wireless NoCs. The
proposed solution will take bit-wise decision of flipping bits using symmetric
keys. The proposed Py (Crowley, 2006) algorithm will take only 2.85 cycles
compared to 20 cycles of AES. The area and power overhead of Py is minimal
while having less network saturation compared to AES. However, Py is
vulnerable to liner distinguishing attacks. Although (Pereñíguez-García and
Abellán, 2017) provides solutions for different kind of attacks they do not
consider eavesdropping. They reasoned that all broadcast messages through
wireless NoC only contain memory address and destination node ID and they are
not critical information to hide. Many researchers argue that eavesdropping
and collecting broadcasting messages can lead to complex attacks to disrupt
confidentiality and privacy of SoC through machine learning based techniques.
Vashist et al. (Vashist et al., 2019a) propose eavesdropping attack prevention
technique embedded to each transceiver. It performs XOR-based data scrambling
based encoding in each sensitive data transmission. The header bits are kept
as plaintext for faster routing. This method is extremely lightweight and fast
due to XOR operation. For internal eavesdropping attack, the authors propose a
low complexity rule checker on destination address at wireless interface.

####  4.2.2. Integrity

Usage of a hash function is proposed by (Pereñíguez-García and Abellán, 2017)
to overcome integrity issue in wireless NoC. The sender appends a tag with
hash value at the end of the packet while receiver validates the tag upon
receiving. The authors use a lightweight hash function of SPONGENT family
(Bogdanov et al., 2012) as the most reliable and efficient solution for
wireless NoC. Specifically, they have used SPONGENT configuration which
results in a 88-bit length hash value and operates using 8-bit blocks. The
authors assume that it will take 450 cycles for hash function to generate
output in 1GHz frequency.

####  4.2.3. Availability

Ganguly et al. (Ganguly et al., 2012) propose a design methodology to mitigate
effect of DoS attack. The authors propose a small-world topology which is
known for its inherent resilience to DoS attacks. The small-world topology has
many short-distance links and a small number of long distance shortcuts. The
topology has both wired and wireless links. The authors have optimized the
defence against DoS attack by simulated annealing to mitigate spreading of DoS
attack. Experimental results show that the proposed methodology assists high
data transfer rate with low power dissipation.

A DoS prevention using unfairness detection is proposed as a module in
Prometheus (Lebiednik et al., 2018a). The module monitors possible collisions
violating collision avoidance media access control protocol protocol. After a
successful detection of collision, the wired NoC of hybrid wireless NoC is
used to send the message to suppress transmissions of the malicious node.
Furthermore, the operating system will turn off the communication of the
malicious node by ID. In a case of collision-based media access control
protocol where collision is part of the protocol, the detection is hard. The
authors define an unfairness ratio and a configurable threshold of it’s value
to identify malicious nodes.

Vashist et al. (Vashist et al., 2019a) propose an attack detection and
mitigation technique for jamming-based DoS attack. They use an ML-based model
to distinguish random burst errors from burst errors by a DoS attack. After a
successful detection, a defense unit at each transceiver is used to mitigate
the attack depending on whether the attack is internal or external. In case of
an external attacker, all the wireless interfaces will be disabled from data
routing, instead wired links will be used. In case of an internal attacker,
the power supply will be removed from the specific Trojan infected
transceiver. The authors in (Vashist et al., 2019b) propose a modification of
existing Built-In-Self-Test (BIST) framework used for testing to monitor
jamming-based DoS attacks. The defense mechanism is similar to (Vashist et
al., 2019a). The proposed method is able to detect DoS attack with accuracy of
99.87% with only ¡3% communication overhead and ¡1% energy overhead. Ahmed et
al. (Ahmed et al., 2021b, 2020b) use a similar approach of utilizing BIST
framework to detect persistent jamming based DoS attacks. They used both
regular ML-model and adversarial ML classifier for this detection. A
reconfigurable media access control protocol is used as the countermeasure to
mitigate DoS attack. The reconfigurable media access control protocol is
implemented at transceiver. It uses reservation-based media access control
protocol in normal scenario and special attack mitigating media access control
protocol otherwise. ML and adversarial ML classifiers show 99.87% and 95.95%
accuracy in attack detection, respectively. Reconfigurable media access
control protocol helps to mitigate the effect of DoS attack with 1.44x and
1.56x latency impact for internal and external attack, respectively. The
authors have used K-nearest neighbours algorithm for the detection part of DoS
attack in previous work with accuracy over 99%. The other parts of the
solution is same with few subtle differences.

####  4.2.4. Authenticity

RF power analysis is used in (Lebiednik et al., 2018a, b) to detect spoofing
attacks in wireless NoCs. The authors also highlight the impracticality of
using asymmetric key signature schemes in NoCs despite their use in
traditional wireless networks. The proposed solution can measure power level
of the received transmission. Due to the topology, an effective source address
can be derived from the observed power level. A mismatch in effective source
address and actual address in packet header is recognized as a potential
spoofing attack. To overcome the challenge of correctly identifying the nodes
equidistant to a particular node, the authors propose to place attack
detection modules at each corner of NoC.

Pereñíguez-García and Abellán (Pereñíguez-García and Abellán, 2017) observe
that there is no need for both sender (L3) and receiver (L2) to authenticate
each other using a secret key because the specific message in the threat model
are in the same application context. They suggest only one-way authentication
of sender which is verified by the receiver. The scheme uses a key bind into a
specific process to do this authentication using symmetric cryptography.

####  4.2.5. Freshness

Pereñíguez-García and Abellán (Pereñíguez-García and Abellán, 2017) suggest a
counter-based scheme to monitor the freshness of the communication. This is a
simple counter initialized into a random value by the operating system when
creating the process. When broadcasting the message, the counter is
incremented by one. The receiver will have local variable representing the
counter for each sender. Upon receiving the packet, each receiver will compare
it’s local counter value with the value inside the packet. A mismatch in the
counter will flag a redundant message and it will be discarded.

Table 2 shows the summary of the surveyed papers attacking confidentiality,
integrity, availability, authenticity and freshness in wireless NoCs and
corresponding countermeasures.The first column shows the main security
concept. The second column outlines the threat model. The second and third
columns provide the countermeasure and associated overhead in terms of area
and power.

Table 2. Summery of Attacks and countermeasures in wireless NoCs categorized
by security concepts.

| Security
---
Concept
Attack | Countermeassure |  | Overhead
---
Area — Power
Confidentiality | Eavesdropping attack via HT | Encrypt using stream cipher at NI (Lebiednik et al., 2018a) | Minimal
| Eavesdropping of broadcasting L2 to
---
L3 cache coherence messages
| No mitigation, since broadcasting from L2 to
---
L3 does not contain critical information (Pereñíguez-García and Abellán, 2017)
NA
External and internal eavesdropping | XoR-based data scrambling at transciver (Vashist et al., 2019a) | NA
Integrity | Unauthorized Modification of packets | Usage of low-cost hashing (Pereñíguez-García and Abellán, 2017) | NA
Availability |  | DoS attack visa misconfigured
---
Media Access Control (MAC)
Prevention through unfairness detection (Lebiednik et al., 2018a) | NA
DoS attack via flooding by malicious IP |  | Small-world topology with simulated
---
annealing (Ganguly et al., 2012)
Low
Persistent jamming-based DoS by Internal or External attacker | ML-based detection and avoiding (Vashist et al., 2019a) | NA
| Monitoring using built in test
---
framework (Vashist et al., 2019b)
NA
| ML based detection using testing framework
---
Reconfigurable MAC for mitigation (Ahmed et al., 2021b, 2020b)
Low
Authenticity | Spoofing by malicious IP | Detection by RF power analysis (Lebiednik et al., 2018a, b) | Low
|  | Authentication by symmetric
---
cryptography (Pereñíguez-García and Abellán, 2017)
NA
Freshness | Replay attack | Counter based scheme (Pereñíguez-García and Abellán, 2017) | NA

##  5\. Optical On-chip Communication Security

Optical NoC design and security analysis is an active research field. In this
section, we survey security of optical NoCs. First, we review the threat model
and attacks on optical NoCs. Next, we survey the countermeasures to defend
against these attacks.

###  5.1. Threat Models and Attacks

Bus-based topologies and their variations can be considered as the most common
topologies in optical NoCs. Therefore, there are different set of threat
models and vulnerabilities compared to mesh based electrical NoCs. In this
section, we explore threat models and attacks on optical NoCs.

####  5.1.1. Confidentiality

Figure 15. Eavesdropping attack on optical NoCs in the presence of HT in
Optical Station (Bashir et al., 2020).

Bashir et al. (Bashir et al., 2020) discuss multiple categories of attacks on
optical NoCs. We focus on general threat model and specific attack on
confidentiality in this section while other attacks are discussed in
subsequent sections. The attack model trusts only the sender and receiver. In
other words, it considers that NoC and other IPs connected to it can be
malicious. Furthermore, the threat model assumes that an attacker cannot
tamper with clock, power or ground lines. Eavesdropping attack on optical NoCs
is simple. A malicious IP can simply listen into the shared waveguide and
steal sensitive data without altering the original communication. According to
Figure 15, station 1 sends message to station 3. Since station 2 is malicious,
the HT will turn on and tune the detector (MR inside the detector) on
wavelength used by station 1 and 3. Then station 2 can steal critical
information intended for station 3. MRs are highly sensitive for temperature
variations. Therefore, there is a control system for thermal sensing at
different locations in optical NoC and corresponding tuning MRs. However,
these sensed thermal data needs to be sent to collection node to calculate
relevant tuning adjustments of each MR. In hybrid optical NoCs, electrical NoC
is used to send these control signals. Zhou et al. (Zhou et al., 2021) talks
about attack on confidentiality when sending optical NoC control signal data
(thermal sensing values) through insecure electrical NoC.

Chittamuru et al. (Chittamuru et al., 2018, 2020) introduced a spoofing attack
through HT in MR tuning circuit. A gateway is responsible for interfacing
shared wave-guide of optical NoC to processing cluster. An HT in gateway is
able to manipulate tuning circuit of MR to partially tune the neighbouring
wavelength. Once it snoops data from ongoing communication, the data will be
sent to a malicious node to extract critical information. Multiple side
channel attacks caused by resource contention is discussed by Guo et al. (Guo
et al., 2020). There is a malicious switch sharing common resource such as
link with a legitimate communication. The malicious switch competes and
intentionally allows the legitimate communication win. The malicious switch
observes timing characteristics of the flow and extracts secret information
from them. The authors discuss two side-channel attacks of one-way and two-way
interference that uses discussed threat model. The authors also discuss an
attack that leaks critical NoC temperature related control data that can be
used by other attacks.

Figure 16. Message tampering attack on optical NoCs in the presence of HT in
Optical Station (Bashir et al., 2020).

####  5.1.2. Integrity

Bashir et al. (Bashir et al., 2020) use the same basic threat model as
discussed in Section 5.1.1 for attack on integrity. The attacker has the
ability to actively modify packets of an ongoing legitimate communication. The
attacker will simply capture and delete original packet from the bus, modify
the content of the packet, and finally place the packet with tampered data on
bus with the same destination. Figure 16 visualizes message tampering attack
by compromised station 2 on legitimate data transfer. Similar to eavesdropping
attack, tuning MR to a selected wavelength by HT is the origin of the attack.

As discussed earlier, optical networks are sensitive to temperature since
thermal sensing is integrated into optical NoCs. Zhou et al. (Zhou et al.,
2021, 2020) outline an attack that tampers the thermal-sensing control
procedure of MRs. The optical router is the focal point of this attack where
the thermal-sensing measurement is happening. HT in optical router will tamper
modulation voltage which results in incorrect measurements. This will lead to
negative impact on performance and reliability. The authors highlight that
these HTs are harder to detect due to their negligible overhead.

####  5.1.3. Availability

Multiple HT-based remote DoS attacks on optical NoCs have been studied by (Guo
et al., 2020). The threat model assumes that every node has a optical
switching cell for switching of optical signal. A blackhole attack on optical
NoC is led by HT inserted in switching cell. In blackhole attack, HT will drop
packets without forwarding them to correct local output port. Sinkhole attack
is also led by same HT in switch. When an upstream switch wants to forward
data to a downstream switch, it considers available wavelengths and modes in
the downstream switch. In sinkhole attack, the HT will notify more empty
wavelength and modes than what the switch actually have. Both blackhole and
sinkhole attacks result in performance degradation which will leads to DoS
attack. The authors also elaborate flooding attack where a malicious cell
continuously injects dummy packets to induce a DoS attack.

####  5.1.4. Authenticity

A spoofing attack can also be easily conducted on top of the basic threat
model by (Bashir et al., 2020) which was discussed in Section 5.1.1. Malicious
IP/station connected to the shared optical wave-guide can tune it’s MR to
listen to an on-going communication and impersonate the sender or the
receiver. Similar to attack on integrity by (Guo et al., 2020), attacker can
capture and remove a legitimate request from sender. After that either it can
respond to the request impersonating as the destination or it can send it’s
own request back to the wave-guide impersonating as the legitimate sender.
Impersonating as the sender can result in attacker obtaining sensitive
information from the destination or make destination conduct an unintended
task.

Zhou et al. (Zhou et al., 2021) also talk about possible spoofing attack in
thermal sensing control procedure. As discussed in Section 5.1.2, the optical
router measures the raw data for temperature calculation. Then it needs to
transfer this data to processing unit through low priority electrical NoC. The
unique identifier for optical router in control packet can be changed so that
the processing element can calculate and act on different optical router as
intended. This will also lead to performance degradation and unreliable
communication. The effects of the attack will be different in each instance
making it harder to detect these attacks.

####  5.1.5. Anonymity

There are no recent efforts on attacking anonymity in optical NoCs.

####  5.1.6. Freshness

The same basic attack model discussed in Section 5.1.1 can be used by an
attacker for replay attack (Bashir et al., 2020). An HT in the middle of a
legitimate communication can tune itself through MR tuning circuit. Then the
attacker can store selected messages from the session internally and inject
them again to the wave-guide. This can result in destination doing unintended
action. Frequent injections can result in unwanted bandwidth utilization
affecting legitimate communication. The authors highlight the fact that this
attack is possible even with encrypted payload in the packet.

###  5.2. Countermeasures

This section surveys the countermeasures to defend against the attacks
outlined in Section 5.1 categorized by security concepts.

####  5.2.1. Confidentiality

Bashir et al. (Bashir et al., 2020) propose a layer of security in between
optical station and processing elements. The authors highlight that optical
networks are more sensitive to latencies in cryptographic operations.
Therefore, naive implementations of exiting traditional countermeasures will
not adapt well for optical NoCs. The authors propose a symmetric encryption
based solution for eavesdropping attack. In the first stage of the solution, a
key distribution algorithm is proposed which is executed during the boot time.
The authors assume availability of specific hardware block for key generation.
In co-existence of electrical NoC, the key distribution algorithm will use
secure electrical NoC for key distribution. Otherwise, it will use low
complexity public-key cryptography named BlueJay for key distribution. The
proposed countermeasure uses One-Time Pad which can be executed in one cycle
for encryption at sender and decryption at receiver. The First-In-First-Out
(FIFO) property of optical bus is utilized for pre-computing and storing of
tags for faster execution. To ensure that both sender and receiver use the
same key for One-Time Pad, a minor key concat with main key is used.
Incrementing of the minor key after every message and the FIFO property of the
bus ensures synchronization of the keys used for One-Time Pad. The complete
solution for addressing multiple security requirements incur only 1.6% area
overhead and 14.2% performance overhead while eavesdropping only solution
incurs even less overhead. In a hybrid optical NoC, Zhou et al. (Zhou et al.,
2021) use an encryption scheme to ensure confidentiality of control messages
transfer via electrical NoC. The fabrication of optical NoC introduces Process
Variations. The change of resonant wavelength due to the PV of MR is used as
the key for this symmetric encryption scheme. Furthermore, they use simple and
lightweight XoR operation in the encryption scheme.

Chittamuru et al. (Chittamuru et al., 2018) introduce a process variation
based authentication signature scheme to protect photonic networks against
snooping attacks in both uni-cast and multi-cast scenarios. Specifically, the
packet is encrypted by the process variation profile of detector in
destination gateway. Architecture-level reservation-assisted security
enhancement scheme is proposed and combined with authentication scheme to
further increase the security of optical NoCs. The reservation scheme
introduces a secure reservation wave-guide which prevents malicious Gateway
Interface stealing information about another Gateway Interface. This framework
secures optical NoC against snooping attack with moderate overhead of 14.2% in
average latency and of up to 14.6% in energy delay product. Guo et al. (Guo et
al., 2020) divide cells into trusted and malicious cells for countermeasure
against timing side channel attack. This HT countermeasure limits locally-
generated traffic leaving a cell that tagged as malicious. Furthermore, the
static and dynamic partitioning of cells based on the trust of each cell will
try to isolate sensitive traffic inside secure cells. Both of these approaches
provide protection against timing side channels by avoiding malicious traffic
been collided with sensitive traffic.

####  5.2.2. Integrity

Bashir et al. (Bashir et al., 2020) propose an integrity checking mechanism to
avoid unauthorized packet modification. First, they point out that standard
hash generation and verification is not practical in optical NoCs because it
consumes too many cycles. The authors propose a piggybacking of the hash. When
sender wants to send a message, hash generation of a the message starts in
parallel of actual sending of the message through optical NoC. The message
arrives at the destination without the hash. The hash for the current message
will arrive with the next message. The receiver will process the message until
the hash arrives but commits it only if hash is verified. If verification
fails, the message is discarded and already processed action will not be
committed. The hashing algorithm will use the same key distributed by key
distribution algorithm (BlueJay) which was discussed in Section 5.2.1.

Zhou et al. (Zhou et al., 2021) discuss on adding module to check optical
sampling during thermal sensing. This module is implemented in the network
interface of Electrical NoC because it will not affect the normal optical
network communication. The module is capable of checking and correcting raw
data sent by an optical router before transferring it to the relevant
processing element via electrical NoC. The process can be seen as a
theoretical checking and correction. In addition, they also introduce a
mechanism for run-time detection of the security status of the whole NoC under
the presence of discussed HTs. This scheme uses spiking neural networks for
detection of the security status. This will help operating system to take more
precautions in the presence of an attack. The experimental results show that
the presented mitigation techniques allow secure thermal-sensing in optical
NoC with overhead of 3.06% and 2.6% in average latency and energy consumption,
respectively.

Table 3. Summary of Attacks and countermeasures in optical NoCs categorized by
security concepts.

| Security
---
Concept
Attack | Countermeassure |  | Overhead
---
Area — Power
Confidentiality | Eavesdropping via Malicious Optical Station | One-Time-Pad with changing keys (Bashir et al., 2020) | ¡1.6% — NA
| Eavesdropping of control signal via electrical
---
interconnect in hybrid optical NoC
| Encryption scheme with Process Variation
---
of Optical network as key (Zhou et al., 2021)
¡1% — Low
| Snooping via HT in MR
---
tuning circuit
| Process variation based authentication
---
signature (Chittamuru et al., 2018, 2020)
| 14.6% energy
---
delay product
Timing side channel by resource contention |  | T Restricting local traffic from malicious
---
cell & static and dynamic partitioning (Guo et al., 2020)
NA
Integrity | Unauthorized packet modification | Hashing with piggybacking the tag (Bashir et al., 2020) | ¡1.6% — NA
| Tampering critical control data at Optical
---
Router
| Checking and Correcting raw data and
---
security status detection using ML (Zhou et al., 2021)
2.6% on energy
Availability |  | DoS by blackhole, sinkhole and flooding
---
attacks
HT detection, localization and mitigation (Guo et al., 2020) | NA
Authenticity |  | Spoofing by impersonating sender and
---
receiver via malicious IP
No countermeasure is given in (Bashir et al., 2020) | NA
| Spoofing source identifier data in control
---
messages
Using hash at Electrical NI (Zhou et al., 2021) | NA
Freshness | Replay attack via Malicious Optical Station | Counter-based solution (Bashir et al., 2020) | ¡1.6% — NA

####  5.2.3. Availability

Guo et al. (Guo et al., 2020) discuss countermeasures against DoS attack
inducing HT detection, localization and mitigation. The authors assume that
the optimal location for HT is hotspots in optical NoC. In the first step, a
preliminary HT localization module tags hotspot locations as potential HT
locations. Then, the exact localization algorithm tags HTs by identifying
anomalies that surpass the upper-bound of the maximal packet count curve for
that node. From initially tagged nodes, address of those abnormally delayed
packets are tagged as HTs. Finally, the HT-detection stage has two
countermeasures. The first countermeasure applies randomized permutation to
the data so that it is hard for HT to change the final destination address.
The second countermeasure ensures integrity of data by detecting message
removal from the system. After these three steps, there will be trusted and
untrusted cells. As extra layer of security, the authors propose static and
dynamic partitioning of cells resulting in traffic isolation.

####  5.2.4. Authenticity

Although (Bashir et al., 2020) discusses spoofing attack in optical NoCs, it
does not provide countermeasure to overcome the proposed attack. Zhou et al.
(Zhou et al., 2021) discuss a countermeasure for their proposed spoofing
attack on thermal-sensing process. The module for countermeasure is
implemented on electrical NI. They propose using of hash algorithm to ensure
authenticity. When sending the packet to the collection processing node from
electrical NI, the module will append 128-bit tag. When the collection node
receives the packet, it validates the tag with the same algorithm and proceed
with it’s actions. MD5 (Rivest, 1992) is proposed as the hashing algorithm by
the authors.

####  5.2.5. Freshness

Bashir et al. (Bashir et al., 2020) ensure freshness of the messages through a
counter based solution. This solution will detect if a message is removed from
the system or removed and reinserted back a message after considerable delay.
Therefore, it can detect the proposed replay attack. This solution also
utilizes the FIFO property of the optical waveguide. Every sender will
maintain a major and minor counter. It will send the both counter values to
destination in every n cycles. If the respective counter values in the
destination matches, it will send a known response message. If sender does not
receive a particular response withing a threshold time limit, it will flag for
possible message removal from the system. The authors define these parameters
in the algorithm based on simulation results. This solution has minimal area
and performance overhead according to the experimental results.

Table 3 shows the summary of the surveyed papers attacking confidentiality,
integrity, availability, authenticity and freshness in wireless NoCs and
corresponding countermeasures.The first column shows the main security
concept. The second column outlines the threat model. The second and third
columns provide the countermeasure and associated overhead in terms of area
and power.

##  6\. Conclusion

NoC is the core component responsible for communication in SoCs with large
number of tiles. In this paper, we perform a comprehensive survey about
attacks, threat models and countermeasures of diverse on-chip communication
technologies (electrical, optical, wireless, and hybrid) and architectures.
The primary goal of this survey is to provide the reader with a clear insight
into the technologies and recent developments in NoC communication security.
The survey also consists of an extensive summary on architecture and
technology primitives that are essential for the understanding about security
of NoC. The survey contains state-of-the art security attacks and
countermeasures from both industry and academic perspectives. The discussion
about attacks and countermeasures are divided into six security areas.

We believe there are several NoC security challenges that need to be addressed
in the near future. For example, emerging technologies can introduce
vulnerabilities through inherent side channels. Similarly, it is possible to
attack NoC security using machine learning techniques. While communication
architecture and NoC security have been independently studied, designing them
together would lead to secure and robust on-chip communication architectures.
The future NoCs need to support sophisticated SoCs in diverse application
domains implemented using novel technologies. This will lead to opportunities
for exploring new attacks and developing effective countermeasures.

## References

  * (1)
  * noa ([n. d.]) [n. d.].  Number of IoT devices 2015-2025.  https://www.statista.com/statistics/471264/iot-number-of-connected-devices-worldwide/.  Accessed: 2022-7-6.
  * Ahmed et al. (2020b) MMeraj Ahmed, Abhishek Vashist, Sai Manoj Pudukotai Dinakarrao, and Amlan Ganguly. 2020b.  Architecting a Secure Wireless Interconnect for Multichip Communication: An ML Approach. In _2020 Asian Hardware Oriented Security and Trust Symposium (AsianHOST)_. IEEE, 1–6.
  * Ahmed et al. (2021a) M Meraj Ahmed, Abhijitt Dhavlle, Naseef Mansoor, Sai Manoj Pudukotai Dinakarrao, Kanad Basu, and Amlan Ganguly. 2021a.  What Can a Remote Access Hardware Trojan do to a Network-on-Chip?. In _2021 IEEE International Symposium on Circuits and Systems (ISCAS)_. IEEE, 1–5.
  * Ahmed et al. (2020a) M Meraj Ahmed, Abhijitt Dhavlle, Naseef Mansoor, Purab Sutradhar, Sai Manoj Pudukotai Dinakarrao, Kanad Basu, and Amlan Ganguly. 2020a.  Defense against on-chip trojans enabling traffic analysis attacks. In _2020 Asian Hardware Oriented Security and Trust Symposium (AsianHOST)_. IEEE, 1–6.
  * Ahmed et al. (2021b) M Meraj Ahmed, Amlan Ganguly, Abhishek Vashist, and Sai Manoj Pudukotai Dinakarrao. 2021b.  AWARe-Wi: A jamming-aware reconfigurable wireless interconnection using adversarial learning for multichip systems.  _Sustainable Computing: Informatics and Systems_ 29 (2021), 100470\.
  * Ampere (2022) Ampere. 2022.  Ampere Altra Max 64-Bit Multi-Core Processor.  https://amperecomputing.com/processors/ampere-altra/.  [Online].
  * Ancajas et al. (2014) Dean Michael Ancajas, Koushik Chakraborty, and Sanghamitra Roy. 2014.  Fort-NoCs: Mitigating the threat of a compromised NoC. In _Proceedings of the 51st Annual Design Automation Conference_. 1–6.
  * Anders (2014) Mark A Anders. 2014\.  High-performance energy-efficient noc fabrics: Evolution and future challenges. In _2014 Eighth IEEE/ACM International Symposium on Networks-on-Chip (NoCS)_. IEEE, i–i.
  * ARM (1999) ARM. 1999.  ‘Amba specification’, Technical report, ARM, Revision 2.0.  developer.arm.com/products/architecture/amba-protocol.  [Online].
  * Arteris (2009) Arteris. 2009.  FlexNoC Resilience Package.  www.arteris.com/flexnoc-resilience-package-functional-safety.  [Online].
  * Aumasson and Bernstein (2012) Jean-Philippe Aumasson and Daniel J Bernstein. 2012.  SipHash: a fast short-input PRF. In _International Conference on Cryptology in India_. Springer, 489–508.
  * Bahn et al. (2007) Jun Ho Bahn, Seung Eun Lee, and Nader Bagherzadeh. 2007\.  On design and analysis of a feasible network-on-chip (noc) architecture. In _Fourth International Conference on Information Technology (ITNG’07)_. IEEE, 1033–1038.
  * Barrios et al. (2003) Carlos Angulo Barrios, Vilson R de Almeida, and Michal Lipson. 2003.  Low-power-consumption short-length and high-modulation-depth silicon electrooptic modulator.  _Journal of Lightwave Technology_ 21, 4 (2003), 1089\.
  * Bashir et al. (2020) Janibul Bashir, Chandran Goodchild, and Smruti Ranjan Sarangi. 2020\.  SecONet: A Security Framework for a Photonic Network-on-Chip. In _2020 14th IEEE/ACM International Symposium on Networks-on-Chip (NOCS)_. IEEE, 1–8.
  * Bashir et al. (2019) Janibul Bashir, Eldhose Peter, and Smruti R Sarangi. 2019\.  A survey of on-chip optical interconnects.  _ACM Computing Surveys (CSUR)_ 51, 6 (2019), 1–34.
  * Bjerregaard and Mahadevan (2006) Tobias Bjerregaard and Shankar Mahadevan. 2006.  A survey of research and practices of network-on-chip.  _ACM Computing Surveys (CSUR)_ 38, 1 (2006), 1–es.
  * Bogaerts et al. (2012) Wim Bogaerts, Peter De Heyn, Thomas Van Vaerenbergh, Katrien De Vos, Shankar Kumar Selvaraja, Tom Claes, Pieter Dumon, Peter Bienstman, Dries Van Thourhout, and Roel Baets. 2012\.  Silicon microring resonators.  _Laser & Photonics Reviews_ 6, 1 (2012), 47–73.
  * Bogdanov et al. (2012) Andrey Bogdanov, Miroslav Knezevic, Gregor Leander, Deniz Toz, Kerem Varici, and Ingrid Verbauwhede. 2012\.  SPONGENT: the design space of lightweight cryptographic hashing.  _IEEE Trans. Comput._ 62, 10 (2012), 2041–2053.
  * Boraten and Kodi (2018a) Travis Boraten and Avinash Kodi. 2018a.  Mitigation of Hardware Trojan based Denial-of-Service attack for secure NoCs.  _J. Parallel and Distrib. Comput._ 111 (2018), 24–38.
  * Boraten and Kodi (2016) Travis Boraten and Avinash Karanth Kodi. 2016.  Packet security with path sensitization for nocs. In _2016 Design, Automation & Test in Europe Conference & Exhibition (DATE)_. IEEE, 1136–1139.
  * Boraten and Kodi (2018b) Travis H Boraten and Avinash K Kodi. 2018b.  Securing NoCs against timing attacks with non-interference based adaptive routing. In _2018 Twelfth IEEE/ACM International Symposium on Networks-on-Chip (NOCS)_. IEEE, 1–8.
  * Charles et al. (2021) Subodha Charles et al. 2021\.  A survey of network-on-chip security attacks and countermeasures.  _ACM Computing Surveys (CSUR)_ 54, 5 (2021), 1–36.
  * Charles et al. (2022) Subodha Charles, Vincent Bindschaedler, and Prabhat Mishra. 2022\.  Digital Watermarking for Detecting Malicious Intellectual Property Cores in NoC Architectures.  _IEEE Transactions on Very Large Scale Integration (VLSI) Systems_ (2022).
  * Charles et al. (2020a) Subodha Charles, Megan Logan, and Prabhat Mishra. 2020a.  Lightweight anonymous routing in NoC based SoCs. In _2020 Design, Automation & Test in Europe Conference & Exhibition (DATE)_. IEEE, 334–337.
  * Charles et al. (2019) Subodha Charles, Yangdi Lyu, and Prabhat Mishra. 2019\.  Real-time detection and localization of DoS attacks in NoC based SoCs. In _2019 Design, Automation & Test in Europe Conference & Exhibition (DATE)_. IEEE, 1160–1165.
  * Charles et al. (2020b) Subodha Charles, Yangdi Lyu, and Prabhat Mishra. 2020b.  Real-time detection and localization of distributed DoS attacks in NoC-based SoCs.  _IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems_ 39, 12 (2020), 4510–4523.
  * Charles and Mishra (2020) Subodha Charles and Prabhat Mishra. 2020.  Securing network-on-chip using incremental cryptography. In _2020 IEEE Computer Society Annual Symposium on VLSI (ISVLSI)_. IEEE, 168–175.
  * Chen et al. (2019) Kun-Chih Chen, Masoumeh Ebrahimi, Ting-Yi Wang, and Yuch-Chi Yang. 2019.  NoC-based DNN accelerator: A future design paradigm. In _Proceedings of the 13th IEEE/ACM International Symposium on Networks-on-Chip_. 1–8.
  * Chittamuru et al. (2018) Sai Vineel Reddy Chittamuru, Ishan G Thakkar, Varun Bhat, and Sudeep Pasricha. 2018.  SOTERIA: exploiting process variations to enhance hardware security with photonic NoC architectures. In _Proceedings of the 55th Annual Design Automation Conference_. 1–6.
  * Chittamuru et al. (2020) Sai Vineel Reddy Chittamuru, Ishan G Thakkar, Sudeep Pasricha, Sairam Sri Vatsavai, and Varun Bhat. 2020\.  Exploiting process variations to secure photonic NoC architectures from snooping attacks.  _IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems_ 40, 5 (2020), 850–863.
  * Crowley (2006) Paul Crowley. 2006\.  Improved cryptanalysis of Py.  _Cryptology ePrint Archive_ (2006).
  * Daemen and Rijmen (1999) Joan Daemen and Vincent Rijmen. 1999.  AES proposal: Rijndael.  (1999).
  * Dally and Towles (2001) W.J. Dally and B. Towles. 2001.  Route packets, not wires: on-chip interconnection networks. In _Proceedings of the 38th Design Automation Conference (IEEE Cat. No.01CH37232)_. 684–689.  https://doi.org/10.1109/DAC.2001.156225
  * Daoud and Rafla (2018) Luka Daoud and Nader Rafla. 2018.  Routing aware and runtime detection for infected network-on-chip routers. In _2018 IEEE 61st International Midwest Symposium on Circuits and Systems (MWSCAS)_. IEEE, 775–778.
  * Engels et al. (2011) Daniel Engels, Markku-Juhani O Saarinen, Peter Schweitzer, and Eric M Smith. 2011\.  The Hummingbird-2 lightweight authenticated encryption algorithm. In _International workshop on radio frequency identification: Security and privacy issues_. Springer, 19–31.
  * Fang et al. (2013) Dabin Fang, Huikai Li, Jun Han, and Xiaoyang Zeng. 2013\.  Robustness analysis of mesh-based network-on-chip architecture under flooding-based denial of service attacks. In _2013 IEEE Eighth International Conference on Networking, Architecture and Storage_. IEEE, 178–186.
  * Fiorin et al. (2008) Leandro Fiorin, Gianluca Palermo, and Cristina Silvano. 2008\.  A security monitoring service for NoCs. In _Proceedings of the 6th IEEE/ACM/IFIP international conference on Hardware/Software codesign and system synthesis_. 197–202.
  * Ganguly et al. (2012) Amlan Ganguly, Mohsin Yusuf Ahmed, and Anuroop Vidapalapati. 2012.  A denial-of-service resilient wireless NoC architecture. In _Proceedings of the great lakes symposium on VLSI_. 259–262.
  * Ganguly et al. (2010) Amlan Ganguly, Kevin Chang, Sujay Deb, Partha Pratim Pande, Benjamin Belzer, and Christof Teuscher. 2010.  Scalable hybrid wireless network-on-chip architectures for multicore systems.  _IEEE Trans. Comput._ 60, 10 (2010), 1485–1502.
  * Ganguly et al. (2011) Amlan Ganguly, Paul Wettin, Kevin Chang, and Partha Pande. 2011.  Complex network inspired fault-tolerant NoC architectures with wireless links. In _Proceedings of the fifth ACM/IEEE International Symposium on Networks-on-Chip_. 169–176.
  * Guo et al. (2020) Pengxing Guo, Weigang Hou, Lei Guo, Zizheng Cao, and Zhaolong Ning. 2020.  Potential threats and possible countermeasures for photonic network-on-chip.  _IEEE Communications Magazine_ 58, 9 (2020), 48–53.
  * Hamedani et al. (2014) Parisa Khadem Hamedani, Natalie Enright Jerger, and Shaahin Hessabi. 2014.  Qut: A low-power optical network-on-chip. In _2014 Eighth IEEE/ACM International Symposium on Networks-on-Chip (NoCS)_. IEEE, 80–87.
  * Henning (2000) John L Henning. 2000\.  SPEC CPU2000: Measuring CPU performance in the new millennium.  _Computer_ 33, 7 (2000), 28–35.