Rodrigo Alán

Senior Member, IEEE Hassan Aboushady Díaz-Rizo

Member, IEEE Haralampos-G Stratigopoulos
email: haralampos.stratigopoulos@lip6.fr

Alán Rodrigo

Díaz Rizo

Hassan Aboushady
email: hassan.aboushady@lip6.fr

Anti-Piracy Design of RF Transceivers

Keywords: Hardware security and trust, RF transceivers, wireless ICs, IC piracy, locking

We present a locking-based design-for-security methodology to prevent piracy of RF transceiver integrated circuits. The solution is called SyncLock as it locks the synchronization of the transmitter with the receiver. If a key other than the secret key is applied, synchronization and, thereby, communication fail. SyncLock is implemented using a novel locking concept consisting of two spatially separated mechanisms. A hard-coded error is hidden into the design to break synchronization while error correction, i.e., unlocking, takes place in another part of the design by applying the secret key. SyncLock offers several advantages: the secret key is unique, i.e., any incorrect key causes a denial-of-service, there is no performance penalty, it can be seemingly integrated into the digital design flow, area and power overheads are negligible, and it achieves maximum provable security thwarting all known counter-attacks. SyncLock is demonstrated with hardware measurements.

I. INTRODUCTION

In the early days of the semiconductor industry, a single company possessed all the design know-how, tooling, fabrication facilities, and test equipment required to build endto-end an Integrated Circuit (IC). Today, few such vertically integrated companies combining all the diverse competencies exist. We observe increasing globalization of design and manufacturing tasks and outsourcing to third parties. For instance, many companies are founded or have transitioned to be "fabless": they outsource the manufacturing step of their IC design to offshore foundries, many of which are located in separate continents. In this way, they do not need to bear the enormous costs of building, maintaining, and upgrading a manufacturing facility, which rise dramatically with each new technology node visited. Another trend is the rise of complex Systems-on-Chip (SoCs) where numerous general and specialized functions are integrated onto the same chip. Many companies do not have the know-how to design endto-end a SoC, thus relying on third-party Intellectual Property (IP) blocks for building some of the functions.

A major security threat resulting from this globalized supply chain is piracy of IP blocks in ICs and SoCs or of the entire IC or SoC [START_REF] Guin | Counterfeit integrated circuits: A rising threat in the global semiconductor supply chain[END_REF]. Piracy refers to cloning, overbuilding, remarking, and recycling of chips. More specifically, cloning consists of illegally copying a design and reusing it without the consent or knowledge of the design owner. It can be conducted by rogue agents in IC/SoC integration houses and foundries. It can also be conducted by an end-user through reverse-engineering of a legally purchased chip. In fact, nowadays there are increased capabilities for performing reverse-engineering of chips to extract the design netlist and other technology secrets [START_REF] Holler | High-resolution non-destructive three-dimensional imaging of integrated circuits[END_REF]. Overbuilding can be performed by a foundry that holds the blueprint of the design and refers to producing and selling chips beyond the number agreed on in the contract with the chip design owner. Remarking can be performed by a test facility and refers to relabelling failing chips as functional. Recycling refers to scrapping a likely aged chip from a used board and re-entering it into the market as a "fresh" chip. Unauthorized chip use is often considered another form of piracy.

Piracy leads to counterfeit chips that are a serious threat to design houses (e.g., loss of know-how, sales, and brand name), governments (e.g., national security threat if counterfeit chips are used in critical infrastructure or defense), and the society as a whole (e.g., counterfeits are likely to be of lower quality and have shorter lifespan).

To defend against IP/IC piracy, IP/IC locking is considered as the strongest counter-measure [START_REF] Chakraborty | Keynote: A disquisition on logic locking[END_REF]. Illustrated in Fig. 1, it is performed by the designer and consists in embedding a lock mechanism inside the IP/IC. The lock mechanism is a circuit that is mingled with the original circuit and is controlled by a key, which is typically in the form of a digital bit-string. The lock mechanism is transparent to the IP/IC such that upon application of the correct key the nominal functionality is restored. However, applying an incorrect key corrupts the functionality. The correct key is a designer's secret and is not shared with any potentially untrusted party, i.e., SoC integration house, foundry, or end-user. The chip is securely activated after fabrication by storing the secret key in a Tamper-Proof Memory (TPM) such that it is erased on detecting a probing attempt. In this case, the secret key is common to all chips, thus if it is leaked any chip instance can be unlocked. Alternatively, a key provisioning on-die unit can be used to ensure that each chip is unlocked only by a user key, which is unique to that chip [START_REF] Sanabria-Borbón | Schmitt trigger-based key provisioning for locking analog/RF integrated circuits[END_REF]. A standard scheme [START_REF] Wang | Thwarting analog IC piracy via combinational locking[END_REF] uses a Physical Unclonable Function (PUF) [START_REF] Herder | Physical unclonable functions and applications: A tutorial[END_REF] to generate on-die a chip identification key, then a chip-unique user key is generated by XORing the identification key with the common key. The common key is generated internally by XORing the user and identification keys. Read access to the PUF output is disabled after recording to prevent probing attacks by endusers. Another key management scheme uses a PUF and RSA encryption to securely activate the chip remotely [START_REF] Roy | Ending piracy of integrated circuits[END_REF]. IP/IC locking protects an IP/IC against potential attackers located anywhere in the supply chain, as well as against malicious end-users. It can protect also against recycling facilities as long as the key is reloaded every time the IC is powered on.

In this paper, we propose a locking technique for RF transceivers. Even the most modern RF transceiver designs (for example see [START_REF] Park | 4.1 A 39GHz-band CMOS 16-channel phased-array transceiver IC with a companion dual-stream IF transceiver IC for 5G NR base-station applications[END_REF]- [START_REF] Bechthum | [END_REF]) are not made with anti-piracy security in mind. To this end, we propose a security plug-in that can transform any design to a key-controlled version. In this way, the intellectual property of the design can be protected against piracy attempts at any point across the supply chain and its authenticity can be traced along its entire life-cycle.

For an RF transceiver, being a mixed-signal design, one can leverage existing techniques for locking part of its digital section, for locking blocks in its analog section, or for locking it at system-level, i.e., by exploiting its programmability features. These generic techniques, however, have shown to be vulnerable to attacks, as it will be described in more detail in Section II. Herein, we propose a domain-specific locking technique for RF transceivers that takes advantage of a specific part of the signal processing chain found in any RF transceiver.

More specifically, the proposed RF transceiver locking technique, called SyncLock, acts on the synchronization of the transmitter with the receiver. Upon application of an incorrect key, SyncLock disables the synchronization, thus the wireless communication link crashes. The synchronization is commonly set via a preamble that is appended to the beginning of data frames. SyncLock is based on two spatially separated hardware-level mechanisms. The first mechanism hides a hard-coded error into the design of the data frame generator corrupting the preamble of the data frame. The second mechanism is located upstream in the signal processing chain into the preamble generator and its goal is to corrupt the preamble so as to cancel out the downstream corruption. The corruption applied by the second mechanism is key-controlled, with a single correct key being capable of counterbalancing the two spatially separated preamble corruptions.

SyncLock is generally applicable to any RF transceiver architecture, any wireless communication protocol using correlation-based synchronization algorithms, and any modulation scheme. As the lock mechanism is embedded into the baseband Digital Signal Processor (DSP), SyncLock can be effortlessly integrated into the digital design flow. On the other hand, the sensitive Analog Front-End (AFE) is left intact which is an essential characteristic of SyncLock allowing for its wide adoption by analog IC designers. SyncLock elegantly achieves all locking objectives: (a) locking is totally transparent to the RF transceiver operation when the correct secret key is applied; (b) applying invalid keys breaks the operation; (c) area and power overheads are minimal; (d) all known counterattacks in both the analog and digital domains are thwarted. We demonstrate SyncLock in hardware using the Software Defined Radio (SDR) bladeRF board from Nuand TM [START_REF] Nuand | SDR bladeRF 2.0 micro xA9[END_REF].

SyncLock was originally proposed in [START_REF] Díaz Rizo | SyncLock: RF transceiver security using synchronization locking[END_REF]. This paper describes a new design and implementation of SyncLock that offers higher security compared to its preliminary version in [START_REF] Díaz Rizo | SyncLock: RF transceiver security using synchronization locking[END_REF]. In addition, the paper provides an in-depth analysis of the inner workings of SyncLock.

The rest of the article is structured as follows. In Section II, we discuss the prior art on locking and anti-piracy design of analog and mixed-signal ICs. In Section III, we present the new implementation and design of SyncLock. Section III concludes by presenting the first SyncLock implementation in [START_REF] Díaz Rizo | SyncLock: RF transceiver security using synchronization locking[END_REF] as a sub-case and comparing the two. In Section IV, we present the hardware platform used for demonstrating the locking efficiency of SyncLock in Section V. Section VI discusses related locking and obfuscation approaches, including approaches based on the corrupt-and-correct principle utilized by SyncLock, and explains their differences as compared to SyncLock. Section VI also discusses existing counter-attacks for locking approaches based on the corrupt-and-correct principle. Section VII provides the threat model and analyzes the resilience of SyncLock to all known counter-attacks. Section VIII concludes this article.

II. PRIOR ART ON LOCKING AND ANTI-PIRACY DESIGN

The first locking technique was proposed originally for digital circuits [START_REF] Roy | Ending piracy of integrated circuits[END_REF], a.k.a. logic locking or logic encryption. Since then, several logic locking techniques were proposed aiming at reducing Power, Performance, and Area (PPA) penalties, increasing corruption for invalid keys, and circumventing counter-attacks that were developed in the meantime aiming at exposing security vulnerabilities of logic locking, i.e., finding the secret key with reasonable effort or identifying and subsequently removing the lock. For a recent review of logic locking techniques and counter-attacks the reader is referred to [START_REF] Chakraborty | Keynote: A disquisition on logic locking[END_REF]. Leveraging logic locking to lock a mixedsignal design via locking its digital section was proposed in [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF]- [START_REF] Leonhard | Digitally-assisted mixed-signal circuit security[END_REF]. In [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF], locking targeted the digital processor in the feedback calibration loop, while in [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF], [START_REF] Leonhard | Digitally-assisted mixed-signal circuit security[END_REF] locking targeted digital blocks within the signal processing chain. This latter locking approach, called MixLock, was demonstrated recently for RF transceivers [START_REF] Díaz Rizo | RF transceiver security against piracy attacks[END_REF]. A state-of-the-art logic locking technique called Stripped Functionality Logic Locking (SFLL)-rem [START_REF] Sengupta | Truly stripping functionality for logic locking: A fault-based perspective[END_REF] was employed in [START_REF] Díaz Rizo | RF transceiver security against piracy attacks[END_REF]. However, recently a counter-attack based on structural analysis of the netlist was shown to break SFLL-rem within seconds [START_REF] Han | Does logic locking work with EDA tools?[END_REF]. Essentially, there is an ongoing "cat-and-mouse" game between logic locking defenses and counter-attacks. Every newly introduced logic locking technique is considered secure until shortly after a counter-attack heuristic is demonstrated that breaks it.

For locking analog blocks the existing technique is biasing locking which aims at controlling the bias generation with the key. Unless the correct key is provided the analog block is incorrectly biased meaning that the quiescent point of transistors is not the desired one resulting in performance degradation or malfunction. For RF transceivers, one can perform biasing locking in blocks of the AFE, i.e., Low Noise Amplifier (LNA), Power Amplifier (PA), Phase-Locked Loop (PLL), data converters, etc. Several embodiments of biasing locking exist, including obfuscating the geometry of a bias transistor [START_REF] Rao | Performance and security analysis of parameterobfuscated analog circuits[END_REF], designing key-controlled current mirrors [START_REF] Wang | Thwarting analog IC piracy via combinational locking[END_REF], and replacing the biasing circuit with an alternative keycontrolled bias generator, e.g., based on an on-chip neural network [START_REF] Volanis | Analog performance locking through neural network-based biasing[END_REF] or a programmable memristor crossbar [START_REF] Hoe | Towards secure analog designs: A secure sense amplifier using memristors[END_REF]. Biasing locking may result in imprecise or unstable biasing and, besides, recently counter-attacks were proposed based on Satisfiability Modulo Theory (SMT) [START_REF] Jayasankaran | Breaking analog locking techniques[END_REF] and optimization [START_REF] Acharya | Attack of the genes: Finding keys and parameters of locked analog ICs using genetic algorithm[END_REF], [START_REF] Leonhard | Breaking analog biasing locking techniques via re-synthesis[END_REF] that break this type of defense.

System-level locking can be achieved via calibration locking which makes the compensation of process variations or adaptation to different operation modes key-dependent. Techniques in this category include logic locking of the digital section of the calibration loop [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF], treating digital programmability as a natural secret key [START_REF] Elshamy | Securing programmable analog ICs against piracy[END_REF]- [START_REF] Tlili | Anti-piracy of analog and mixed-signal circuits in FD-SOI[END_REF], and making the calibration range key-dependent [START_REF] Rao Nimmalapudi | Range-controlled floating-gate transistors: A unified solution for unlocking and calibrating analog ICs[END_REF]. To be secure calibration locking requires that the calibration algorithm is complex enough to be devised or re-designed in hardware by the attacker, an assumption that is not always met.

Besides locking, other anti-piracy methods include split manufacturing [START_REF] Perez | A survey on split manufacturing: Attacks, defenses, and challenges[END_REF] that protects only against an untrusted foundry and camouflaging [START_REF] Vijayakumar | Physical design obfuscation of hardware: A comprehensive investigation of device and logic-level techniques[END_REF] that protects only against reverse-engineering. Split manufacturing has been demonstrated for RF designs [START_REF] Bi | Beyond the interconnections: split manufacturing in RF designs[END_REF] and camouflaging ideas for analog and mixed-signal ICs include multi-threshold transistor design [START_REF] Ash-Saki | How multi-threshold designs can protect analog IPs[END_REF] and obfuscating the geometry of layout components [START_REF] Leonhard | Analog and mixed-signal IC security via sizing camouflaging[END_REF]. Unlike split manufacturing and camouflaging, locking offers an end-to-end protection against all potential piracy threat scenarios.

III. SyncLock A. Principle of operation

SyncLock is a security mechanism for preventing piracy of RF transceivers. It can be viewed as a domain-specific logic locking capitalizing on a specific digital signal processing path in RF transceivers. The underlying idea is to lock the preamble that allows the synchronization process between the transmitter and the receiver. By blocking the synchronization, wireless receivers are unable to find the start of the received frame, thus the wireless communication fails.

A simplified architecture of a wireless IC with SyncLock embedded is shown in Fig. 2. SyncLock acts on two different parts of the design. First, it modifies the frame generation block at the end of the baseband DSP chain of the transmitter by corrupting the preamble of each transmitted frame. The introduced error is hard-coded such that after logic synthesis of the DSP it is impossible to be traced and recovered by structural analysis of the netlist. Then, it modifies the preamble generation block at the beginning of the baseband DSP chain such that the output preamble is key-controlled. To enable the synchronization process, the key must neutralize the unknown to the attacker later corruption in the frame generation block.

B. Preamble generation

In all wireless communication protocols, the payload is transmitted along with the physical layer (PHY) specifications. The baseband DSP prepares the payload in a frame format for transmission. The PHY Protocol Data Unit (PPDU) frame format of an Orthogonal Frequency-Division Multiplexing (OFDM) IEEE 802.11 transmission consists of several OFDM symbols. These symbols are divided into three parts: preamble (a.k.a SYNC), header (a.k.a SIGNAL), and payload (a.k.a DATA). The preamble section is composed of two different training symbol sequences, namely a Short Training Sequence (STS) and a Long Training Sequence (LTS). Fig. 3 shows the PPDU of an IEEE 802.11 transmission with the above three parts as defined in the IEEE 802.11 standard [START_REF] Ieee | IEEE standard for information technology-telecommunications and information exchange between systems local and metropolitan area networks-specific requirements -part 11: Wireless LAN medium access control (MAC) and physical layer (PHY) specifications[END_REF]. The STS field consists of 10 identical short symbol repetitions and is used for timing acquisition based on the Schmidl and Cox algorithm [START_REF] Schmidl | Robust frequency and timing synchronization for OFDM[END_REF], i.e., for synchronization or start of frame detection and for coarse frequency offset estimation. The LTS field consists of 2 long symbol repetitions and is used for channel estimation and fine frequency offset estimation [START_REF] Ieee | IEEE standard for information technology-telecommunications and information exchange between systems local and metropolitan area networks-specific requirements -part 11: Wireless LAN medium access control (MAC) and physical layer (PHY) specifications[END_REF]. More specifically, as defined in the IEEE 802.11 standard [START_REF] Ieee | IEEE standard for information technology-telecommunications and information exchange between systems local and metropolitan area networks-specific requirements -part 11: Wireless LAN medium access control (MAC) and physical layer (PHY) specifications[END_REF], the nominal STS is divided into two parts, denoted here by ST S nom I and ST S nom Q, corresponding to the real I and imaginary Q channels, respectively. ST S nom I, Q is composed of 10 repetitions of the 16 samples of 16 bits each shown in Table I in floating-point and fixed-point representations. Thus, ST S nom I, Q is composed of 10 * 16 * 16 = 2560 bits in total.

Each sample of ST S nom I, Q is generated in the baseband DSP by the preamble generation block shown in Fig. 4. There are in total 13 multiplexers (MUXes) per I/Q branch where the i-th MUX receives a constant 16-bit input DATA i with values shown in Table II. The SEL input of the MUXes is a 4-bit word and selects the creation of one of the 16 samples of the sequence. The position of the selected bit of DATA i that is transferred at the output of each MUX equals the decimal representation of the SEL input. The 16-bit fixed-point I and Q values of the sample are then created by concatenating the outputs of the MUXes according to the schemes shown in the second and fifth rows of Table III for the I and Q branches, respectively. The same hardware and concatenation operations are used to generate any sample k by setting the input SEL equal to k in decimal.

For example, let us consider the first sample, i.e., k = 0, in the I branch which has a fixed-point value of 16'h02F2 in hexadecimal representation. In this case, SEL = 4'b0000 selecting the first bit position of the DATA i inputs of the MUXes, as shown in blue in the I branch part of Table II. The concatenation of the MUXes output is shown in blue in the third row of Table III resulting in the desired value of 16'h02F2. As a second example, let us consider the fourth sample, i.e., k = 3, in the Q branch with a fixed-point value of 16'hFF31 in hexadecimal representation. SEL = 4'b0011 selecting the fourth bit position of the DATA i inputs of the MUXes, as shown in red in the Q branch part of Table II. The concatenation of the MUXes output is shown in red in the sixth row of Table III resulting in the desired value of 16'hFF31.

C. Locking mechanism

SyncLock acts specifically on the generation of the STS. The locking mechanism of SyncLock is divided into two parts embedded into the preamble and frame generation blocks, as shown in Fig. 5. In the frame generation block, the STS originally generated by the preamble generation block is embedded into the frame for transmission, with the final STS denoted by ST S out . The design owner deliberately corrupts the incoming STS to the frame generation block prior to frame creation by XORing it with the output of a nonlinear module f (•). This module implements a feedback loop involving ST S out and a hard-coded key, denoted by key h-c . In the preamble generation block, an XOR operation is performed between the key-bits stored in the TPM and ST S nom , thus corrupting

ST S out = ST S f aulty ⊕ f (ST S out , key h-c ) (2)
Combining Eqs. ( 1)-( 2) and using the associative property

(A ⊕ B) ⊕ C = A ⊕ (B ⊕ C) of the XOR function, the system equation becomes ST S out = ST S nom ⊕ (key ⊕ f (ST S out , key h-c )) (3)
Thus, using the self-inverse property

A ⊕ A = 0 of the XOR function, ST S out = ST S nom if and only if key = f (ST S nom , key h-c ) ST S out = ST S nom ⇐⇒ key = f (ST S nom , key h-c ) (4)
The SyncLock mechanism can be viewed as two spatially separated XOR-based stream ciphers controlled by two secret keys, one stored in the TPM and the other one being hardcoded. The generated ST S nom by the original preamble generation block, i.e., the plaintext, is encrypted by the key to ST S f aulty , i.e., the ciphertext, so as to "match" the hidden hard-coded decryption that comes downstream in the DSP chain at the frame generation block. The secret correct key must be loaded in the TPM of the chip for correct deciphering. Applying incorrect keys introduces two uncorrelated STS corruptions at two distinct blocks of the DSP chain which breaks the synchronization.

As mentioned in Section III-B, for each channel I or Q, at any point in the signal processing chain, STS is composed of 2560 bits and is processed in 160 blocks with each block corresponding to one sample of 16 bits shown in Table I. Each key is composed of 512 bits divided into two parts of 256 bits for each channel. Thus, for each channel, a key is divided into 16 blocks of 16 bits each. This means that for each channel the key is repeatedly applied 10 times for every 16 blocks of STS.

The implementation specifics showing how ST S out converges in Eq. (2) will be described in detail in Section III-E.

D. Choice of function f (•)

As will be explained in detail in Section VII-B5, the function f (•) is introduced to circumvent the Known-Plaintext Attack (KPA), which is a vulnerability of the preliminary version of SyncLock in [START_REF] Díaz Rizo | SyncLock: RF transceiver security using synchronization locking[END_REF]. The choice of f (•) is free, leaving in theory unlimited freedom to the defender. It can also change from one design to another or across design iterations to update the key for increased security.

In our current implementation, f (•) is a two-step function. It first performs 16-bit parallel XORing of ST S out with the hardcoded key key h-c , then it applies to the result a circular shift operation, a.k.a. bitwise rotation, i.e., f (ST S out , key h-c ) = (ST S out ⊕ key h-c ) >> b, where >> is the bitwise rotation operation and b is the number of bit rotations to the right. Other possibilities include bitwise logical operations between ST S out and key h-c , bit scrambling or substitution after the XORing between ST S out and key h-c , etc.

The function f (•) can be executed in a single clock cycle using any of the above bitwise operations with depth equal to one. For example, in our current implementation, the XOR operation ST S out ⊕ key h-c needs one clock cycle, while the rotation can be simply implemented by rotating the wiring of the 16-bit output of ST S out ⊕ key h-c when it is fed into the XOR function with ST S f aulty . To accommodate this one clock cycle delay and guarantee convergence, as we will see in Section III-E that presents the implementation specifics, we let the first 16-bit block of STS pass without being processed by the XOR stream ciphers, whereas the XOR steam ciphers come into play starting from the second 16-bit block of STS. Essentially, from this point onward, the k-th block of ST S f aulty is XORed with the output of f (•), which has been computed with the (k -1)-th blocks of ST S out and key h-c , to produce the k-th block of ST S out .

In general, if f (•) had a larger depth needing n clock cycles to be executed, then the XOR stream ciphers would come into play starting from the n-th 16-bit block of STS.

E. Implementation specifics

ST S nom I[j] = s I [mod(j, 16)] (5)
The key and hard-coded key are composed of 512-bits each and are reused in every repetition of the 16 samples. Each key can be divided into two equal 256-bit parts, with the first part corresponding to the I channel and the second part to the Q channel. For the I channel, the key and hardcoded key are denoted by keyI and key h-c I, respectively. Similar to STS values, each key is divided into 16-bit words corresponding to samples s I [k]. For example, keyI results from the concatenation keyI = keyI[0]...keyI [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF], where keyI[n] is the part of keyI in bit positions from n * 16 to n * 16 + 15, n = 0, • • • , 15.

Using the above definitions, we can now formally explain the SyncLock implementation. Since the nonlinear module evaluates ST S out in a feedback loop, the system essentially incorporates an internal memory and a valid ST S out would become available starting from the second sample of the first repetition. To remove this delay, for the first sample of the first repetition both XOR-based error units in the preamble and frame generation blocks are bypassed, i.e., ST S f aulty I[0] = ST S nom [0] and ST S out I[0] = ST S f aulty I[0], that is, we force the initial condition

ST S out I[0] = ST S nom I[0] (6)
From the second sample of the first repetition onward, the key and the two XOR-based error units start intervening in the computation. Specifically, using the above definitions, for j ≥ 1 we have

ST S f aulty I[j] = ST S nom I[j] ⊕ keyI[mod(j, 16)], j = 1, • • • , 159 (7) ST S out I[j] = ST S f aulty I[j]⊕ f (ST S out I[j -1], key h-c I[mod(j, 16)]), j = 1, • • • , 159. (8)
Substituting Eq. ( 7) into Eq. ( 8) we have

ST S out I[j] = ST S nom I[j] ⊕ (keyI[mod(j, 16)]⊕ f (ST S out I[j -1], key h-c I[mod(j, 16)])), j = 1, • • • , 159. (9)
The hard-coded key is set arbitrarily by the designer. The key is then selected such that ST S out I = ST S nom I which from Eq. ( 9) is satisfied by the identity

keyI[mod(j, 16)]) = f (ST S nom I[j -1], key h-c I[mod(j, 16)]) j = 1, • • • , 159. (10)
This results in

keyI[0] = f (ST S nom I[15], key h-c I[0]) (11) keyI[n] = f (ST S nom I[n -1], key h-c I[n]), ( 12
) n = 1, • • • , 15.
An excerpt of the computations for the first 19 real samples j = 0, • • • , 18 of ST S nom I, i.e., comprising a complete first iteration and 3 samples in the second iteration, is shown in Table IV for three different key cases, namely (a) incorrect zero key; (b) random incorrect key; and (c) correct key. Bitwise rotation with b = 1 is used as the nonlinear function. The key is repeated every 16 samples, but the XOR operations are bypassed for the first sample of the first iteration so as to force the initial condition for the feedback loop. The locking mechanism becomes active starting from the second sample of the first iteration and stays active until the end of the ST S nom transmission to the frame generation block. As it can be seen, ST S out is generated without errors only for the correct key.

F. Key size

The above SyncLock implementation has the advantageous property that there is a single correct key enabling synchronization, while any other key results in no synchronization, i.e., there are no approximate keys. This property stems from the nonlinear module inside the frame generation block. More specifically, considering for example a bit rotation function, for a single bit flip of the secret key, there is a large and arbitrary number of bit flips in ST S out . Thus, even for an incorrect key with Hamming Distance (HD) of 1 from the correct key, ST S out contains a high number of errors. As a result, this SyncLock implementation has a full effective 512-bit key size.

So far, we have assumed full key sizes of 512 bits. However, this is a rather unnecessarily large key size from a security point view. Typically, a key size of 64 bits suffices to guarantee high resilience against brute-force and optimization attacks. Therefore, we can consider keys of smaller size that can be composed using any key-bits of the original 512-bit keys since all key-bits are effective. Reducing the keys' size has the advantage of reducing the die area of the TPM, or in general the die area of the implemented on-die key provisioning scheme, as well as the die area of the lock mechanism itself. G. Overheads 1) Area Overhead: The hardware added by the SyncLock are two XOR-based modules in the preamble and frame generation blocks and one nonlinear module involving another XOR operation and a bitwise rotation in the frame generation block. To compute the area overhead of SyncLock we used as baseline non-locked implementation an open-source IEEE 802.11 compatible SDR VHDL modem [START_REF] Nuand | Open-source IEEE[END_REF]. The project is called bladeRF-wiphy as it implements the IEEE 802.11 PHY on the Cyclone V Field-Programmable Gate Array (FPGA) integrated on the bladeRF board [START_REF] Nuand | SDR bladeRF 2.0 micro xA9[END_REF]. More details about the bladeRF board will be given in Section IV. Starting from the non-locked implementation, we added the SyncLock locking mechanism into the PHY of the modem and we re-synthesized the project using Quartus II 16.0 from Intel to find the resultant overhead. Considering a full key size of 512 bits, SyncLock results in 1.22% area overhead for the baseband DSP section, which when projected to the entire RF transceiver is even smaller as the area is dominated by the AFE.

The overhead for the key management scheme, i.e., based on a TPM, is common to all locking schemes. Besides, the key can be shared across different blocks in a SoC. Thus, the overhead of the key management scheme is taken as fixed for any locking mechanism and is not considered.

2) Power overhead: Embedding SyncLock in the bladeRFwiphy PHY implementation as above resulted in no noticeable power overhead.

3) Performance penalty: The SyncLock mechanism has no impact on the performance of the RF transceiver. The delay of f (•) is accommodated by just enabling the XOR stream ciphers with the same delay. Thus, the STS generation is not delayed because of f (•). However, the two XOR stream ciphers introduce a delay of two clock cycles in the STS generation. This results in no timing violation because the preamble, consisting of STS and LTS, and the payload are generated in parallel to compose the data frame, while the payload part is much longer than the preamble part. In other words, the preamble generation, despite being delayed, still finishes before the payload is generated. The noninstrusiveness of the SyncLock mechanism is confirmed with hardware measurements in Section V.

4) Design flow: The AFE is left intact, thus there is no change in the analog IC design flow. This is an important attribute of SyncLock since analog IC designers are often reluctant to make any alternations in the circuit once it is finalized since this would typically add parasitics that would likely degrade performance. A lock mechanism inside the analog section inevitably would have to be co-designed with the circuit, possibly increasing design iterations and failing to meet the intent specifications. In contrast, SyncLock is a plugin module added to the digital section of the RF transceiver once the design is completed without requiring any change in the design flow.

H. Practicality

Since a synchronization process is present and necessary in any wireless communication protocol, SyncLock is applicable to any of them. For instance, Wireless Local Area Network (WLAN) IEEE 802.11 (i.e., Wi-Fi), Wireless Personal Area Network (WPAN) IEEE 802.15.1 (i.e., Bluetooth), Low-Rate Wireless Personal Area Network (LRWPAN) IEEE 802.15.4 (i.e., Zigbee), and any other standard using correlation-based synchronization algorithms, are natural candidates. Furthermore, since SyncLock only acts on the preamble generation, it is independent of the modulation scheme that is applied on the payload and, thereby, it is generally applicable for any modulation scheme. Finally, since SyncLock modifies only the DSP, it is independent of the AFE of the RF transceiver architecture. Therefore, it can be applied to conventional RF transceiver architectures, such as Zero Intermediate Frequency (Zero-IF) and Low Intermediate Frequency (Low-IF), as well as to highly-digitized RF transceiver architectures.

I. First SyncLock version [14]

The first SyncLock implementation in [START_REF] Díaz Rizo | SyncLock: RF transceiver security using synchronization locking[END_REF] is a special case of the new SyncLock implementation proposed in this paper. In particular the first SyncLock implementation does not include the nonlinear module and feedback in the part of the mechanism that is embedded inside the frame generation block. This can be expressed as

f (ST S out , key h-c ) = key h-c (13)
with the system equation being simplified from Eq. ( 3) to

ST S out = ST S nom ⊕ (key ⊕ key h-c ) (14)
As will be explained in detail in Section VII-B5, the motivation for the new SyncLock implementation is that the first SyncLock implementation in [START_REF] Díaz Rizo | SyncLock: RF transceiver security using synchronization locking[END_REF] is vulnerable to the KPA. This new SyncLock implementation effectively thwarts the KPA.

Another difference is that the first SyncLock implementation in [START_REF] Díaz Rizo | SyncLock: RF transceiver security using synchronization locking[END_REF] does not provide a full effective key size. The reason is that a single bit flip in the input secret key results in a single bit flip in ST S out . To quantify the fraction of incorrect keys that are still capable of enabling synchronization we performed a HD test. In particular, we generated incorrect keys with increasing HD from the correct key. For a full size key of 512 bits, there are 512 incorrect keys with HD=1 and 512 k keys with HD=k. Since 512 k is very high for k > 1, e.g., 512 2 =130816, for each k > 1 we tested a randomly generated set of 10 3 keys. We increased k until for all tested 10 3 keys synchronization failed. The results are shown in Table V. For HD=1, only 192 incorrect keys, or 37% of the incorrect keys, did not allow the synchronization process, thus reducing the number of effective key-bits to 192. This percentage increases with k and for k = 14 all incorrect keys resulted in no synchronization. The number of incorrect keys that enabled synchronization can be estimated as: where ω k is the percentage of failing keys for HD=k and n = 13 is the highest HD showing keys that enable synchronization. Thus, a negligible percentage (10 22 /2 512 ) • 100 = 10 -131 % of incorrect keys were capable of enabling synchronization.

n=13 i=1 1 - ω k 100 • 512 i ≈ 10 22
Table VI summarizes the comparison between the first and new SyncLock implementations. The description of different counter-attacks and the resilience to them will be described in detail in Section VII.

IV. HARDWARE PLATFORM

SyncLock is demonstrated in hardware using a SDR bladeRF board from Nuand [START_REF] Nuand | SDR bladeRF 2.0 micro xA9[END_REF]. The board contains three main chips: (a) an RF transceiver; (b) an FPGA; and (c) a USB 3.0 peripheral controller. We implemented on the bladeRF board an IEEE 802.11 RF transceiver with a direct conversion AFE architecture for both the receiver and the transmitter. The bladeRF board has an AFE RF loopback mode as shown in Fig. 2, which allows us to perform Bit Error Rate (BER) measurements and symbol timing recovery, i.e., synchronization, using the same board. Note that this on-board loopback minimizes the impairments of the wireless communication channel, such as path loss, fading, and shadowing, and greatly simplifies the channel model. The measurements presented in Section V were obtained using this on-board loopback considering an Additive White Gaussian Noise (AWGN) channel model. The baseband DSP is designed in VHDL [START_REF] Nuand | Open-source IEEE[END_REF] and implemented on the FPGA of the board. The VHDL code of the preamble and frame generation blocks is modified to insert the SyncLock locking mechanism and is re-embedded into the same FPGA Fig. 6. Bit error rate with for RF transceiver with no locking and RF transceiver with SyncLock embedded using the correct and incorrect keys.

project. Detailed information on implementation overhead is presented in Section III-G1. As mentioned in Section III-H, SyncLock is independent of the modulation scheme. To show this, we repeat the demonstration by modulating the payload of the transmitted signal using Binary Phase-Shift Keying (BPSK), Quadrature Phase-Shift Keying (QPSK), and 16-Quadrature Amplitude Modulation (QAM), then encoding it into OFDM symbols. The frame generation block creates the PPDU frame format for an IEEE 802.11 transmission, as shown in Fig. 3. At the receiver side, the synchronization frame detection block searches for the start of the frame based on the Schmidl and Cox algorithm [START_REF] Schmidl | Robust frequency and timing synchronization for OFDM[END_REF]. The received signal is processed and demodulated, and different performances of the RF transceiver are derived and visualized, such as BER and constellation diagram of the received payload.

V. MEASURED SyncLock EFFICIENCY

A. BER performance for incorrect keys

The hardware platform is used for assessing the impact of SyncLock on the nominal performance when using the correct key and for demonstrating the locking efficiency when using an incorrect key. As discussed in Section III-F, there is a single key enabling synchronization since any incorrect key, even those with HD=1 from the correct key, generate an arbitrary number of bit errors in the preamble of the outgoing data frame which impedes synchronization. For this reason, in the measurement results below we utilize a randomly selected incorrect key.

Fig. 6 shows the BER of an OFDM-BPSK transmission considering different Signal-to-Noise Ratio (SNR) values without SyncLock, with SyncLock when applying the correct key, and with SyncLock when applying a randomly selected incorrect key. A first observation is that when applying the correct key there is no BER penalty. The curves of BER without and with SyncLock are identical for all SNR values. This measurement proves that SyncLock is totally transparent when the correct key is used, thus there is zero performance penalty. This is expected since SyncLock leaves intact the sensitive AFE concentrating the lock mechanism inside the DSP. For each preamble bit line SyncLock essentially introduces two spatially separated XOR gates in the path without causing any timing violation. A second observation is that with an incorrect key the system does not synchronize and erroneously demodulates the received signal. As a result, the BER is maximum and constant across all SNR values. It should be noted that for SNR values below -5dB the synchronization was not possible even for the device with no locking.

B. Constellation diagrams for incorrect keys

Fig. 7 shows the constellation diagrams of the received payload for three different modulation schemes, namely BPSK, QPSK, and 16-QAM, when applying the correct key and when applying a randomly selected incorrect key. The thin black circles show the reference constellation points for the modulation schemes. While the received signal lies inside the reference constellation for every modulation using the correct key, the non-synchronized signal is randomly distributed.

C. Locking efficiency for approximate keys

Finally, we tested the synchronization process for all the 512 incorrect keys with HD=1 from the correct key. All incorrect keys resulted in no synchronization with the smallest observed HD between ST S out and ST S nom being equal to 80. As discussed theoretically in Section III-F, any incorrect key will show the same behavior observed in Figs. 6 and7, with the only difference being the randomness of distribution of payload data in Fig. 7 when different incorrect keys are loaded onto the chip.

VI. RELATED LOCKING AND OBFUSCATION APPROACHES

Herein, we describe related locking approaches and explain their differences compared to SyncLock.

1) Key-gates in logic locking: Traditional logic locking techniques insert key-gates into the design [START_REF] Roy | Ending piracy of integrated circuits[END_REF], [START_REF] Rajendran | Fault analysis-based logic encryption[END_REF]- [START_REF] Limaye | Thwarting all logic locking attacks: Dishonest oracle with truly random logic locking[END_REF]. A key-gate interrupts a digital line controlling its value with a key-bit. The first technique inserted key-gates randomly [START_REF] Roy | Ending piracy of integrated circuits[END_REF], while follow-up techniques targeted high output corruption for incorrect keys [START_REF] Rajendran | Fault analysis-based logic encryption[END_REF], resilience to sensitizing the key-bits to the output [START_REF] Yasin | On improving the security of logic locking[END_REF], reducing PPA overheads [START_REF] Juretus | Reduced overhead gate level logic encryption[END_REF], or thwarting the ability of the attacker to learn the key-bit value from the keygate type [START_REF] Limaye | Thwarting all logic locking attacks: Dishonest oracle with truly random logic locking[END_REF]. In all cases, key-gates are inserted randomly or algorithmically. In contrast, SyncLock inserts key-gates on fixed binary sequences, i.e., ST S nom inside the preamble generation block and ST S f aulty inside the frame generation block.

2) Preamble obfuscation: The XOR-based cipher of the SyncLock mechanism inside the preamble generator that encrypts the nominal preamble ST S nom with a key was used in [START_REF] Chacko | Physical gate based preamble obfuscation for securing wireless communication[END_REF] as a PHY layer security to prevent man-in-the-middle attacks such as eavesdropping. In this different context, the preamble obfuscation is performed through unique keys that are independently generated at both the transmitter and the receiver based on channel characteristics known only to the pair. Using only the XOR-based cipher inside the preamble generator is not sufficient for anti-piracy since the attacker can identify and straightforwardly remove this XOR-based cipher by tracing the key-bits from the TPM. SyncLock hides a second XOR-based cipher inside the frame generation block to achieve the anti-piracy objective.

3) Corrupt-and-correct logic locking: SyncLock belongs to the family of corrupt-and-correct locking techniques. Two state-of-the-art corrupt-and-correct logic locking techniques are SFLL-hd [START_REF] Yasin | Provably-secure logic locking: From theory to practice[END_REF] and SFLL-rem [START_REF] Sengupta | Truly stripping functionality for logic locking: A fault-based perspective[END_REF].

SFLL-hd, illustrated in Fig. 8, inserts a corrupt unit which compares the input to a hard-coded secret key. If the HD between the key and the input is h, then the output of the corrupt unit is 1, thus flipping the output of the circuit using an XOR gate. The inputs that satisfy this condition are called Protected Input Patterns (PIPs). The correct unit is identical (e) Addition of correct unit for restoring functionality for the selected PIPs in Fig. 9b. Fig. 9. SFLL-rem principle of operation explained with an example using the c17 circuit from the ISCAS benchmark suite [START_REF] Hansen | Unveiling the ISCAS-85 benchmarks: a case study in reverse engineering[END_REF].

to the corrupt unit, but in this case the key is sourced from the TPM. The correct unit flips the output a second time for the PIPs to restore correct functionality only when the correct secret key is loaded into the TPM. If an incorrect key is used, the functionality will be corrupted for all PIPs. The hypothesis is that the corrupt unit is immersed into the circuit after logic synthesis becoming indistinguishable to the attacker. SFLL-rem, illustrated in Fig. 9 with an example reproduced from [START_REF] Sengupta | Truly stripping functionality for logic locking: A fault-based perspective[END_REF], corrupts the circuit functionality by injecting a stuck-at fault. Due to the fault, a number of input patterns fail resulting in incorrect output. Also due to the fault, some gates become redundant and the topology of the circuit is simplified by removing them. The circuit is then redesigned to correct functionality for all input patterns apart for a selected one that has k care bits and n -k don't care bits, where n is the input size. In this way, 2 n-k PIPs are generated. Thereafter, a correction unit similar to SFLL-hd is used where the secret key is composed of the aforementioned k care bits and is sourced from the TPM to flip the output for all PIPs restoring functionality. Similar to SFLL-hd, if an incorrect key is used, the functionality will be corrupted for all PIPs.

SyncLock compared to SFLL-hd and SFLL-rem is concep-tually different. As it will be discussed in detail in Section VII-B4, SFLL-hd and SFLL-rem were shown to be vulnerable to recently developed structural attacks [START_REF] Han | Does logic locking work with EDA tools?[END_REF], [START_REF] Sirone | Functional analysis attacks on logic locking[END_REF], [START_REF] Yang | Stripped functionality logic locking with hamming distance-based restore unit (SFLL-hd) -unlocked[END_REF], while SyncLock circumvents successfully these attacks.

VII. THREAT MODEL AND SECURITY ANALYSIS A. Threat model

We consider the most demanding threat model for a defender. We assume that the attacker is in possession of the netlist and an oracle, i.e., a working chip with the correct key applied into the TPM. The goal of the attacker is either to identify a key that establishes synchronization or, alternatively, remove SyncLock while restoring the functionality. Next, we describe the known counter-attacks and discuss how SyncLock achieves resilience against all of them.

B. Resilience to counter-attacks 1) Attacks in the analog domain: Biasing locking is the only known locking approach working in the analog domain. Recently several attacks on biasing locking were demonstrated, some of them not requiring particular knowledge on analog design by the attacker [START_REF] Jayasankaran | Breaking analog locking techniques[END_REF]- [START_REF] Leonhard | Breaking analog biasing locking techniques via re-synthesis[END_REF]. These attacks assume the existence of an obfuscated analog component, i.e., the geometry of the mirroring transistor in a current mirror. They do not apply to SyncLock since SyncLock is not based on analog component obfuscation.

2) Brute-force and optimization attacks: The attacker searches in the key space either randomly in a brute-force manner or more efficiently by employing an optimization algorithm hoping to find a key that enables synchronization. The search is performed by simulating the design at netlistlevel where the TPM is circumvented and the key inputs are accessed directly. At each iteration, instead of evaluating synchronization, a faster evaluation criterion may be devised by involving the oracle. For example a simulated transient response can be compared to that of the oracle. Resilience against this attack is achieved since: (a) the key space size, i.e., 2 512 for a full key size, is huge; (b) a single secret key enables synchronization, thus the optimization function behaves like a delta function on the secret key and an optimization algorithm will "zig-zag" endlessly; (c) a single simulation at netlist-level can be very time-consuming, thus the attacker in practice can perform a very limited number of trials.

3) Input-output query attacks: Attacks based on Boolean satisfiability (SAT) [START_REF] Subramanyan | Evaluating the security of logic encryption algorithms[END_REF] belong to this category and were shown to be very powerful, breaking traditional logic locking approaches [START_REF] Roy | Ending piracy of integrated circuits[END_REF], [START_REF] Rajendran | Fault analysis-based logic encryption[END_REF]- [START_REF] Juretus | Reduced overhead gate level logic encryption[END_REF] by recovering the key with little effort. The SAT attack computes Distinguishing Input Patterns (DIPs), defined as inputs which produce different output for at least two different keys, and prunes down multiple incorrect keys iteratively using DIPs and querying the oracle. SFLL-hd and SFLL-rem were specifically proposed to push the limits of the SAT attack by eliminating exactly one key per iteration, thus making it equivalent to a brute-force attack in terms of attack time. As the SAT attack makes use of the scan chain, another recently proposed solution to thwart the SAT attack is to withdraw the secret key upon detection of access to the scan chain [START_REF] Limaye | Thwarting all logic locking attacks: Dishonest oracle with truly random logic locking[END_REF]. The SAT attack does not apply to SyncLock since the inputs to the preamble generation block, i.e., the DATA i values and SEL, are fixed and hard-coded, thus no DIPs can be generated.

4) Structural attacks: Structural attacks, a.k.a. removal attacks, aim at identifying and removing the locking mechanism. The attacker can trace the key-bits from the TPM to straightforwardly identify and remove the first XOR-based stream cipher in the preamble generation block. In this case, the design will be left with a hard-coded error introduced by the second XOR-based stream cipher inside the frame generation block. Thus, the attacker will need to identify this second corrupt unit too to complete the removal attack. However, after logic synthesis this small circuit is immersed in the original design and the two become inseparable. The attacker has at hand a non-annotated netlist, thus identifying this small circuit is puzzling.

The fact that the corrupt unit is non-identifiable is the hypothesis of SFLL-hd too. For SFLL-hd, however, two specific attacks were developed recently that succeed in identifying the corrupt unit [START_REF] Sirone | Functional analysis attacks on logic locking[END_REF], [START_REF] Yang | Stripped functionality logic locking with hamming distance-based restore unit (SFLL-hd) -unlocked[END_REF]. They perform a structural analysis of the locked netlist to identify PIPs by leveraging the properties of the HD-based corrupt and correct units, and also exploiting the fact that in SFLL-hd the input feeds the corrupt unit. These attacks, apart from being specific to SFLL-hd, are not generalizable for SyncLock for two reasons. First, in SyncLock corruption is not a function of the ST S nom input which is fixed, i.e., SyncLock does not generate PIPs or stated differently all inputs are PIPs. Second, the corrupt unit hidden inside the frame generation block is spatially separated from the correct unit inside the input preamble generation block, thus the corrupt unit cannot be traced from the input.

In [START_REF] Han | Does logic locking work with EDA tools?[END_REF], a structural attack is proposed that defeats both SFLL-hd and SFLL-rem. It works differently by analyzing the Boolean truth table of the corrupted circuit to extract the PIPs. The SFLL-hd and SFLL-rem techniques essentially construct the corrupted circuit by adding (removing) selected minterm(s) to (from) the original circuit to create the PIPs. Then, the logic synthesis tool synthesizes the resulting corrupted circuit. The attack in [START_REF] Han | Does logic locking work with EDA tools?[END_REF] aims at recovering the PIPs. It demonstrates how the optimization performed to minimize the PPA overhead executed by the Electronic Design Automation (EDA) tools may expose the PIPs. This attack is not applicable to SyncLock either since SyncLock does not employ PIPs to secure the circuit, i.e., it does not add or remove any minterms, and no trace is left in the Boolean truth table. In addition, the correctness of the extracted PIPs is verified by querying the oracle with the PIPs. As explained in Section VII-B3, in the case of SyncLock, an attacker cannot query the oracle since the inputs to the preamble generation block, i.e., the DATA i values and SEL, are fixed and hard-coded.

In short, it is realistic to assume that the corrupt unit inside the frame generation block cannot be distinguished within a "sea" of non-annotated digital gates. However, as we observed with other corrupt-and-correct logic locking techniques [START_REF] Sengupta | Truly stripping functionality for logic locking: A fault-based perspective[END_REF], [START_REF] Yasin | Provably-secure logic locking: From theory to practice[END_REF], it leaves a backdoor that may be exploited to develop an attack based on structural analysis. Although such an attack is not known at this point for SyncLock, the possibility cannot be ruled out.

5) KPA: It applies to stream ciphers with symmetric encryption, i.e., when the encryption and decryption processes are performed using the same encryption key. In our context, the plaintext is ST S nom and is known to the attacker since it is published in the IEEE 802.11 standard [START_REF] Ieee | IEEE standard for information technology-telecommunications and information exchange between systems local and metropolitan area networks-specific requirements -part 11: Wireless LAN medium access control (MAC) and physical layer (PHY) specifications[END_REF].

Let us consider the first SyncLock implementation in [START_REF] Díaz Rizo | SyncLock: RF transceiver security using synchronization locking[END_REF]. The attacker applies a trial key, denoted by key trial . From Eq. ( 14), using the associative and self-inverse properties of the XOR function, we obtain key h-c = key trial ⊕ ST S nom ⊕ ST S out [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] Knowing ST S nom and selecting any key trial , the attacker can successfully recover key h-c and, thereby, the secret key since key = key h-c , provided that ST S out is measured accurately.

In the oracle chip, the attacker cannot re-write the TPM to apply a trial key, thus ST S out has to be extracted by simulation.

The attacker can simulate a transmission and try to extract ST S out from the transmitted frame. A loopback connection to the receiver can be used to analyse the transmitted signal.

There are three different loopback modes, as shown in Fig. 2, namely (a) the AFE RF loopback that connects the output of the transmitter's PA to the input of the receiver's LNA, (b) the AFE baseband loopback right before the RF mixers, and (c) the digital baseband loopback between the DSP output and subsequent AFE data converters. In all three scenarios, the attacker should be able to manually locate the received ST S out bits. However, with loopback modes (a) and (b), some bits of ST S out will be corrupted due to analog impairments, quantization noise, and nonlinearities introduced throughout the signal processing at transistor-level. To demonstrate this, we implemented this attack using loopback mode (b) on our hardware platform, which will be described in Section IV. Fig. 10 shows the amplitude values of the first 32 samples of the measured transmitted and received ST S out for a given key trial . As it can be seen, for every sample the amplitude values differ between the two ST S out signals. To quantify the number of bit errors, we translated the floating-point values into binary fixed-point values and obtained a HD of 1902 bits out of 5120 bits between the two signals. Thus, the transmitted ST S out will be extracted with errors and the computed key h-c from Eq. ( 15) will be incorrect. In contrast, if the attacker can locate the boundary between the DSP and AFE to implement loopback mode (c), then ST S out can be extracted accurately and KPA is completed successfully. This is a security breach of the first SyncLock implementation in [START_REF] Díaz Rizo | SyncLock: RF transceiver security using synchronization locking[END_REF] that is addressed with the second SyncLock implementation in this paper. As shown in the comparison Table VI, this is the main differentiation between the two implementations and the motivation for complexifying SyncLock giving rise to the second implementation.

In particular, introducing the nonlinear feedback inside the frame generation block helps thwarting the KPA attack even when ST S out is correctly extracted using a purely digital baseband loopback (c). The reason is that the identity from Eq. (3) now becomes ST S out = (ST S nom ⊕ key trial ) ⊕ f (ST S out , key h-c ) [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF] making it impossible to de-embed key h-c since both the nonlinear function f and key h-c are unknown to the attacker. In the implementation presented herein, f is an XOR followed by a circular shift operation. However, as mentioned in Section III-D, any shift value can be used and any other function performing bitwise operations can be used instead. Thus, we presented one out of the countless implementations without endangering the security of SyncLock.

VIII. CONCLUSION

We presented SyncLock, an anti-piracy design technique for RF transceivers. SyncLock makes the synchronization between the transmitter and receiver key-dependent, while there is a single valid key that can have up to 512 effective key-bits. The SyncLock mechanism is hidden inside the DSP resulting in an overhead of around 1.22% of the DSP, which is negligible when projected to the entire RF transceiver since the area is dominated by the AFE. SyncLock is non-intrusive to the RF transceiver operation when applying the correct key incurring no performance penalty. No changes in the AFE design or the analog design flow are needed. The SyncLock mechanism is a simple plug-in to the DSP. SyncLock is a generic approach applicable to any RF transceiver architecture, communication protocol, and modulation scheme. Finally, it is shown to be resilient against any known counter-attack aiming at finding the secret key or removing the lock mechanism.

Fig. 1 .

 1 Fig. 1. Locking methodology.

Fig. 2 .

 2 Fig. 2. Simplified architecture of a wireless device IC with SyncLock embedded.

Fig. 3 .

 3 Fig. 3. PPDU frame format of an OFDM IEEE 802.11 transmission.

Fig. 4 .

 4 Fig. 4. Original preamble generation block.

  to a faulty value, denoted by ST S f aulty . Herein and in the rest of the article we refer to a TPM but any other on-die key provisioning scheme can be used instead. The equations describing the operations are ST S f aulty = ST S nom ⊕ key (1)

Fig. 5 .

 5 Fig. 5. SyncLock principle of operation.

  Without loss of generality, let us consider the I channel. Let s I [k] denote the 16-bit k-th sample in Table I, k = 0, • • • , 15, e.g., s I [0] = 16 h02F 2, s I [1] = 16 hF 786, etc. Let also ST S f aulty I and ST S out I denote the real parts of ST S f aulty and ST S out , respectively, each composed of 2560 bits similarly to ST S nom I. As explained Section III-B, by construction, STS is divided into words of 16-bits corresponding to samples s I [k]. Starting with ST S nom I, it is divided into 16bit words ST S nom I[j] corresponding to bit positions from j * 16 to (j * 16 + 15), j = 0, • • • , 159. ST S nom I[j] can be expressed in terms of s I [k] as

Fig. 7 .

 7 Fig. 7. Constellation diagram of the received payload with SyncLock embedded using the correct and an incorrect key.

Fig. 8 .

 8 Fig. 8. SFLL-hd principle of operation.

  (a) Targeted logic cone from the c17 circuit having n = 5 inputs {I1, I2, I3, I6, I7}. The location of the stuck-at fault is shown. (b) Failing inputs patterns for the stuck-at 0 fault of Fig. 9a highlighting the selected PIPs. (c) Simplified circuit after stuck-at-0 fault injection. (d) Circuit after restoring logic in the circuit in Fig. 9c for all input patterns in Fig. 9b except the selected PIPs.

Fig. 10 .

 10 Fig. 10. Amplitude values of the first 32 samples of the transmitted and received ST Sout for a given key trial using the AFE baseband loopback.

TABLE I

 I ST Snom AS DEFINED IN THE IEEE 802.11 STANDARD[START_REF] Ieee | IEEE standard for information technology-telecommunications and information exchange between systems local and metropolitan area networks-specific requirements -part 11: Wireless LAN medium access control (MAC) and physical layer (PHY) specifications[END_REF].

	Sample (k)	Floating-point (I,Q)	Fixed-point (I,Q)
	0	0.04600 , 0.04600	16'h02F2 , 16'h02F2
	1	-0.13245 , 0.00234	16'hF786 , 16'h0026
	2	-0.01347 , -0.07853	16'hFF23 , 16'hFAF9
	3	0.14276 , -0.01265	16'h0923 , 16'hFF31
	4	0.09200 , 0.00000	16'h05E3 , 16'h0000
	5	0.14276 , -0.01265	16'h0923 , 16'hFF31
	6	-0.01347 , -0.07853	16'hFF23 , 16'hFAF9
	7	-0.13245 , 0.00234	16'hF786 , 16'h0026
	8	0.04600 , 0.04600	16'h02F2 , 16'h02F2
	9	0.00234 , -0.13245	16'h0026 , 16'hF786
	10	-0.07853 , -0.01347	16'hFAF9 , 16'hFF23
	11	-0.01265 , 0.14276	16'hFF31 , 16'h0923
	12	0.

00000 , 0.09200 16'h0000 , 16'h05E3 13 -0.01265 , 0.14276 16'hFF31 , 16'h0923 14 -0.07853 , -0.01347 16'hFAF9 , 16'hFF23 15 0.00234 , -0.13245 16'h0026 , 16'hF786

TABLE II INPUT

 II VALUES OF MUXES IN THE PREAMBLE GENERATION BLOCK.

	MUX	Name	Input (16-bit)
			I branch
	M0

TABLE III CONCATENATION

 III OPERATION AT THE OUTPUTS OF THE MUXES.

TABLE IV VALUES

 IV OF THE MAIN SIGNALS OF THE SyncLock LOCKING MECHANISM FOR THREE KEY CASES: INCORRECT ZERO KEY, RANDOM INCORRECT KEY, AND CORRECT KEY. THE EXAMPLE CONSIDERS A BIT ROTATION FUNCTION WITH b = 1 AND SHOWS THE COMPUTATIONS DURING THE TRANSMISSION OF THE FIRST 19 SAMPLES OF ST Snom FOR THE I CHANNEL.

					(a) Incorrect zero key
		Preamble generation block			Frame generation block
	j	ST SnomI[j]	keyI[mod(j, 16)]	ST S f aulty I[j]	key h-c I[mod(j, 16)]	f (ST SoutI[j -1], key h-c I[mod(j, 16)])	ST SoutI[j]
		16'h02F2	16'h0000 (Bypassed)	16'h02F2	16'h0052 (Bypassed)	(Bypassed)	16'h02F2
		16'hF786	16'h0000	16'hF786	16'hFAFA	(16'h02F2 ⊕ 16'hFAFA) >> b = 16'h7C04	16'h8B82
		16'hFF23	16'h0000	16'hFF23	16'hFEA6	(16'h8B82 ⊕ 16'hFEA6) >> b = 16'h3A92	16'hC5B1
		16'h0923	16'h0000	16'h0923	16'h5216	(16'hC5B1 ⊕ 16'h5216) >> b = 16'hCBD3	16'hC2F0
		16'h05E3	16'h0000	16'h05E3	16'h5614	(16'hC2F0 ⊕ 16'h5614) >> b = 16'h4A72	16'h4F91
		16'h0923	16'h0000	16'h0923	16'hCAFE	(16'h4F91 ⊕ 16'hCAFE) >> b = 16'hC2B7	16'hCB94
		16'hFF23	16'h0000	16'hFF23	16'hFEF8	(16'hCB94 ⊕ 16'hFEF8) >> b = 16'h1AB6	16'hE595
		16'hF786	16'h0000	16'hF786	16'h4516	(16'hE595 ⊕ 16'h4516) >> b = 16'hD041	16'h27C7
		16'h02F2	16'h0000	16'h02F2	16'h0158	(16'h27C7 ⊕ 16'h0158) >> b = 16'h934F	16'h91BD
		16'h0026	16'h0000	16'h0026	16'hCAFE	(16'h91BD ⊕ 16'hCAFE) >> b = 16'hADA1	16'hAD87
	10	16'hFAF9	16'h0000	16'hFAF9	16'hFFAC	(16'hAD87 ⊕ 16'hFFAC) >> b = 16'hA915	16'h53EC
	11	16'hFF31	16'h0000	16'hFF31	16'hAAAA	(16'h53EC ⊕ 16'hAAAA) >> b = 16'h7CA3	16'h8392
	12	16'h0000	16'h0000	16'h0000	16'h003A	(16'h8392 ⊕ 16'h003A) >> b = 16'h41D4	16'h41D4
	13	16'hFF31	16'h0000	16'hFF31	16'h0569	(16'h41D4 ⊕ 16'h0569) >> b = 16'hA25E	16'h5D6F
	14	16'hFAF9	16'h0000	16'hFAF9	16'hFFC2	(16'h5D6F ⊕ 16'hFFC2) >> b = 16'hD156	16'h2BAF
	15	16'h0026	16'h0000	16'h0026	16'h9623	(16'h2BAF ⊕ 16'h9623) >> b = 16'h5EC6	16'h5EE0
	16	16'h02F2	16'h0000	16'h02F2	16'h0052	(16'h5EE0 ⊕ 16'h0052) >> b = 16'h2F59	16'h2DAB
	17	16'hF786	16'h0000	16'hF786	16'hFAFA	(16'h2DAB ⊕ 16'hFAFA) >> b = 16'hEBA8	16'h1C2E
	18	16'hFF23	16'h0000	16'hFF23	16'hFEA6	(16'h1C2E ⊕ 16'hFEA6) >> b = 16'h7144	16'h8E67
					(b) Random incorrect key
		Preamble generation block			Frame generation block
	j	ST SnomI[j]					ST SoutI[j]
		16'h02F2	16'h2324 (Bypassed)	16'h02F2	16'h0052 (Bypassed)	(Bypassed)	16'h02F2
		16'hF786	16'hCAFE	16'h3D78	16'hFAFA	(16'h02F2 ⊕ 16'hFAFA) >> b = 16'h7C04	16'h417C
		16'hFF23	16'h5249	16'hAD6A	16'hFEA6	(16'h417C ⊕ 16'hFEA6) >> b = 16'h5FED	16'hF287
		16'h0923	16'h3216	16'h3B35	16'h5216	(16'hF287 ⊕ 16'h5216) >> b = 16'hD048	16'hEB7D
		16'h05E3	16'hEFAC	16'hEA4F	16'h5614	(16'hEB7D ⊕ 16'h5614) >> b = 16'hDEB4	16'h34FB
		16'h0923	16'h1234	16'h1B17	16'hCAFE	(16'h34FB ⊕ 16'hCAFE) >> b = 16'hFF02	16'hE415
		16'hFF23	16'hAFC5	16'h50E6	16'hFEF8	(16'hE415 ⊕ 16'hFEF8) >> b = 16'h8D76	16'hDD90
		16'hF786	16'hDE18	16'h299E	16'h4516	(16'hDD90 ⊕ 16'h4516) >> b = 16'h4C43	16'h65DD
		16'h02F2	16'h0090	16'h0262	16'h0158	(16'h65DD ⊕ 16'h0158) >> b = 16'hB242	16'hB020
		16'h0026	16'hFE10	16'hFE36	16'hCAFE	(16'hB020 ⊕ 16'hCAFE) >> b = 16'h3D6F	16'hC359
	10	16'hFAF9	16'h3620	16'hCCD9	16'hFFAC	(16'hC359 ⊕ 16'hFFAC) >> b = 16'h9E7A	16'h52A3
	11	16'hFF31	16'h5148	16'hAE79	16'hAAAA	(16'h52A3 ⊕ 16'hAAAA) >> b = 16'hFC04	16'h527D
	12	16'h0000	16'h6696	16'h6696	16'h003A	(16'h527D ⊕ 16'h003A) >> b = 16'hA923	16'hCFB5
	13	16'hFF31	16'hA5CD	16'h5AFC	16'h0569	(16'hCFB5 ⊕ 16'h0569) >> b = 16'h656E	16'h3F92
	14	16'hFAF9	16'hB517	16'h4FEE	16'hFFC2	(16'h3F92 ⊕ 16'hFFC2) >> b = 16'h6028	16'h2FC6
	15	16'h0026	16'h9ED1	16'h9EF7	16'h9623	(16'h2FC6 ⊕ 16'h9623) >> b = 16'hDCF2	16'h4205
	16	16'h02F2	16'h2324	16'h21D6	16'h0052	(16'h4205 ⊕ 16'h0052) >> b = 16'hA12B	16'h80FD
	17	16'hF786	16'hCAFE	16'h3D78	16'hFAFA	(16'h80FD ⊕ 16'hFAFA) >> b = 16'hBD03	16'h807B
	18	16'hFF23	16'h5249	16'hAD6A	16'hFEA6	(16'h807B ⊕ 16'hFEA6) >> b = 16'hBF6E	16'h1204
					(c) Correct key
		Preamble generation block			Frame generation block
	j	ST SnomI[j]	keyI[mod(j, 16)]	ST S f aulty I[j]	key ST SoutI[j]
		16'h02F2	16'h003A (bypassed)	16'h02F2	16'h0052 (bypassed)	(bypassed)	16'h02F2
		16'hF786	16'h7C04	16'h8B82	16'hFAFA	(16'h02F2 ⊕ 16'hFAFA) >> b = 16'h7C04	16'hF786
		16'hFF23	16'h0490	16'hFBB3	16'hFEA6	(16'hF786 ⊕ 16'hFEA6) >> b = 16'h0490	16'hFF23
		16'h0923	16'hD69A	16'hDFB9	16'h5216	(16'hFF23 ⊕ 16'h5216) >> b = 16'hD69A	16'h0923
		16'h05E3	16'hAF9B	16'hAA78	16'h5614	(16'h0923 ⊕ 16'h5614) >> b = 16'hAF9B	16'h05E3
		16'h0923	16'hE78E	16'hEEAD	16'hCAFE	(16'h05E3 ⊕ 16'hCAFE) >> b = 16'hE78E	16'h0923
		16'hFF23	16'hFBED	16'h04CE	16'hFEF8	(16'h0923 ⊕ 16'hFEF8) >> b = 16'hFBED	16'hFF23
		16'hF786	16'hDD1A	16'h2A9C	16'h4516	(16'hFF23 ⊕ 16'h4516) >> b = 16'hDD1A	16'hF786
		16'h02F2	16'h7B6F	16'h799D	16'h0158	(16'hF786 ⊕ 16'h0158) >> b = 16'h7B6F	16'h02F2
		16'h0026	16'h6406	16'h6420	16'hCAFE	(16'h02F2 ⊕ 16'hCAFE) >> b = 16'h6406	16'h0026
	10	16'hFAF9	16'h7FC5	16'h853C	16'hFFAC	(16'h0026 ⊕ 16'hFFAC) >> b = 16'h7FC5	16'hFAF9
	11	16'hFF31	16'hA829	16'h5718	16'hAAAA	(16'hFAF9 ⊕ 16'hAAAA) >> b = 16'hA829	16'hFF31
	12	16'h0000	16'hFF85	16'hFF85	16'h003A	(16'hFF31 ⊕ 16'h003A) >> b = 16'hFF85	16'h0000
	13	16'hFF31	16'h82B4	16'h7D85	16'h0569	(16'h0000 ⊕ 16'h0569) >> b = 16'h82B4	16'hFF31
	14	16'hFAF9	16'h8079	16'h7A80	16'hFFC2	(16'hFF31 ⊕ 16'hFFC2) >> b = 16'h8079	16'hFAF9
	15	16'h0026	16'h366D	16'h364B	16'h9623	(16'hFAF9 ⊕ 16'h9623) >> b = 16'h366D	16'h0026
	16	16'h02F2	16'h003A	16'h02C8	16'h0052	(16'h0026 ⊕ 16'h0052) >> b = 16'h003A	16'h02F2
	17	16'hF786	16'h7C04	16'h8B82	16'hFAFA	(16'h02F2 ⊕ 16'hFAFA) >> b = 16'h7C04	16'hF786
	18	16'hFF23	16'h0490	16'hFBB3	16'hFEA6	(16'hF786 ⊕ 16'hFEA6) >> b = 16'h0490	16'hFF23

keyI[mod(j, 16)] ST S f aulty I[j] key h-c I[mod(j, 16)] f (ST SoutI[j -1], key h-c I[mod(j, 16)]) h-c I[mod(j, 16)] f (ST SoutI[j -1]

, key h-c I[mod(j, 16)])

TABLE V HD

 V TEST FOR THE FIRST SyncLock IMPLEMENTATION IN[START_REF] Díaz Rizo | SyncLock: RF transceiver security using synchronization locking[END_REF].

	HD	1	2	3	4	5	6	7
	Percentage
	of failing	37.5%	63.5%	72.8%	84.6%	91.7%	94.4%	96.3%
	keys
	HD	8	9	10	11	12	13	14
	Percentage
	of failing	98.0%	98.3%	98.9%	99.3%	99.7%	99.9%	100%
	keys

TABLE VI COMPARISON

 VI BETWEEN THE NEW AND FIRST SyncLock

	IMPLEMENTATIONS.
		First	New
		implementation [14]	implementation
	Effective number of key-bits	192	512
	Area overhead
	(projected to DSP)	1.12%	1.22%
	Performance penalty	no	no
	Attacks in the analog domain
	Brute-force and
	optimization attacks
	Input-output query attacks
	Removal attacks
	KPA through
	AFE baseband loopback
	KPA through
	digital baseband loopback

: Resilient , : Not Resilient

This work was supported by the ANR STEALTH project under Grant ANR-17-CE24-0022-01. The work of A. R. Díaz Rizo was supported by the Mexican National Council for Science and Technology (CONACYT) through Fellowship. This article was recommended by Associate Editor D.

DATA 0 16'b0110 1100 0110 M1 DATA 1 16'b0110 1100 1100 M2 DATA 2 16'b0010 1000 0110 M3 DATA 3 16'b0110 1101 0111 M4 DATA 4 16'b0010 1000 1110 M5 DATA 5 16'b0100 0101 0011 M6 DATA 6 16'b0100 0101 0001 M7 DATA 7 16'b1110 1111 1101 M8 DATA 8 16'b0110 1101 0001 M9 DATA 9 16'b0100 0100 0000 M10 DATA 10 16'b1000 0010 0010 M11 DATA 11 16'b1000 0011 1111 M12 DATA 12 16'b0110 1100 1100 Q branch M13 DATA 13 16'b1100 0110 1100 M14 DATA 14 16'b0110 1100 1100 M15 DATA 15 16'b1101 0110 1000 M16 DATA 16 16'b1100 0111 1101 M17 DATA 17 16'b1111 1110 1000 M18 DATA 18 16'b1001 0011 0101 M19 DATA 19 16'b0001 0001 0101 M20 DATA 20 16'b0111 1101 1111 M21 DATA 21 16'b0000 0001 1101 M22 DATA 22 16'b0000 0000 0100 M23 DATA 23 16'b1000 0010 0010 M24 DATA 24 16'b1111 1111 0011 M25 DATA 25 16'b0111 1100 1100