Detection of Sequential Trojans in Embedded System Designs Without Scan Chains

~ NJ 07974 Abstract - This paper addresses the problem of simukating transition faults in synchronous sequential circuits. After presenting the concept of the transition fault modell for sequential circuits, we present a fault simulation algorithm for transition faults. The algorithm is a modification of PROOFS, a parallel, differential fault simulation algorithm for stuck faults. A novel fault injection technique is pro- posed. Experimental results show that neither a comprehen- sive functional verification sequence nor a test sequence gen- erated by a sequential circuit test generator for stucck-at faults produces a high fault coverage for transition faults. and finite state machine (FSM) synthesis for delay testabil- ity was adtlressedl. A known reset state is required. The method has limited capability of handling large circuits, because it Icquires the extraction of the complete or partial state transition graph. The approach suggested in 1131 assumes that the circuit is fault-free in the initialization and fault propagation phases. This suggestion is valid if the clock is applied alt a lower speed during the initialization and the fault propagation phases and is applied at a rated speed during the fault activation phase. Slow clock for ini- tialization ,and fault propagation is also assumed in (12). To the author's Icnowledge, no delay-fault simulator €or sequential circuits has been reported before. In this paper, we address the problem of simulating transition faults in sequential circuits. We first enhance the transition fault model for the gate-delay faults and the stuck-open faults in synchronous sequential circuits. We assume the input vectors and clock are applied at speed and at a fixed interval during test application. The primary outputs are: also observed at a fixed interval. We use a transition fault of size n clock cycles to model the defects that cause im extra delay of n clock cycles to a transition. We present a fault simulation algorithm for the proposed fault model. Fault simulation results on the ISCAS-89 sequential benchmark circuits are presented in Section 5.

Malicious modification of integrated circuits, referred to as Hardware Trojans, in untrusted fabrication facility has emerged as a major security threat. Logic testing approaches are not very effective for detecting large sequential Trojans which require multiple state transitions often triggered by rare circuit events in order to activate and cause malfunction. On the other hand, side-channel analysis has emerged as an effective approach for detection of such large sequential Trojans. However, existing side-channel approaches suffer from large reduction in detection sensitivity with increasing process variations or decreasing Trojan size. In this paper, we propose TeSR, a Temporal Self-Referencing approach that compares the current signature of a chip at two different time windows to completely eliminate the effect of process noise, thus providing high detection sensitivity for Trojans of varying size. Furthermore, unlike existing approaches, it does not require golden chip instances as a reference. Simulation results for three complex designs and three representative sequential Trojan circuits demonstrate the effectiveness of the approach under large inter- and intra-die process variations.

Logic circuits in digital electronics can generally be classified two categories-combinational and sequential logic circuits.There are several software-based applications and hardware description languages to describe the structure and behavior of electronic circuits.Although it is an easy to construct a state transition table from the state transition diagram,creating an excitation table according to the memory element type in the sequential circuit design is a very laborious and time-consuming task.After the logic functions extracted from the state transition tables are obtained,logic design verification can be carried out by a conventional simulator.This will require time and persistence much like learning any other skill.Computer science degrees include courses focused mainly on programming languages.There’s a strong case to be made for use of skills acquired in programming courses to shorten the learning curve.Thus, this work has proposed a method for the implementation of the circuit only the state equations of the sequential circuit without dealing with excitation tables.This eliminates the process of constructing the circuit schematically, since it does not require flip-flop selection.In this method, since the state equations can be expressed through buttonbox,checkbox,textbox etc.which are the basic elements of the programming language,the behavior of the circuit can be observed in a very short time.

Hardware Trojans have emerged as a new threat to the security of chip and the reliability of computing systems. As such, methods of determining whether a “security chip” contains hardware Trojans are a research concern. This study proposes power relative variation (PRV) parameters to analysis the relation between test vectors and detection sensitivity. Following a brief introduction into Trojans and detection methods, we present the S-box circuit noise model in AES core and simulate the power tracks of various sizes of hardware Trojans using HSPICE. We also apply different sets of test vectors in 40 nm processing. Experimental results show that the power of the entire circuit is reduced by 41% and the PRV value increased 12.71% and 3.34% at most corresponding to combinational and sequential Trojan circuits. The valid test vectors can enhance the activity of hardware Trojans. They can also limit the noise from process, supply voltage, and temperature and extrude the features from the Trojan circuit to increase PRV value. As a result, a sample amount can be compressed at a reduced cost given a similar detection effect. Hence, the investigation into the influence of test vectors on the detection methods of hardware Trojans based on side-channel analysis is extremely important.

Built-in self-test (BIST) is a key design-for-testability technique for digital systems in nanometre technologies. BIST design is usually quite intrusive. In fact, BIST-per-scan or BIST-per-clock schemes require the replacement of all circuit registers by modified flip-flops or registers with extra functionality, which may lead to unacceptable area overhead and, especially, performance degradation. However, for some applications, system performance cannot be compromised by BIST insertion. Moreover, many applications have multiple clock domains and need to be self-tested at speed, during product lifetime. The functional-oriented mask-based BIST is proposed as a minimum impact BIST design methodology. The proposed approach uses testability metrics and circuit functionality to iteratively obtain a BIST solution with the required fault coverage (FC). It can be implemented in multiple clock domain designs and lead to short BIST sessions and a limited impact on system performance. A real world case study, for which system performance is critical, is used to demonstrate that high FC values in a sequential circuit can be achieved, operating at-speed with multiple clock signals, with minimum performance degradation and with lower hardware overhead than the one obtained with a BIST-per-scan solution. The case study is a two-clock domain Sync core for the Synchronisation and Link Board of electromagnetic calorimeter and hadron calorimeter detectors of the CERN compact Muon solenoid experiment.

The advantage of Evolvable Hardware over the traditional circuit design approach is its capacity for dynamic and autonomous adaptation. EHW can reconfigure its structure according to changes in the task requirement or the environment in which the EHW is embedded. Focuses on the application of extrinsic evolution and their used for the design of small sequential circuits. At the foundation of evolvable hardware, a full-connected feed-forward circuit network model was constructed which is based on the character of sequential circuits. This model is imitating the structure of artificial neural network. It firstly using D flip-latch and logic gate as the basic element, and the one-to-one mapping existed in the mathematical encoding, circuit topology, and HDL file was established. Then, the method to obtain HDL file according to circuit encoding was designed, the circuit evaluation process was automated by using of batch processing technology. Designed the mutation rate dynamic adjust function to improve the performance of (1+λ)-ES. Experiment results of two types of Finite State Machine proved the feasibility and validity of the circuit evolution method.

Scan chain design is a popular design-for-test technique for testing of sequential circuits. Significant amount of power is consumed during loading and unloading of scan chains due to weighted transitions. As the power consumption in the test mode is quite high compared to normal circuit operation, the test power has become the prime concern for current research. Scan chain reordering is widely used method to reduce test power. In this paper, a Hamming distance based distributed reordering for loading and unloading scan chain vector is proposed. This method focuses on how and where weighted transitions occur. In current scenario of VLSI the manufacturing cost and area of transistor is no longer a big issue for current VLSI world. In this context, the proposed method shows promising results in reduction of test power at a cost of area. The experimental results for widely sited ISCAS'89 benchmark circuits are presented to show the effectiveness of the proposed scheme.

In this paper, we adapt the abstraction refinement techniques of Clarke et al. [7] and Gulavani et al. [15] for systematic generation of model based test cases. Formal models are in general infinite state machines. We approximate such a formal model by a more abstract finite state machine. From the finite model, we obtain probable test cases through model checking, and then a guided symbolic execution is performed over the given formal model to check if this is a real test case. In case of failure, the finite abstract model is refined and the cycle is repeated. The two main results of this paper are: (a) better specification coverage is achieved, and (b) we obtain a more accurate coverage estimate. We explain our method by considering models in the specification language B.

PurposeThe purpose of this paper is to test the relationship between objective and subjective sales performance and salespeople’s economic and non-economic satisfaction in a sequential logic model.Design/methodology/approachBased on a questionnaire survey using a deductive approach. A total of 315 companies were ultimately selected for participation in the study, to represent a range of companies from different industries and company sizes in the product-oriented business sector of Norway. A total of 236 questionnaires were returned, generating a response rate of 74.9%.FindingsThe sequential logic of objective and subjective sales performance, in connection with salespeople’s economic and non-economic satisfaction, reveals an underlying structure that can link existing theory and previous studies on sales performance and salesperson satisfaction in business-to-business (B2B) settings.Research limitations/implicationsThe results reported applying only to a B2B setting, to test whether the sequential logic model and mediating effects still hold in such setting. This study is also limited to product-oriented companies in Norway, which offers the opportunity for a future study to verify whether the refined research model also applies to service-oriented companies.Practical implicationsThe results indicate that the constructs of objective and subjective sales performance and salespeoplés economic and non-economic satisfaction are intertwined in a B2B setting. Specifically, these constructs are related to one another sequentially.Originality/valueContributes to structuring in a B2B setting, the relationships between objective and subjective sales performance on the one hand and salespeoplés economic and non-economic satisfaction on the other. It also highlights two mediating effects, namely, subjective sales performance mediates the relationship effect between objective sales performance and salespeoplés economic satisfaction and salespeople economic’s satisfaction mediates the relationship effect between subjective sales performance and salespeople’s non-economic satisfaction.

In this paper we present an algorithm for allocating scan flops to scan chains based on the placement information of flops. The objective of the algorithm is to reduce the scan wire length, the number of level shifters and the number of lockup latches in the scan path. The algorithm uses a novel partitioning based approach to allocate and order the scan flops for a particular scan chain. The scan flops are allocated to a number of partitions. These partitions are then ordered for the scan chains based on the physical location of the scan-in and scan-out pins of the scan chain and the aspect ratio of the layout. To the best of our knowledge this is the first algorithm that explicitly attempts to reduce the number of level shifters in the scan data path. Experimental results obtained for some industrial circuits show that the number of level shifters in the scan data path is halved for some industrial test cases over approaches that are not multiple supply voltage aware. Scan wire lengths too are reduced by up to 45% over previous approaches for the above designs. Additionally we obtain upto 90% scan wire length reductions over previous approaches [4],[11] for some ISCAS- 89 benchmark circuits.

Design of sequential circuits by quantum-dot cellular automata

Combinational and sequential locking methods are promising solutions for protecting hardware intellectual property (IP) from piracy, reverse engineering, and malicious modifications by locking the functionality of the IP based on a secret key. To improve their security, researchers are developing attack methods to extract the secret key. While the attacks on combinational locking are mostly inapplicable for sequential designs without access to the scan chain, the limited applicable attacks are generally evaluated against the basic random insertion of key gates. On the other hand, attacks on sequential locking techniques suffer from scalability issues and evaluation of improperly locked designs. Finally, while most attacks provide an approximately correct key, they do not indicate which specific key bits are undetermined. This paper proposes an oracle-guided attack that applies to both combinational and sequential locking without scan chain access. The attack applies light-weight design modifications that represent the oracle using a finite state machine and applies an assertion-based query of the unlocking key. We have analyzed the effectiveness of our attack against 46 sequential designs locked with various classes of combinational locking including random, strong, logic cone-based, and anti-SAT based. We further evaluated against a sequential locking technique using 46 designs with various key sequence lengths and widths. Finally, we expand our framework to identify undetermined key bits, enabling complementary attacks on the smaller remaining key space.

BackgroundCellular signaling involves a sequence of events from ligand binding to membrane receptors through transcription factors activation and the induction of mRNA expression. The transcriptional-regulatory system plays a pivotal role in the control of gene expression. A novel computational approach to the study of gene regulation circuits is presented here.MethodologyBased on the concept of finite state machine, which provides a discrete view of gene regulation, a novel sequential logic model (SLM) is developed to decipher control mechanisms of dynamic transcriptional regulation of gene expressions. The SLM technique is also used to systematically analyze the dynamic function of transcriptional inputs, the dependency and cooperativity, such as synergy effect, among the binding sites with respect to when, how much and how fast the gene of interest is expressed.Principal FindingsSLM is verified by a set of well studied expression data on endo16 of Strongylocentrotus purpuratus (sea urchin) during the embryonic midgut development. A dynamic regulatory mechanism for endo16 expression controlled by three binding sites, UI, R and Otx is identified and demonstrated to be consistent with experimental findings. Furthermore, we show that during transition from specification to differentiation in wild type endo16 expression profile, SLM reveals three binary activities are not sufficient to explain the transcriptional regulation of endo16 expression and additional activities of binding sites are required. Further analyses suggest detailed mechanism of R switch activity where indirect dependency occurs in between UI activity and R switch during specification to differentiation stage.Conclusions/SignificanceThe sequential logic formalism allows for a simplification of regulation network dynamics going from a continuous to a discrete representation of gene activation in time. In effect our SLM is non-parametric and model-independent, yet providing rich biological insight. The demonstration of the efficacy of this approach in endo16 is a promising step for further application of the proposed method.

Support of fast lookup of content addresses in IPv6 domains is an important feature for next generation network processing engines. While IPv6 forwarding and IPv6 transition microblocks may simplify the engineering efforts needed to support next generation routing solutions, there must be an efficient and fast mechanism for processing IPv6 headers prior to this. In this paper, we try to develop an IPv6 protocol processing engine based on sequential predicate logic invocations. The design, based on abstract state machines (ASM) logic, shows how the design features may help in resolving scalability issues for large scale IPv6 routing. The novelty of the approach lies in the formal predicate logic definition and synthesis of processing hardware and generation of physical design unit from the data-driven algorithm function computation at compile time

Machine learning techniques have the capability to explore high-dimensional feature space and find patterns that are not intuitive for analytic approaches. It is natural to apply these techniques for hardware Trojan detection to distinguish Trojan-infected designs from good designs. Almost in all aspects of hardware Trojan detection, we can tune machine learning for hardware Trojan detection. For logic testing, machine learning can help generate test vectors that are more likely to have Trojans triggered or partially activated. For side-channel analysis, machine learning can build the pattern of side-channel fingerprints of normal circuits and any outlier will be a Trojan circuit. For approaches based on structural or functional analysis, we can extract the structural or functional properties as features and train machine learning for classification. For runtime Trojan detection or monitoring, machine learning can help as long as we can extract the runtime behavior into features and train the model properly. This chapter discusses some of the successful cases of using machine learning in these aspects to inspire readers for more research in this exciting research domain.