Hardware Trojan attacks on voltage scaling‐based side‐channel attack countermeasure

ABSTRACTThe tremendous advancement in very large scale integration technology encourages chip designers to rely on commercial electronic design automation tools, offshore fabrication services, and outsourced intellectual property cores. As third-party involvement are more in chip design cycle, integrated circuits (IC) such as programmable logic devices (PLD) and application specific ICs (ASIC) are highly vulnerable to hardware Trojan (HT) attacks. HTs are malicious additions or modifications to existing circuit elements, which can be inserted at any stages of IC life cycle to modify/destroy the functionality, reduce reliability, leak sensitive information, etc. Besides, HT can be designed either as always on or triggered only under certain operating conditions. For example, HT attacks in safety critical applications such as nuclear power plant, space and defence will jeopardise the safety and security of the unit and cause serious consequences. Hence, it is most important to ensure that the chip being in use performs only the intended function. In this paper, an in-depth analysis of feasible HT attacks in PLD and ASIC life cycles are presented. Based on the extensive literature survey on HTs and their countermeasure techniques, the state of the art HT prevention, detection, and diagnosis techniques are recommended to the valid stages of PLD and ASIC life cycles. Therefore, incorporating possible HT defence solutions in respective phases of PLD/ASIC-based safety systems thwart them against HT attacks.

Hardware Trojan detection techniques have been studied extensively. However, to develop reliable and effective defenses, it is important to figure out how hardware Trojans are implemented in practical scenarios. The authors attempt to make a review of the hardware Trojan design and implementations in the last decade and also provide an outlook. Unlike all previous surveys that discuss Trojans from the defender's perspective, for the first time, the authors study the Trojans from the attacker's perspective, focusing on the attacker's methods, capabilities, and challenges when the attacker designs and implements a hardware Trojan. First, the authors present adversarial models in terms of the adversary's methods, adversary's capabilities, and adversary's challenges in seven practical hardware Trojan implementation scenarios: in‐house design team attacks, third‐party intellectual property vendor attacks, computer‐aided design tools attacks, fabrication stage attacks, testing stage attacks, distribution stage attacks, and field‐programmable gate array Trojan attacks. Second, the authors analyse the hardware Trojan implementation methods under each adversarial model in terms of seven aspects/metrics: hardware Trojan attack scenarios, the attacker's motivation, feasibility, detectability (anti‐detection capability), protection and prevention suggestions for the designer, overhead analysis, and case studies of Trojan implementations. Finally, future directions on hardware Trojan attacks and defenses are also discussed.

Traditionally, Hardware is considered as root of trust. Software generally builds on top of the hardware. By emerging Hardware Trojan attacks, this trust seems to be violated. Hardware Trojan is any addition or modification to a circuit or a system with malicious intention. Trojan can cause change or control over functionality in circuit or it may leak sensitive information from inside the chip and hence reduce circuit reliability. In this paper, we analyze threats caused by hardware Trojan attacks and type of hardware Trojans. We have discussed state-of-art hardware Trojan protection schemes. The limitations and challenges related to those trojan detection schemes are described. We also propose simple but effective probabilistic method to detect and find the location of hardware trojan in combinational circuits. The experimental results for a series of ISCAS85 benchmark circuits show that better trojan detection rate or coverage can be achieved with proposed technique.

Hardware Trojans (HTs) can be implanted in security-weak parts of a chip with various means to steal the internal sensitive data or modify original functionality, which may lead to huge economic losses and great harm to society. Therefore, it is very important to perform hardware Trojan detection and diagnosis, find potential safety hazards and apply protection techniques in the whole IC design cycle, in order to enhance the security of chips. In this paper, we elaborate an IC market model, and describe the potential HT threats faced by the parties involved in the model. Then we survey the recent research advances in the countermeasures against HT attacks, which are classified into HT detection, diagnosis and prevention. Finally, the challenges and prospects for HT defense are illuminated.

Malicious Hardware Trojans can corrupt data which if undetected may cause serious harm. We propose a technique where characteristics of the data itself are used to detect Hardware Trojan (HT) attacks. In particular, we use a two-chip approach where we generate a data in analog and test for the signature in a partially reconfigurable digital microchip where the HT may attack. This paper presents an overall signature-based HT detection architecture and case study for cardiovascular signals used in medical device technology. Our results show that with minimal performance and area overhead, the proposed architecture is able to detect HT attacks on primary data inputs as well as on multiple modules of the design.

Hardware Trojan detection via rewriting logic

Security in embedded systems is considered to be more important and needs to be a diagnosis for every minute. Also with the advent of the Internet of Things (IoT), security in the embedded system has reached its new peak of dimension. A Mathematically secure algorithm was formulated and runs on the cryptographic chips which are embedded in the systems, but secret keys can be at risk and even information can be retrieved by the prominent side-channel attacks. Fixed encryption keys, non-intelligent detection of side-channel attacks are some of the real-time challenges in an existing system of encryption. Following the limitations of existing systems, this research article focuses on the integration of powerful machine learning algorithms by retrieving the secret key information with countermeasures methodology using the chaotic logistic maps and includes the following contributions: (a) Preparation of Data Sets from the Power consumption traces captured from ARTIX-7 FPGA boards while running the Elliptical Curve Cryptography(ECC) on it (b) Implementation of High Speed and High Accurate Single feed-forward learning machines for the detection and classification of side-channel attacks (c) Design of Chaotic Countermeasures using 3-Dlogistic maps for attacked bits. The test_bed has been developed using the integration of FPGA along with Cortex-A57 architectures for experimentation of the proposed work and various evaluation parameters such as Accuracy, F-calls, Precision rates, sensitivity, and correlation co-efficient, entropy were calculated and analyzed. Moreover, the parameters of the proposed system which has been analyzed prove to outperform the other existing algorithms in terms of performance and detection.

Malicious hardware modification, also known as hardware Trojan attack, has emerged as a serious security concern for electronic systems. Such attacks compromise the basic premise of hardware root of trust. Over the past decade, significant research efforts have been directed to carefully analyze the trust issues arising from hardware Trojans and to protect against them. This vast body of work often needs to rely on well-defined set of trust benchmarks that can reliably evaluate the effectiveness of the protection methods. In recent past, efforts have been made to develop a benchmark suite to analyze the effectiveness of pre-silicon Trojan detection and prevention methodologies. However, there are only a limited number of Trojan inserted benchmarks available. Moreover, there is an inherent bias as the researcher is aware of Trojan properties such as location and trigger condition since the current benchmarks are static. In order to create an unbiased and robust benchmark suite to evaluate the effectiveness of any protection technique, we have developed a comprehensive framework of automatic hardware Trojan insertion. Given a netlist, the framework will automatically generate a design with single or multiple Trojan instances based user-specified Trojan properties. It allows a wide variety of configurations, such as the type of Trojan, Trojan activation probability, number of triggers, and choice of payload. The tool ensures that the inserted Trojan is a valid one and allow for provisions to optimize the Trojan footprint (area and switching). Experiments demonstrate that a state-of-the-art Trojan detection technique provides poor efficacy when using benchmarks generated by our tool. This tool is available for download from http://www.trust-hub.org/.

In recent years, Hardware Trojans (HT)have become an increasing concern due to outsourcing the manufacturing of Implantable Medical Devices (IMDs). Power Analysis based Side-Channel Attack (SCA)is one of the main methods of detecting HT in IMDs. However, using SCA in detecting trojans is limited by the large process variation effects in IC technology which has reduced detection sensitivity of ultra-small trojans. Along with the safety of IMDs against HTs, the need for power management has also risen in parallel with the increasing complexity of IMDs. In this paper, we are analyzing the usefulness of Differential Power Analysis (DPA)resistant adiabatic logic gates to detect smaller trojans. DPA resistant adiabatic logic gates consume uniform power irrespective of input data transition and also consume lower power compared to conventional CMOS logic gates. When the HT is triggered in the DPA resistant circuits, the circuit will have non-uniform power consumption which will help us to easily identify HTs. In order to validate our proposed methodology, we have implemented a C17 and a carry save adder using a recently proposed DPA resistant adiabatic logic family called Energy-Efficient Secure Positive Feedback Adiabatic Logic Family (EE-SPFAL). Further, in order to calculate the true energy-efficiency of the EE-SPFAL logic, we have proposed a four phase Power Clock Generator (PCG)and integrated with the EE-SPFAL logic circuits. Simulations are performed in Cadence Spectre using 180nm CMOS technology. From our simulations, we have observed the non-uniform power consumption, during the activation of HT, in EE-SPFAL based C17 and carry save adder circuit. Further, EE-SPFAL based C17 and carry save adder along with its PCG consume 25.8% and 31.4% of less power as compared to the conventional CMOS based C17 and carry save adder respectively.

With the globalization of the manufacturing supply chain, the malicious modification existing in the middle of distrust is becoming an important security issue on the chip. These modifications are called hardware Trojan (HT). HT is difficult to detect due to its high concealment and diversity of implementation. HT detection based on the side channel is a relatively effective detection method because it does not need to trigger the Trojan or destroy the chip. However, detection based on the side channel faces two major challenges. Firstly, the side channel detection is quite dependent on the golden model. The second one relates to the accuracy of the samples. Side channel information of the chip comes from the hardware manufacturing process and implementation, so it is obviously affected by process variation. In the existing work, many self-reference detection methods have been proposed to solve the problem of missing golden models. However, the existing methods often have special requirements for the circuit structure (such as the need for self-similar structures in the circuit). And, they can hardly resist process variation. This paper combines design and detection. We select the power consumption generated at different times and construct two self-reference ‘knapsack’ to detect HT. The solution proposed in this article is a kind of self-reference method, but we need neither self-similar structures nor the same state of some clocks in the circuit. Meanwhile, by constructing the ‘knapsack,’ we reduce the impact of process variation on detection accuracy because the process variation in the two sets of power consumption is balanced.

As recently studied, field-programmable gate arrays (FPGAs) suffer from growing Hardware Trojan (HT) attacks, and many techniques, e.g., register-transfer level (RTL) code-based analyzing, have been presented to detect HTs on FPGAs. However, for most of the FPGA end users, they can only obtain bitstream, rather than the RTL code. Therefore, we present a new FPGA reverse engineering tool-chain. It can precisely transform the FPGA bitstream to an RTL code and therefore assists in HT detection. In detail, we first construct an integrated database involving the FPGA architecture information and the bitstream mapping information. Then, we build two tools, namely, bitstream reversal tool (BRT) and netlist reversal tool (NRT). They can be combined together to retrieve the RTL code from the FPGA bitstream in moderate time. To demonstrate the effectiveness of our tool-chain, we evaluate it qualitatively and quantitatively by using two benchmarks (ISCAS'85 and ISCAS'89) and three real applications (8051 core, 68HC08, and AES). Our tool-chain is comprehensive since it covers all the reverse engineering stages, from bitstream to netlist and from netlist to code, without any support from other tools. Moreover, it rebuilds the netlist with a 100% correct rate and retrieves RTL code, which is exactly, functionally equivalent to the original one for all our benchmarks. To the best of our knowledge, it is the first tool that can perform integrated, precise reverse engineering for FPGAs, paving the way for the netlist-/code-based HT detection.

Fine-grained power estimation is fundamental to modern MPSoC design and operation, enabling early power and thermal budgeting before fabrication, predictive thermal control at runtime, post-silicon microarchitectural energy debugging, and hardware security analysis. Existing System-on-Chip (SoC) designs often rely solely on total power consumption measurements because of the cost, size, and complexity of power sensors. However, the lack of precision and granularity in power measurements leads to inefficient power and thermal management and limits the ability to detect failed or compromised sensors. To tackle these challenges, we propose the Improved Clustering Blind Power Identification (ICBPI) approach, an innovative approach for fine-grained power estimation in SoCs. ICBPI leverages total power measurements and per-unit temperature data, even with potentially unreliable sensors, to deliver accurate per-unit power estimates. This dual focus not only enhances power estimation, leading to better power management decisions, but also improves the detection of malicious sensors—such as those compromised by hardware Trojan attacks—that manipulate sensor data to induce potential system failures. Extensive evaluations across four SoC architectures demonstrate ICBPI’s superior performance in reducing per-core power estimation errors by \({77.56\%} \) compared to the baseline Blind Power Identification (BPI) and by \({68.44\%} \) compared to the state-of-the-art approaches. Furthermore, ICBPI achieves \({100\%} \) detection of malicious thermal sensor attacks and enhances the localization process compared to the Blind Identification Countermeasure (BIC) approach. In the comparative analysis between ICBPI and the most recent model, Alternating Blind Power Identification (ABPI), ICBPI shows error rates as low as \({0.5\%} \) compared to \({2.8\%} \) in a 2 × 2 mesh benchmark and outperforms ABPI on heterogeneous architectures. The NVIDIA Jetson Xavier AGX development board serves as a platform for validating ICBPI. Consequently, ICBPI demonstrates an approximate reduction in average error of \(79.71\% \) on the CPU and \(79.59\% \) on the GPU relative to three existing state-of-the-art approaches.

True Random Number Generator (TRNG) circuits are important components of cryptographic systems. Lack of statistical randomness in the generated bitstreams from a TRNG can result in compromised keys, leading to serious security breaches. In this paper, we describe a Hardware Trojan Horse (HTH)-based attack on the TRNG of an FPGA-based cryptosystem, that results in reduced entropy and increased predictability of the generated keys. The proposed HTH does not cause any functional failure in the cryptosystem, and its impact is undetectable by analysis of the compromised bitstream using standard statistical randomness testing software suites (NIST, two enhanced versions of NIST Dieharder, and LIL-tests), and by a circuit-level HTH detection technique using Transition Effect Ring Oscillator (TERO). Finally, we show that the impact of the HTH can be detected by applying Wavelet Transform on the compromised bitstream.

Security of a computer system has been traditionally related to the security of the software or the information being processed. The underlying hardware used for information processing has been considered trusted. The emergence of hardware Trojan attacks violates this root of trust. These attacks, in the form of malicious modifications of electronic hardware at different stages of its life cycle, pose major security concerns in the electronics industry. An adversary can mount such an attack with an objective to cause operational failure or to leak secret information from inside a chip-e.g., the key in a cryptographic chip, during field operation. Global economic trend that encourages increased reliance on untrusted entities in the hardware design and fabrication process is rapidly enhancing the vulnerability to such attacks. In this paper, we analyze the threat of hardware Trojan attacks; present attack models, types, and scenarios; discuss different forms of protection approaches, both proactive and reactive; and describe emerging attack modes, defenses, and future research pathways.

We report our experiences in designing and implementing several hardware Trojans within the framework of the Embedded System Challenge competition that was held as part of the Cyber Security Awareness Week (CSAW) at the Polytechnic Institute of New York University in October 2008. Due to the globalization of the Integrated Circuit (IC) manufacturing industry, hardware Trojans constitute an increasingly probable threat to both commercial and military applications. With traditional testing methods falling short in the quest of finding hardware Trojans, several specialized detection methods have surfaced. To facilitate research in this area, a better understanding of what Hardware Trojans would look like and what impact they would incur to an IC is required. To this end, we present eight distinct attack techniques employing Register Transfer Level (RTL) hardware Trojans to compromise the security of an Alpha encryption module implemented on a Digilent BASYS Spartan-3 FPGA board. Our work, which earned second place in the aforementioned competition, demonstrates that current RTL designs are, indeed, quite vulnerable to hardware Trojan attacks.