Hardware trojan detection by delay and electromagnetic measurements

Offshore fabrication, assembling and packaging challenge chip security, as original chip designs may be tampered by malicious insertions, known as hardware Trojans (HTs). HT detection is imperative to guarantee the chip performance and safety. Existing HT detection methods have limited capability to detect small-scale HTs and are further challenged by the increased process variation. To increase HT detection sensitivity and reduce chip authorization time, we propose to exploit the inherent feature of differential cascade voltage switch logic (DCVSL) to detect HTs at runtime. In normal operation, a system implemented with DCVSL always produces complementary logic values in internal nets and final outputs. Noncomplementary values on inputs and internal nets in DCVSL systems potentially result in abnormal power behavior and even system failures. By examining special power characteristics of DCVSL systems upon HT insertion, we can detect HTs, even if the HT size is small. Simulation results show that the proposed method achieves up to 100% HT detection rate. The evaluation on ISCAS benchmark circuits shows that the proposed method obtains a HT detection rate in the range of 66% to 98%.

Hardware Trojans (HTs) have become a major threat for the integrated circuit industry and supply chain and have motivated numerous developments of HT detection schemes. Although the side-channel HT detection approach is among the most promising solutions, most of the previous methods require a trusted golden chip reference. Furthermore, detection accuracy is often influenced by environmental noise and process variations. In this article, a novel electromagnetic (EM) side-channel fingerprinting-based HT detection method is proposed. Different from previous methods, the proposed solution eliminates the requirement of a trusted golden fabricated chip. Rather, only the genuine RTL code is required to generate the EM signatures as references. A factor analysis method is utilized to extract the spectral features of the HT trigger’s EM radiation, and then a k -means clustering method is applied for HT detection. Experimentation on two selected sets of Trust-Hub benchmarks has been performed on FPGA platforms, and the results show that the proposed framework can detect all dormant HTs with a high confidence level.

Hardware Trojans (HTs) pose a serious threat to integrated circuit (IC) security. Detection of HTs is extremely challenging due to their stealthy nature. Side-channel analysis techniques have emerged as promising approaches for HT detection by observing anomalies in physical parameters like power or delay. More recently, machine learning (ML) methods have been explored to enhance the accuracy and efficiency of side-channel based HT detection. Background: This paper presents a novel approach using machine learning techniques to detect stealthy hardware Trojans through side-channel analysis. Hardware Trojans, malicious modifications inserted into integrated circuits during manufacturing, pose significant threats to the integrity and security of electronic systems. Traditional methods of detecting these Trojans often rely on known signatures or specific patterns, making them ineffective against subtle and sophisticated attacks. Method: This paper provides a comprehensive review of research advancements in applying ML for side-channel based HT detection. First, an overview of HT attacks, their classification, threat models and detection challenges is presented. Next, various side-channel parameters like power, temperature, delay and electromagnetic emanations used for HT detection are discussed along with their merits and demerits. Furthermore, the application of supervised, unsupervised and semi-supervised ML algorithms for automated feature extraction and intelligent decision making is elucidated in detail. Result: Specifically, the data collection strategies, feature extraction techniques, ML models and performance evaluation metrics adopted in existing literature are critically reviewed. In addition, the limitations of current approaches and promising future research directions like on-chip ML implementation, hierarchical ML and explainable ML models tailored for HT detection are highlighted. Conclusion: Case studies on benchmark circuits are also presented to demonstrate the efficacy of ML-based side-channel HT detection methods. Through an extensive literature review and incisive analysis, this paper provides contemporary insights on the advancement of ML techniques to enable robust side-channel based HT detection for securing next-generation ICs.

This paper proposes Hardware Trojan (HT) placement techniques that yield challenging HT detection benchmarks. We develop three types of one-gate HT benchmarks based on switching power, leakage power, and delay measurements that are commonly used in HT detection. In particular, we employ an iterative searching algorithm to find rarely switching locations, an aging-based approach to create ultra-low power HT, and a backtracking-based reconvergence identification method to determine the non-observable delay paths. The simulation results indicate that our HT attack benchmarks provide the most challenging representative test cases for the evaluation of side-channel based HT detection techniques.

The high cost of integrated circuit chip production has driven more and more chip design companies to use overseas production services. Since the integrated circuit production cannot be closely monitored, the security of integrated circuit chips has become a major concern. Hardware Trojan (HT) insertion is one type of the hardware attack. HTs are extremely stealthy due to their small sizes and low triggering rates. HTs inserted during manufacturing can have minimum impact on the timing and power. In fact, this impact can be smaller than the timing and power variations caused by the process variations. Therefore, these HTs cannot be easily detected using traditional electrical methods. In this article, we propose a novel optical method, where we image the integrated circuit chip from the backside. Our method, can easily detect any replacements, modifications, or rearrangements of fill cells or functional cells for HT insertion. We use a noise-based detection method to achieve high HT detection rates in different testbenches. To further improve the robustness of our method, we strategically place high reflectance fill cells in the designs. Our approach provides high-resolution, nondestructive, and rapid means to detect HTs inserted during fabrication. We evaluate our approach using various hardware blocks where the HTs can occupy less than 0.1% of the total area or consist of fewer than three gates. In addition, we analyze our method with various magnitudes of noise, process variations, detection window sizes, and resolutions.

This work proposes a plausible detection scheme for Hardware Trojan (HT) detection in frequency domain analysis. Due to shrinking technology every node consumes low power values (in the range of $\mu$ W) which are difficult to manipulate for HT detection using conventional methods. The proposed method utilizes the time domain power signals which is converted to frequency domain that represents the implausible signals and analyzed. The precision of HT detection is found to be increased because of the magnified power values in frequency domain. This work uses ISCAS89 bench mark circuits for conducting experiments. In this, the wide range of power values that spans from $695 \mu \mathrm{W}$ to 22.3 $\mu \mathrm{W}$ are observed in frequency domain whereas the respective powers in time domain have narrow span of $2.29 \mu \mathrm{W}$ to 0.783 $\mu \mathrm{W}$ which is unconvincing. This work uses the wide span of power values to identify HT and observed that the mid-band of frequencies have larger footprints than the side bands. These methods intend to help the designers in easy identification of HT even of single gate events.

Over the past decade, Hardware Trojans (HTs) research community has made significant progress towards developing effective countermeasures for various types of HTs, yet these countermeasures are shown to be circumvented by sophisticated HTs designed subsequently. Therefore, instead of guaranteeing a certain (low) false negative rate for a small <i>constant</i> set of publicly known HTs, a rigorous security framework of HTs should provide an effective algorithm to detect any HT from an <i>exponentially large</i> class (exponential in number of wires in IP core) of HTs with negligible false negative rate. In this work, we present HaTCh, the first rigorous algorithm of HT detection within the paradigm of pre-silicon logic testing based tools. HaTCh detects any HT from <inline-formula><tex-math notation="LaTeX">$H_D$</tex-math></inline-formula> , a huge class of deterministic HTs which is orders of magnitude larger than the small subclass (e.g., TrustHub) considered in the current literature. We prove that HaTCh offers negligible false negative rate and controllable false positive rate for the class <inline-formula><tex-math notation="LaTeX">$H_D$</tex-math></inline-formula> . Given certain global characteristics regarding the stealthiness of the HT within <inline-formula><tex-math notation="LaTeX">$H_D$</tex-math></inline-formula> , the computational complexity of HaTCh for practical HTs scales polynomially with the number of wires in the IP core. We implement and test HaTCh on TrustHub and other sophisticated HTs.

With the rapid development of integrated circuit technology, hardware Trojans have attracted widespread attention as a growing threat. Positioned at the hardware level of electronic devices and integrated circuits, hardware Trojans possess concealment and destructiveness, potentially leading to severe security threats. This paper conducts an in-depth exploration of the threats posed by hardware Trojans, including typical and special instances of hardware Trojans. Regarding the detection of hardware Trojans, this paper introduces methods such as destructive and non-destructive detection and explores the application of machine learning in hardware Trojan detection. Additionally, this paper proposes a series of strategies for preventing hardware Trojans, including reinforcement measures for detection and physical security measures, aiming to address the evolving threat of hardware Trojans. Finally, this paper discusses the development trends of hardware Trojans from the perspectives of attackers and defenders. Through comprehensive research and analysis, this paper aims to deepen the understanding of the issue of hardware Trojans and provide robust support for ensuring the security of digital infrastructure.

Recently Hardware Trojan has been widely studied for its threat to IC security. The method based on power side-channel information is an effective one in various Hardware Trojan detection methods proposed at present. However, there is a problem that Hardware Trojan power is difficult to be distinguished and easy to be drowned by the noise if using the power information to recognize Hardware Trojan through direct power difference during detection process. On the base of power component analysis, this paper proposes that we can extract the feature character of power information based on the feature difference between Hardware Trojan power and noise to manifest the power caused by Hardware Trojan. Then it gives out the power feature extraction algorithm and Trojan power identification model. In the experiment, the AES circuit is used as attack carrier embedded into the hardware Trojan circuit, then simulating the power, the results show that the feature extraction algorithm and convergence and divergence identification model can detect Hardware Trojans effectively.

Malicious modification of integrated circuits, referred to as Hardware Trojans, in untrusted fabrication facility has emerged as a major security threat. Logic testing approaches are not very effective for detecting large sequential Trojans which require multiple state transitions often triggered by rare circuit events in order to activate and cause malfunction. On the other hand, side-channel analysis has emerged as an effective approach for detection of such large sequential Trojans. However, existing side-channel approaches suffer from large reduction in detection sensitivity with increasing process variations or decreasing Trojan size. In this paper, we propose TeSR, a Temporal Self-Referencing approach that compares the current signature of a chip at two different time windows to completely eliminate the effect of process noise, thus providing high detection sensitivity for Trojans of varying size. Furthermore, unlike existing approaches, it does not require golden chip instances as a reference. Simulation results for three complex designs and three representative sequential Trojan circuits demonstrate the effectiveness of the approach under large inter- and intra-die process variations.

Hardware Trojans (HTs) are regarded as a security threat in the information society. HTs are unintentionally injected into LSI circuits by untrusted entities before the chip fabrication. HTs trigger malicious operations such as information leakage without designers noticing their operations. This paper proposes fine-grained power domain partitioning, which is a circuit design technique for detecting HT activities. This paper assumes a scenario where a fab injects HTs into the taped-out layout data and that circuit designers test the presence of HTs by using side-channel information (power consumption) of fabricated chips. Fine-grained power domain partitioning decomposes the power domain of target circuit into multiple power domains, enabling to effectively measure the small power consumption introduced by activities of tiny HTs. The measurement result using an HT-injected Advanced Encryption Standard (AES) circuit with fine-grained power domain partitioning shows that HTs can be detected.

Pre-Silicon hardware Trojan detection has been studied for years. The most popular benchmark circuits are from the Trust-Hub. Their common feature is that the probability of activating hardware Trojans is very low. This leads to a series of machine learning based hardware Trojan detection methods which try to find the nets with low signal probability of 0 or 1. On the other hand, it is considered that, if the probability of activating hardware Trojans is high, these hardware Trojans can be easily found through behaviour simulations or during functional test. This paper explores the grey zone between these two opposite scenarios: if the activation probability of a hardware Trojan is not low enough for machine learning to detect it and is not high enough for behaviour simulation or functional test to find it, it can escape from detection. Experiments show the existence of such hardware Trojans, and this paper suggests a new set of hardware Trojan benchmark circuits for future study.

For the problem of Hardware Trojan detection, we analyzed the statistical properties of the power side-channel signal, and proposed a Hardware Trojan(HT) detection method based on the power side-channel signal. We processed the power side-channel signal by the maximum margin criterion(MMC), and projected the power side-channel signal onto low-dimensional subspace. We extract signal's Characteristic vector sequence, and detect Hardware Trojan in IC chip through statistical processing and analysis. We did simulation experiments to verify by Monte Carlo, and detect Hardware Trojan in C7552 circuit. Experimental results show that at ±20% of the process noise we can detect Hardware Trojan that accounts for 0.028 percent of the circuit, and compared with the K-L transform, this method achieved a good experimental result.

Hardware Trojan (HT) has recently drawn much attention in both industry and academia due to the global outsourcing trend in semiconductor manufacturing, where a malicious logic can be inserted into the security critical ICs at almost any stages. HT severity mainly stems from its low-cost and stealthy nature where the HT only functions at a strict condition to purposely alter the logic or physical behavior for leaking secrets. This fact makes HT detection very challenging in practice. In this paper, we propose a novel HT detection technique based on machine learning approach. The described solution is constructed over one-class SVM and is shown to be more robust compared to the template based detection techniques. An unsupervised approach is also applied in our solution for mitigating the golden model dependencies. To evaluate the solution, a practical HT design was inserted into an AES coprocessor implemented in a Xilinx FPGA. Based on the partial reconfiguration, the HT size can be dynamically changed without altering cipher part, which helps to precisely evaluate the HT influence. The experimental results have shown that our proposed detection technique achieve a high performance accuracy.

ABSTRACTThe tremendous advancement in very large scale integration technology encourages chip designers to rely on commercial electronic design automation tools, offshore fabrication services, and outsourced intellectual property cores. As third-party involvement are more in chip design cycle, integrated circuits (IC) such as programmable logic devices (PLD) and application specific ICs (ASIC) are highly vulnerable to hardware Trojan (HT) attacks. HTs are malicious additions or modifications to existing circuit elements, which can be inserted at any stages of IC life cycle to modify/destroy the functionality, reduce reliability, leak sensitive information, etc. Besides, HT can be designed either as always on or triggered only under certain operating conditions. For example, HT attacks in safety critical applications such as nuclear power plant, space and defence will jeopardise the safety and security of the unit and cause serious consequences. Hence, it is most important to ensure that the chip being in use performs only the intended function. In this paper, an in-depth analysis of feasible HT attacks in PLD and ASIC life cycles are presented. Based on the extensive literature survey on HTs and their countermeasure techniques, the state of the art HT prevention, detection, and diagnosis techniques are recommended to the valid stages of PLD and ASIC life cycles. Therefore, incorporating possible HT defence solutions in respective phases of PLD/ASIC-based safety systems thwart them against HT attacks.