Hardware Trojan detection via rewriting logic

ABSTRACTThe tremendous advancement in very large scale integration technology encourages chip designers to rely on commercial electronic design automation tools, offshore fabrication services, and outsourced intellectual property cores. As third-party involvement are more in chip design cycle, integrated circuits (IC) such as programmable logic devices (PLD) and application specific ICs (ASIC) are highly vulnerable to hardware Trojan (HT) attacks. HTs are malicious additions or modifications to existing circuit elements, which can be inserted at any stages of IC life cycle to modify/destroy the functionality, reduce reliability, leak sensitive information, etc. Besides, HT can be designed either as always on or triggered only under certain operating conditions. For example, HT attacks in safety critical applications such as nuclear power plant, space and defence will jeopardise the safety and security of the unit and cause serious consequences. Hence, it is most important to ensure that the chip being in use performs only the intended function. In this paper, an in-depth analysis of feasible HT attacks in PLD and ASIC life cycles are presented. Based on the extensive literature survey on HTs and their countermeasure techniques, the state of the art HT prevention, detection, and diagnosis techniques are recommended to the valid stages of PLD and ASIC life cycles. Therefore, incorporating possible HT defence solutions in respective phases of PLD/ASIC-based safety systems thwart them against HT attacks.

Hardware Trojans (HTs) pose a serious threat to integrated circuit (IC) security. Detection of HTs is extremely challenging due to their stealthy nature. Side-channel analysis techniques have emerged as promising approaches for HT detection by observing anomalies in physical parameters like power or delay. More recently, machine learning (ML) methods have been explored to enhance the accuracy and efficiency of side-channel based HT detection. Background: This paper presents a novel approach using machine learning techniques to detect stealthy hardware Trojans through side-channel analysis. Hardware Trojans, malicious modifications inserted into integrated circuits during manufacturing, pose significant threats to the integrity and security of electronic systems. Traditional methods of detecting these Trojans often rely on known signatures or specific patterns, making them ineffective against subtle and sophisticated attacks. Method: This paper provides a comprehensive review of research advancements in applying ML for side-channel based HT detection. First, an overview of HT attacks, their classification, threat models and detection challenges is presented. Next, various side-channel parameters like power, temperature, delay and electromagnetic emanations used for HT detection are discussed along with their merits and demerits. Furthermore, the application of supervised, unsupervised and semi-supervised ML algorithms for automated feature extraction and intelligent decision making is elucidated in detail. Result: Specifically, the data collection strategies, feature extraction techniques, ML models and performance evaluation metrics adopted in existing literature are critically reviewed. In addition, the limitations of current approaches and promising future research directions like on-chip ML implementation, hierarchical ML and explainable ML models tailored for HT detection are highlighted. Conclusion: Case studies on benchmark circuits are also presented to demonstrate the efficacy of ML-based side-channel HT detection methods. Through an extensive literature review and incisive analysis, this paper provides contemporary insights on the advancement of ML techniques to enable robust side-channel based HT detection for securing next-generation ICs.

Hardware Trojans (HTs) can be implanted in security-weak parts of a chip with various means to steal the internal sensitive data or modify original functionality, which may lead to huge economic losses and great harm to society. Therefore, it is very important to perform hardware Trojan detection and diagnosis, find potential safety hazards and apply protection techniques in the whole IC design cycle, in order to enhance the security of chips. In this paper, we elaborate an IC market model, and describe the potential HT threats faced by the parties involved in the model. Then we survey the recent research advances in the countermeasures against HT attacks, which are classified into HT detection, diagnosis and prevention. Finally, the challenges and prospects for HT defense are illuminated.

Offshore fabrication, assembling and packaging challenge chip security, as original chip designs may be tampered by malicious insertions, known as hardware Trojans (HTs). HT detection is imperative to guarantee the chip performance and safety. Existing HT detection methods have limited capability to detect small-scale HTs and are further challenged by the increased process variation. To increase HT detection sensitivity and reduce chip authorization time, we propose to exploit the inherent feature of differential cascade voltage switch logic (DCVSL) to detect HTs at runtime. In normal operation, a system implemented with DCVSL always produces complementary logic values in internal nets and final outputs. Noncomplementary values on inputs and internal nets in DCVSL systems potentially result in abnormal power behavior and even system failures. By examining special power characteristics of DCVSL systems upon HT insertion, we can detect HTs, even if the HT size is small. Simulation results show that the proposed method achieves up to 100% HT detection rate. The evaluation on ISCAS benchmark circuits shows that the proposed method obtains a HT detection rate in the range of 66% to 98%.

Traditionally, Hardware is considered as root of trust. Software generally builds on top of the hardware. By emerging Hardware Trojan attacks, this trust seems to be violated. Hardware Trojan is any addition or modification to a circuit or a system with malicious intention. Trojan can cause change or control over functionality in circuit or it may leak sensitive information from inside the chip and hence reduce circuit reliability. In this paper, we analyze threats caused by hardware Trojan attacks and type of hardware Trojans. We have discussed state-of-art hardware Trojan protection schemes. The limitations and challenges related to those trojan detection schemes are described. We also propose simple but effective probabilistic method to detect and find the location of hardware trojan in combinational circuits. The experimental results for a series of ISCAS85 benchmark circuits show that better trojan detection rate or coverage can be achieved with proposed technique.

Hardware Trojans (HTs) are regarded as a security threat in the information society. HTs are unintentionally injected into LSI circuits by untrusted entities before the chip fabrication. HTs trigger malicious operations such as information leakage without designers noticing their operations. This paper proposes fine-grained power domain partitioning, which is a circuit design technique for detecting HT activities. This paper assumes a scenario where a fab injects HTs into the taped-out layout data and that circuit designers test the presence of HTs by using side-channel information (power consumption) of fabricated chips. Fine-grained power domain partitioning decomposes the power domain of target circuit into multiple power domains, enabling to effectively measure the small power consumption introduced by activities of tiny HTs. The measurement result using an HT-injected Advanced Encryption Standard (AES) circuit with fine-grained power domain partitioning shows that HTs can be detected.

Hardware Trojans (HTs) are one of the emerging malicious hardware modification attacks that have become a critical threat to the integrity, reliability, security, and trustworthiness of integrated circuits (ICs) applications. These deliberately hidden malicious entities can be inserted into the IC during manufacturing or design, potentially leading to the leakage of secret information or the deactivation or destruction of the entire system that relies on the IC hardware chips. Localizing and detecting hardware Trojans is becoming increasingly challenging as these threats are deeply embedded and electronic systems continue to grow in complexity. Traditional methods, including physical inspections and functional testing, are increasingly inadequate. They are limited in scope and often fall short when confronted with the advanced designs of modern hardware Trojans.This study aims to improve the identification of hardware Trojans (HTs) in integrated circuits by using advanced machine learning algorithms with a unique dataset of power side-channel signals. Various machine learning techniques, such as Support Vector Machines (SVM), neural networks, and decision trees, are applied to classify and identify HTs accurately. This method combines comprehensive feature extraction and model validation to provide high accuracy and reliability in HT identification. This research makes significant contributions to cybersecurity by providing improved techniques for detecting minor anomalies associated with HTs using advanced machine learning algorithms. The results show potential advances in securing electronic systems against these hidden threats, highlighting the practical significance and necessity of our work in maintaining a wide range of applications from consumer electronics to national infrastructure.

Hardware Trojan detection techniques have been studied extensively. However, to develop reliable and effective defenses, it is important to figure out how hardware Trojans are implemented in practical scenarios. The authors attempt to make a review of the hardware Trojan design and implementations in the last decade and also provide an outlook. Unlike all previous surveys that discuss Trojans from the defender's perspective, for the first time, the authors study the Trojans from the attacker's perspective, focusing on the attacker's methods, capabilities, and challenges when the attacker designs and implements a hardware Trojan. First, the authors present adversarial models in terms of the adversary's methods, adversary's capabilities, and adversary's challenges in seven practical hardware Trojan implementation scenarios: in‐house design team attacks, third‐party intellectual property vendor attacks, computer‐aided design tools attacks, fabrication stage attacks, testing stage attacks, distribution stage attacks, and field‐programmable gate array Trojan attacks. Second, the authors analyse the hardware Trojan implementation methods under each adversarial model in terms of seven aspects/metrics: hardware Trojan attack scenarios, the attacker's motivation, feasibility, detectability (anti‐detection capability), protection and prevention suggestions for the designer, overhead analysis, and case studies of Trojan implementations. Finally, future directions on hardware Trojan attacks and defenses are also discussed.

This paper proposes Hardware Trojan (HT) placement techniques that yield challenging HT detection benchmarks. We develop three types of one-gate HT benchmarks based on switching power, leakage power, and delay measurements that are commonly used in HT detection. In particular, we employ an iterative searching algorithm to find rarely switching locations, an aging-based approach to create ultra-low power HT, and a backtracking-based reconvergence identification method to determine the non-observable delay paths. The simulation results indicate that our HT attack benchmarks provide the most challenging representative test cases for the evaluation of side-channel based HT detection techniques.

This work proposes a plausible detection scheme for Hardware Trojan (HT) detection in frequency domain analysis. Due to shrinking technology every node consumes low power values (in the range of $\mu$ W) which are difficult to manipulate for HT detection using conventional methods. The proposed method utilizes the time domain power signals which is converted to frequency domain that represents the implausible signals and analyzed. The precision of HT detection is found to be increased because of the magnified power values in frequency domain. This work uses ISCAS89 bench mark circuits for conducting experiments. In this, the wide range of power values that spans from $695 \mu \mathrm{W}$ to 22.3 $\mu \mathrm{W}$ are observed in frequency domain whereas the respective powers in time domain have narrow span of $2.29 \mu \mathrm{W}$ to 0.783 $\mu \mathrm{W}$ which is unconvincing. This work uses the wide span of power values to identify HT and observed that the mid-band of frequencies have larger footprints than the side bands. These methods intend to help the designers in easy identification of HT even of single gate events.

Over the past decade, Hardware Trojans (HTs) research community has made significant progress towards developing effective countermeasures for various types of HTs, yet these countermeasures are shown to be circumvented by sophisticated HTs designed subsequently. Therefore, instead of guaranteeing a certain (low) false negative rate for a small <i>constant</i> set of publicly known HTs, a rigorous security framework of HTs should provide an effective algorithm to detect any HT from an <i>exponentially large</i> class (exponential in number of wires in IP core) of HTs with negligible false negative rate. In this work, we present HaTCh, the first rigorous algorithm of HT detection within the paradigm of pre-silicon logic testing based tools. HaTCh detects any HT from <inline-formula><tex-math notation="LaTeX">$H_D$</tex-math></inline-formula> , a huge class of deterministic HTs which is orders of magnitude larger than the small subclass (e.g., TrustHub) considered in the current literature. We prove that HaTCh offers negligible false negative rate and controllable false positive rate for the class <inline-formula><tex-math notation="LaTeX">$H_D$</tex-math></inline-formula> . Given certain global characteristics regarding the stealthiness of the HT within <inline-formula><tex-math notation="LaTeX">$H_D$</tex-math></inline-formula> , the computational complexity of HaTCh for practical HTs scales polynomially with the number of wires in the IP core. We implement and test HaTCh on TrustHub and other sophisticated HTs.

With the rapid development of integrated circuit technology, hardware Trojans have attracted widespread attention as a growing threat. Positioned at the hardware level of electronic devices and integrated circuits, hardware Trojans possess concealment and destructiveness, potentially leading to severe security threats. This paper conducts an in-depth exploration of the threats posed by hardware Trojans, including typical and special instances of hardware Trojans. Regarding the detection of hardware Trojans, this paper introduces methods such as destructive and non-destructive detection and explores the application of machine learning in hardware Trojan detection. Additionally, this paper proposes a series of strategies for preventing hardware Trojans, including reinforcement measures for detection and physical security measures, aiming to address the evolving threat of hardware Trojans. Finally, this paper discusses the development trends of hardware Trojans from the perspectives of attackers and defenders. Through comprehensive research and analysis, this paper aims to deepen the understanding of the issue of hardware Trojans and provide robust support for ensuring the security of digital infrastructure.

Recently Hardware Trojan has been widely studied for its threat to IC security. The method based on power side-channel information is an effective one in various Hardware Trojan detection methods proposed at present. However, there is a problem that Hardware Trojan power is difficult to be distinguished and easy to be drowned by the noise if using the power information to recognize Hardware Trojan through direct power difference during detection process. On the base of power component analysis, this paper proposes that we can extract the feature character of power information based on the feature difference between Hardware Trojan power and noise to manifest the power caused by Hardware Trojan. Then it gives out the power feature extraction algorithm and Trojan power identification model. In the experiment, the AES circuit is used as attack carrier embedded into the hardware Trojan circuit, then simulating the power, the results show that the feature extraction algorithm and convergence and divergence identification model can detect Hardware Trojans effectively.

As recently studied, field-programmable gate arrays (FPGAs) suffer from growing Hardware Trojan (HT) attacks, and many techniques, e.g., register-transfer level (RTL) code-based analyzing, have been presented to detect HTs on FPGAs. However, for most of the FPGA end users, they can only obtain bitstream, rather than the RTL code. Therefore, we present a new FPGA reverse engineering tool-chain. It can precisely transform the FPGA bitstream to an RTL code and therefore assists in HT detection. In detail, we first construct an integrated database involving the FPGA architecture information and the bitstream mapping information. Then, we build two tools, namely, bitstream reversal tool (BRT) and netlist reversal tool (NRT). They can be combined together to retrieve the RTL code from the FPGA bitstream in moderate time. To demonstrate the effectiveness of our tool-chain, we evaluate it qualitatively and quantitatively by using two benchmarks (ISCAS'85 and ISCAS'89) and three real applications (8051 core, 68HC08, and AES). Our tool-chain is comprehensive since it covers all the reverse engineering stages, from bitstream to netlist and from netlist to code, without any support from other tools. Moreover, it rebuilds the netlist with a 100% correct rate and retrieves RTL code, which is exactly, functionally equivalent to the original one for all our benchmarks. To the best of our knowledge, it is the first tool that can perform integrated, precise reverse engineering for FPGAs, paving the way for the netlist-/code-based HT detection.

With the growing complexities of modern SoC designs and increasingly shortened time-to-market requirements, new design paradigms such as outsourced design services have emerged. Design abstraction level has also been raised from RTL to ESL. Modern SoC designs in ESL often integrate a variety of third-party behavioral intellectual properties, as well as intensively utilizing EDA tools to improve design productivity. However, this new design trend makes modern SoCs more vulnerable to hardware Trojan attacks. Although hardware Trojan detection has been studied for more than a decade in RTL and lower levels, it has only recently gained attention in ESL designs. In this paper, we present a novel approach for generating test cases by selective concolic testing to detect hardware Trojans in ESL. We have evaluated our approach on an open source benchmark that includes various types of hardware Trojans. The experimental results demonstrate that our approach is able to detect hardware Trojans effectively and efficiently.