Hardware Trojans and Smart Manufacturing – A Hardware Security Perspective

Through the Internet of Things (IoT), everything is connected remotely through a network, allowing smart environments to be created. The IoT will play a central role in every aspect of our daily lives, from toys to healthcare. The security of IoT devices is the most crucial concern. In this chapter, we will discuss hardware vulnerabilities in IoT devices that pose major threats to data transfer. Researchers focus on finding the major vulnerabilities and limitations of proposed countermeasures for IoT devices’ hardware security issues. Modern electronic hardware used in IoT systems consists mostly of interconnected integrated circuits, so hardware security directly affects integrated circuit security. Malicious modifications to integrated circuits are carried out in untrusted fabrication units by Hardware Trojans. Since these Hardware Trojans are stealthy, most of the detection schemes require a gold chip for measuring the side channels. In the existing Trojan detection schemes, false-positive and false-negative detections are possible because of process variation. As a result, this chapter provides an overview of the hardware security challenges with Hardware Trojans associated with IoT devices used in smart environments.

ABSTRACTThe tremendous advancement in very large scale integration technology encourages chip designers to rely on commercial electronic design automation tools, offshore fabrication services, and outsourced intellectual property cores. As third-party involvement are more in chip design cycle, integrated circuits (IC) such as programmable logic devices (PLD) and application specific ICs (ASIC) are highly vulnerable to hardware Trojan (HT) attacks. HTs are malicious additions or modifications to existing circuit elements, which can be inserted at any stages of IC life cycle to modify/destroy the functionality, reduce reliability, leak sensitive information, etc. Besides, HT can be designed either as always on or triggered only under certain operating conditions. For example, HT attacks in safety critical applications such as nuclear power plant, space and defence will jeopardise the safety and security of the unit and cause serious consequences. Hence, it is most important to ensure that the chip being in use performs only the intended function. In this paper, an in-depth analysis of feasible HT attacks in PLD and ASIC life cycles are presented. Based on the extensive literature survey on HTs and their countermeasure techniques, the state of the art HT prevention, detection, and diagnosis techniques are recommended to the valid stages of PLD and ASIC life cycles. Therefore, incorporating possible HT defence solutions in respective phases of PLD/ASIC-based safety systems thwart them against HT attacks.

The microcircuit industry is witnessing a massive outsourcing of the fabrication of ICs (Integrated Circuit), as well as the use of third party IP (Intellectual Property) and COTS (Commercial Off-The-Shelf) tools during IC design. These issues raise new security challenges and threats. In particular, it brings up multiple opportunities for the insertion of malicious logic, commonly referred to as a hardware Trojan, in the IC. Testing is typically used along the IC development lifecycle to verify the functional correctness of a given chip. However, the complexity of modern ICs, together with resource and time limitations, makes exhaustive testing commonly unfeasible. In this paper, we propose a game-theoretic approachfor testing digital circuits that takes into account the decision-making process of intelligent attackers responsible for the infection of ICs with hardware Trojans. Testing for hardware Trojans is modeled as a zero-sum game between malicious manufacturers or designers (i.e., the attacker) who want to insert Trojans, and testers (i.e., the defender) whose goal is to detect the Trojans. The game results in multiple possible mixed strategy Nash equilibria that allow to identify optimum test sets that increase the probability of detecting and defeating hardware Trojans in digital logic.

Recently, there are various methods for detecting the hardware trojans (HTs) in the integrated circuits (ICs). The circuit's logic representations of different types, structures, and functional characteristics should be different. Each type of circuit has its' own performance characteristics according to its' purpose. However, the traditional HTs detection methods adopt the same approach to deal with the multi-purpose hardware trojan. At the same time, as the scale of integrated circuits growing, the structures are more complex, and the functions are more refined. The current situation makes the traditional HTs detection methods weaker and even unfeasible. Therefore, we propose an HTs classified locating method based on machine learning, named ML-HTCL, which belongs to the static detection and locating method. In ML-HTCL, different purpose HTs were represented by different features. Due to the different features, the ML-HTCL employs the multi-layer BP neural network for the control signal type HTs and the one-class SVM for the information leakage HTs, respectively. To deal with the HTs completely, the boundary nets are considered for all data set, while those were ignored by the most existing methods due to the high detection error rate. After detection, the HTs' precise locations were achieved. To evaluate the ML-HTCL, 17 gate-level netlist benchmarks are used for training and testing by leave-one-out cross-validation. From the results, the ML-HTCL reaches 85.05% of TPR and 73.91% of TNR for all kinds of HTs, which performs better than the most existing methods.

Hardware Trojans (HTs) are one of the emerging malicious hardware modification attacks that have become a critical threat to the integrity, reliability, security, and trustworthiness of integrated circuits (ICs) applications. These deliberately hidden malicious entities can be inserted into the IC during manufacturing or design, potentially leading to the leakage of secret information or the deactivation or destruction of the entire system that relies on the IC hardware chips. Localizing and detecting hardware Trojans is becoming increasingly challenging as these threats are deeply embedded and electronic systems continue to grow in complexity. Traditional methods, including physical inspections and functional testing, are increasingly inadequate. They are limited in scope and often fall short when confronted with the advanced designs of modern hardware Trojans.This study aims to improve the identification of hardware Trojans (HTs) in integrated circuits by using advanced machine learning algorithms with a unique dataset of power side-channel signals. Various machine learning techniques, such as Support Vector Machines (SVM), neural networks, and decision trees, are applied to classify and identify HTs accurately. This method combines comprehensive feature extraction and model validation to provide high accuracy and reliability in HT identification. This research makes significant contributions to cybersecurity by providing improved techniques for detecting minor anomalies associated with HTs using advanced machine learning algorithms. The results show potential advances in securing electronic systems against these hidden threats, highlighting the practical significance and necessity of our work in maintaining a wide range of applications from consumer electronics to national infrastructure.

Hardware Trojans are malicious changes to the design of integrated circuits (ICs) at different stages of the design and fabrication process. Different approaches have been developed to detect Trojans namely non-destructive and destructive testing. However, none of the previously developed methods can be used to detect all types of Trojans as they suffer from a number of disadvantages such as low speed of detection, low accuracy, low confidence level, and poor coverage of Trojan types. Majority of the hardware Trojans implemented in an IC will leave a footprint at the active layer. In this paper, we propose a new technique based on rapid backside SEM imaging and advanced computer vision algorithms to detect any subtle changes at the active region of transistors that can show the existence of a hardware Trojan. Here, we are only concerned with untrusted foundry problem, where it is assumed the attacker has access to a golden layout/image of the IC. This is a common threat model for those organizations that fully design their IC but need access to untrusted foundry for fabrication. SEM image from a backside thinned golden IC is compared with a low-quality SEM image of an IC under authentication (IUA). We perform image processing to both golden IC and IUA images to remove noise. We have developed a computer vision-based framework to detect hardware Trojans based on their structural similarity. The results demonstrate that our technique is quite effective at detecting Trojans and significantly faster than full chip reverse engineering. One of the major advantages of our technique is that it does not rely on the functionality of the circuit, rather the real physical structure to detect malicious changes performed by the untrusted foundry.

We report our experiences in designing and implementing several hardware Trojans within the framework of the Embedded System Challenge competition that was held as part of the Cyber Security Awareness Week (CSAW) at the Polytechnic Institute of New York University in October 2008. Due to the globalization of the Integrated Circuit (IC) manufacturing industry, hardware Trojans constitute an increasingly probable threat to both commercial and military applications. With traditional testing methods falling short in the quest of finding hardware Trojans, several specialized detection methods have surfaced. To facilitate research in this area, a better understanding of what Hardware Trojans would look like and what impact they would incur to an IC is required. To this end, we present eight distinct attack techniques employing Register Transfer Level (RTL) hardware Trojans to compromise the security of an Alpha encryption module implemented on a Digilent BASYS Spartan-3 FPGA board. Our work, which earned second place in the aforementioned competition, demonstrates that current RTL designs are, indeed, quite vulnerable to hardware Trojan attacks.

Hardware Trojans pose a serious threat to the expected functionality, performance, and security of integrated circuits (ICs). Many of the existing techniques for detection of hardware Trojans require the use of a “golden IC.” The golden IC is a fabricated instance of the design which is required to be free of Trojans and is used as a reference to verify the responses obtained from an IC under authentication. However identification and even existence of a golden IC may not be possible. In light of these challenges, techniques are desired which can detect a hardware Trojan without the need for a golden IC. This chapter gives an overview of golden-free Trojan detection.

Integrated Circuits (ICs) are sensible to a wide range of (passive, active, invasive, non-invasive) physical attacks. In this context, Hardware Trojans (HTs), that are malicious modifications of a circuit by an untrusted manufacturer, are one of the most challenging threats to mitigate. HTs aim to alter the functionality of the infected chip in a malicious way, e.g. under specific conditions known by the adversary. Fault attacks are a typical attack vector. However, for a HT to be exploitable by an adversary, it also has to be stealthy. For example, a HT that would directly inject exploitable faults in a block cipher may be spotted by analyzing its functional behavior (i.e. the positions and the distribution of the faulty values appearing). In this paper, we propose a stealthy HT instance leading to successful and hidden Statistical Fault Attacks (SFA). More precisely, the faults are injected when the chip is running under condition for which metastabilty occurs (i.e. with a increased clock frequency), leading to the apparition faults at random positions within the target implementation. In addition, an internal bit is set to a value known only by the adversary, allowing him to perform efficient SFA. Compared to classical SFA, the HT uses its control on the target to circumvent behavioral detection tests. Indeed, it also adds computation errors in the early rounds of the target cipher which are not exploitable via SFA.

Integrated Circuits (ICs) are suffering severer threats caused by Hardware Trojans (HTs), some of which hide in routine operations by coercing firmware or hardware. Along with conventional side-channel detection not always getting golden-chip, HTs become more difficult to detect. An improved Support Vector Machine (SVM) machine learning frameworks for this is proposed using system-level side-channel analysis. Cross validation experimental results on Field Programmable Gate Array (FPGA) show that in the condition of golden-chip, supervised SVM achieves 85.8% test accuracy in average. After grouping, outlier-removing and normalization, it rises by 4%. Even if golden-chip is out of hand, semi-supervised SVM has accuracy to judge HTs existence, averaging in 52.9%-79.5% under different test modes. Comparing with existing researches, this work verifies the efficiency of SVM for HT detection in instruction level, and points out the relationship between diversified learning conditions with detection performance.

To reduce the cost of integrated circuit fabrication, a designer often submits layout masks to an untrusted foundry. Contingent on the sensitivity of the project, the cost-reduction benefit can become limited or eliminated due to the lack of security and control in an untrusted environment. Control of the design, components, and intellectual property is lost during the manufacturing step, giving an adversary the opportunity to compromise the integrated circuit. With low probability of detection, a malicious agent can insert extra circuitry in strategic locations and exfiltrate sensitive data or compromise functionality and reliability. The extra circuits are called hardware Trojans. Our project, the Automated Iterative Reverse Engineer, leverages image processing and computer vision techniques to compare the original designer's ideal GDS2 design layout to real-world micro-scopic images of the fabricated integrated circuit. Our previous work in Image Stitch Assembly and Multimodal Image Matching for Hardware Security provides a framework to leverage our Differential Image Transform and facilitate greater execution speed and higher quality matching between the ideal and real-world cases. As our data shows, the high-quality matching yields reliable mismatched areas to better indicate the presence of hardware Trojans.

The horizontal business model in semiconductor industry has brought economic benefits but relinquished the control that integrated circuit (IC) designer had in chip design and manufacturing, thus making chips expose to greater security threats and vulnerable to various kinds of hardware attacks. As electronic devices becoming increasingly ubiquitous and permeated into our daily lives, critical basic infrastructures and national defense systems, hardware security features that can assure the trustworthiness of an integrated system in a reliable, efficient and inexpensive way are highly desirable. In the dissertation, two embedded hardware security primitives, namely active current sensors and Physical Unclonable Functions (PUFs) are investigated for hardware Trojan (HT) detection, device identification and authentication.

Fabrication of Integrated Circuits (ICs) is outsourced to third-party foundries to decrease time to market and production cost. Outsourcing renders the ICs vulnerable to malicious modifications. These malicious circuit modifications, known as Hardware Trojans (HTs), tamper with the integrity of intellectual property cores and hence, must be detected accurately. A highly accurate method for detecting HTs is through time-consuming physical inspection of reverse-engineered chips. Apparently, physically inspection of all suspected chips is unrealistic. Therefore, the knowledge gained from reverse engineering a single infected IC should be used to detect trojans non-invasively in other ICs. The extra malicious logic, in other suspected chips, can be triggered using suitable test patterns leading to its detection. In order to facilitate detection using test patterns, however, the HT should be mapped to the golden circuit, and automated tools should be used to find appropriate patterns. In this work, we explore the feasibility of this two-step methodology for HT detection by discussing the required steps and identifying the unsolved challenges in each step.

The design complexity and outsourcing trend of modern integrated circuits (ICs) have increased the chance for adversaries to implant hardware Trojans (HTs) in the development process. To effectively defend against this hardware-based security threat, many solutions have been reported in the literature, including dynamic and static techniques. However, there is still a lack of methods that can simultaneously detect and diagnose HT circuits with high accuracy and low time complexity. Therefore, to overcome these limitations, this paper presents an HT detection and diagnosis method for gate-level netlists (GLNs) based on different machine learning (ML) algorithms. Given a GLN, the proposed method first partitions it into several circuit cones and extracts seven HT-related features from each cone. Then, we repeat this process for the sample GLN to construct a dataset for the next step. After that, we use K-Nearest Neighbor (KNN), Decision Tree (DT) and Naive Bayes (NB) to classify all circuit cones of the target GLN. Finally, we determine whether each circuit cone is HT-implanted through the label, completing the HT detection and diagnosis for target GLN. We have applied our method to 11 GLNs from ISCAS’85 and ISCAS’89 benchmark suites. As shown in experimental results of the three ML algorithms used in our method: (1) NB costs shortest time and achieves the highest average true positive rate (ATPR) of 100%; (2) DT costs longest time but achieve the highest average true negative rate (ATNR) of 98.61%; (3) Compared to NB and DT, KNN costs a slightly longer time than NB but the ATPR and ATNR values are approximately close to DT. Moreover, it can also report the possible implantation location of a Trojan instance according to the detecting results.

This paper presents an analysis of a sequential Triggered “Time Bomb” hardware Trojan (HT). Major security concerns have been rising up since malicious modification of hardware or fabrication IC can lead to an altered functional behavior, potentially with disastrous consequences in safety-critical applications. Due to the stealthy nature of the hardware Trojans the conventional design and time verification and post manufacturing testing cannot be readily extended. There are a large number of possible instances and operating modes for the hardware Trojans in a digital system. Since the hardware Trojan insertion can modify the functionality of the digital integrated circuit (IC), alter its behavior, generate denial of service (DoS), the HT threats should be analyzed with maximum importance through the entire lifecycle of the IC.