On automating delayered IC analysis for hardware IP protection

ABSTRACTThe tremendous advancement in very large scale integration technology encourages chip designers to rely on commercial electronic design automation tools, offshore fabrication services, and outsourced intellectual property cores. As third-party involvement are more in chip design cycle, integrated circuits (IC) such as programmable logic devices (PLD) and application specific ICs (ASIC) are highly vulnerable to hardware Trojan (HT) attacks. HTs are malicious additions or modifications to existing circuit elements, which can be inserted at any stages of IC life cycle to modify/destroy the functionality, reduce reliability, leak sensitive information, etc. Besides, HT can be designed either as always on or triggered only under certain operating conditions. For example, HT attacks in safety critical applications such as nuclear power plant, space and defence will jeopardise the safety and security of the unit and cause serious consequences. Hence, it is most important to ensure that the chip being in use performs only the intended function. In this paper, an in-depth analysis of feasible HT attacks in PLD and ASIC life cycles are presented. Based on the extensive literature survey on HTs and their countermeasure techniques, the state of the art HT prevention, detection, and diagnosis techniques are recommended to the valid stages of PLD and ASIC life cycles. Therefore, incorporating possible HT defence solutions in respective phases of PLD/ASIC-based safety systems thwart them against HT attacks.

Hardware Trojans are malicious changes to the design of integrated circuits (ICs) at different stages of the design and fabrication process. Different approaches have been developed to detect Trojans namely non-destructive and destructive testing. However, none of the previously developed methods can be used to detect all types of Trojans as they suffer from a number of disadvantages such as low speed of detection, low accuracy, low confidence level, and poor coverage of Trojan types. Majority of the hardware Trojans implemented in an IC will leave a footprint at the active layer. In this paper, we propose a new technique based on rapid backside SEM imaging and advanced computer vision algorithms to detect any subtle changes at the active region of transistors that can show the existence of a hardware Trojan. Here, we are only concerned with untrusted foundry problem, where it is assumed the attacker has access to a golden layout/image of the IC. This is a common threat model for those organizations that fully design their IC but need access to untrusted foundry for fabrication. SEM image from a backside thinned golden IC is compared with a low-quality SEM image of an IC under authentication (IUA). We perform image processing to both golden IC and IUA images to remove noise. We have developed a computer vision-based framework to detect hardware Trojans based on their structural similarity. The results demonstrate that our technique is quite effective at detecting Trojans and significantly faster than full chip reverse engineering. One of the major advantages of our technique is that it does not rely on the functionality of the circuit, rather the real physical structure to detect malicious changes performed by the untrusted foundry.

Recently, there are various methods for detecting the hardware trojans (HTs) in the integrated circuits (ICs). The circuit's logic representations of different types, structures, and functional characteristics should be different. Each type of circuit has its' own performance characteristics according to its' purpose. However, the traditional HTs detection methods adopt the same approach to deal with the multi-purpose hardware trojan. At the same time, as the scale of integrated circuits growing, the structures are more complex, and the functions are more refined. The current situation makes the traditional HTs detection methods weaker and even unfeasible. Therefore, we propose an HTs classified locating method based on machine learning, named ML-HTCL, which belongs to the static detection and locating method. In ML-HTCL, different purpose HTs were represented by different features. Due to the different features, the ML-HTCL employs the multi-layer BP neural network for the control signal type HTs and the one-class SVM for the information leakage HTs, respectively. To deal with the HTs completely, the boundary nets are considered for all data set, while those were ignored by the most existing methods due to the high detection error rate. After detection, the HTs' precise locations were achieved. To evaluate the ML-HTCL, 17 gate-level netlist benchmarks are used for training and testing by leave-one-out cross-validation. From the results, the ML-HTCL reaches 85.05% of TPR and 73.91% of TNR for all kinds of HTs, which performs better than the most existing methods.

In modern integrated circuit (IC) designs, intellectual property (IP) cores are often outsourced and designed by third-party vendors, resulting in the partial relinquishment of the control over the IC design flow. Thus, reliable verifications are required to mitigate the threat of hardware Trojans (HTs) which may be inserted into IP cores by malicious vendors. Existing trustiness verification methods cannot take the merit of high efficiency and accuracy at the same time. In this paper, we propose a multilevel fast trustiness verification framework based on feature analysis to detect HTs in third-party digital IP cores. The proposed framework combines flip-flop level and combinational logic level feature analysis to achieve both high efficiency and accuracy. Experimental results demonstrate that both explicitly and implicitly triggered HTs can be detected in very short time with a negligible false positive rate. More importantly, our framework has the unique advantage of being scalable to defend against future and stealthier HTs by adding new features into the framework.

Hardware Trojans (HTs) pose a serious threat to integrated circuit (IC) security. Detection of HTs is extremely challenging due to their stealthy nature. Side-channel analysis techniques have emerged as promising approaches for HT detection by observing anomalies in physical parameters like power or delay. More recently, machine learning (ML) methods have been explored to enhance the accuracy and efficiency of side-channel based HT detection. Background: This paper presents a novel approach using machine learning techniques to detect stealthy hardware Trojans through side-channel analysis. Hardware Trojans, malicious modifications inserted into integrated circuits during manufacturing, pose significant threats to the integrity and security of electronic systems. Traditional methods of detecting these Trojans often rely on known signatures or specific patterns, making them ineffective against subtle and sophisticated attacks. Method: This paper provides a comprehensive review of research advancements in applying ML for side-channel based HT detection. First, an overview of HT attacks, their classification, threat models and detection challenges is presented. Next, various side-channel parameters like power, temperature, delay and electromagnetic emanations used for HT detection are discussed along with their merits and demerits. Furthermore, the application of supervised, unsupervised and semi-supervised ML algorithms for automated feature extraction and intelligent decision making is elucidated in detail. Result: Specifically, the data collection strategies, feature extraction techniques, ML models and performance evaluation metrics adopted in existing literature are critically reviewed. In addition, the limitations of current approaches and promising future research directions like on-chip ML implementation, hierarchical ML and explainable ML models tailored for HT detection are highlighted. Conclusion: Case studies on benchmark circuits are also presented to demonstrate the efficacy of ML-based side-channel HT detection methods. Through an extensive literature review and incisive analysis, this paper provides contemporary insights on the advancement of ML techniques to enable robust side-channel based HT detection for securing next-generation ICs.

Hardware Trojans (HTs) are one of the emerging malicious hardware modification attacks that have become a critical threat to the integrity, reliability, security, and trustworthiness of integrated circuits (ICs) applications. These deliberately hidden malicious entities can be inserted into the IC during manufacturing or design, potentially leading to the leakage of secret information or the deactivation or destruction of the entire system that relies on the IC hardware chips. Localizing and detecting hardware Trojans is becoming increasingly challenging as these threats are deeply embedded and electronic systems continue to grow in complexity. Traditional methods, including physical inspections and functional testing, are increasingly inadequate. They are limited in scope and often fall short when confronted with the advanced designs of modern hardware Trojans.This study aims to improve the identification of hardware Trojans (HTs) in integrated circuits by using advanced machine learning algorithms with a unique dataset of power side-channel signals. Various machine learning techniques, such as Support Vector Machines (SVM), neural networks, and decision trees, are applied to classify and identify HTs accurately. This method combines comprehensive feature extraction and model validation to provide high accuracy and reliability in HT identification. This research makes significant contributions to cybersecurity by providing improved techniques for detecting minor anomalies associated with HTs using advanced machine learning algorithms. The results show potential advances in securing electronic systems against these hidden threats, highlighting the practical significance and necessity of our work in maintaining a wide range of applications from consumer electronics to national infrastructure.

The fabless nature of the integrated circuits (ICs) manufacturing industry has made it prone to various kinds of attacks that can compromise the security of the IC. The inclusion of malicious circuitry in the original IC is one such attacks which has the potential to create a critical failure in the functioning of the ICs. Such kinds of clandestine circuitry is known as Hardware Trojan Horses (HTH) and they are often inserted in the circuit in such a way that they are very difficult to detect during the testing phase. The secretive nature of HT is attributed to the fact that they are often inserted in the parts of the IC where there is relatively less transitions. In this paper, a technique is suggested that aids in raising the number of transitions all over the IC which in turn helps in stimulating and/or activating the malicious HT circuit. The transition probability is increased in the IC by using 2-to-1 MUXs which are inserted in specific parts of the circuit. The 2-to-1 MUXs feed signals to the various parts of the IC with respect to weighted signal probability during the testing phase. The main goal of this paper is to increase the overall transition probability throughout the IC with an optimal number of 2-to-1 MUX insertions.

Integrated Circuits (ICs) are the cardinal elements of modern electrical, electronic and electro-mechanical systems. Amid global outsourcing of ICs' design and fabrication and their growing applications in smart manufacturing or Industrie 4.0, various hardware security threats and issues of trust have also emerged. IC piracy, counterfeiting, and hardware Trojans (HTs) are some of the key hardware threats that merit the attention of manufacturing community. It is worth noting that the lower abstraction levels (ICs) are falsely assumed to operate securely. The proposition, therefore, is that if an operating system (higher abstraction level) is considered to be secure while operating on a compromised IC (lower abstraction level), would it be prudent to regard this implementation as secure? The purpose of this paper is to highlight IC level threats with an emphasis on hardware Trojans that pose a significant threat to smart manufacturing environment in the wake of Industrial Internet of Things (IIoT).

Offshore fabrication, assembling and packaging challenge chip security, as original chip designs may be tampered by malicious insertions, known as hardware Trojans (HTs). HT detection is imperative to guarantee the chip performance and safety. Existing HT detection methods have limited capability to detect small-scale HTs and are further challenged by the increased process variation. To increase HT detection sensitivity and reduce chip authorization time, we propose to exploit the inherent feature of differential cascade voltage switch logic (DCVSL) to detect HTs at runtime. In normal operation, a system implemented with DCVSL always produces complementary logic values in internal nets and final outputs. Noncomplementary values on inputs and internal nets in DCVSL systems potentially result in abnormal power behavior and even system failures. By examining special power characteristics of DCVSL systems upon HT insertion, we can detect HTs, even if the HT size is small. Simulation results show that the proposed method achieves up to 100% HT detection rate. The evaluation on ISCAS benchmark circuits shows that the proposed method obtains a HT detection rate in the range of 66% to 98%.

The microcircuit industry is witnessing a massive outsourcing of the fabrication of ICs (Integrated Circuit), as well as the use of third party IP (Intellectual Property) and COTS (Commercial Off-The-Shelf) tools during IC design. These issues raise new security challenges and threats. In particular, it brings up multiple opportunities for the insertion of malicious logic, commonly referred to as a hardware Trojan, in the IC. Testing is typically used along the IC development lifecycle to verify the functional correctness of a given chip. However, the complexity of modern ICs, together with resource and time limitations, makes exhaustive testing commonly unfeasible. In this paper, we propose a game-theoretic approachfor testing digital circuits that takes into account the decision-making process of intelligent attackers responsible for the infection of ICs with hardware Trojans. Testing for hardware Trojans is modeled as a zero-sum game between malicious manufacturers or designers (i.e., the attacker) who want to insert Trojans, and testers (i.e., the defender) whose goal is to detect the Trojans. The game results in multiple possible mixed strategy Nash equilibria that allow to identify optimum test sets that increase the probability of detecting and defeating hardware Trojans in digital logic.

Hardware Trojans pose a significant threat to the security and integrity of cryptographic systems, particularly in Advanced Encryption Standard (AES) implementations, which are widely used in securing sensitive data. These malicious modifications to integrated circuits (ICs) can compromise the confidentiality and reliability of AES cryptographic operations by introducing covert backdoors, information leakage channels, or functional disruptions. Hardware Trojans are typically designed to evade detection during design-time validation and post-manufacturing testing, often activating only under specific triggers such as rare input patterns or environmental conditions. In AES systems, Trojans can manipulate the encryption process by leaking secret keys through side-channel information such as power consumption, timing variations, or electromagnetic emissions. Some Trojans directly alter the encryption algorithm, weakening the cryptographic strength and rendering encrypted data vulnerable to attacks. Attackers may also embed Trojans at the Register Transfer Level (RTL) or gate-level design, leveraging the inherent complexity of AES circuits to conceal their presence. Detection and mitigation of hardware Trojans in AES implementations are challenging due to their stealthy nature. Techniques such as side-channel analysis, functional verification, and static code analysis have been developed, but sophisticated Trojans often bypass these methods. Advanced countermeasures include runtime monitoring, hardware obfuscation, and Trojan-resilient design methodologies. This paper explores the implications of hardware Trojans in AES cryptographic systems, analysing their design, potential attack vectors, and impacts on data security. Furthermore, it discusses state-of-the-art detection and prevention techniques, highlighting gaps and future research directions. Given the critical role of AES in securing financial, military, and consumer data, addressing the hardware Trojan threat is paramount to ensuring trust in cryptographic hardware and safeguarding against adversarial exploitation.

We report our experiences in designing and implementing several hardware Trojans within the framework of the Embedded System Challenge competition that was held as part of the Cyber Security Awareness Week (CSAW) at the Polytechnic Institute of New York University in October 2008. Due to the globalization of the Integrated Circuit (IC) manufacturing industry, hardware Trojans constitute an increasingly probable threat to both commercial and military applications. With traditional testing methods falling short in the quest of finding hardware Trojans, several specialized detection methods have surfaced. To facilitate research in this area, a better understanding of what Hardware Trojans would look like and what impact they would incur to an IC is required. To this end, we present eight distinct attack techniques employing Register Transfer Level (RTL) hardware Trojans to compromise the security of an Alpha encryption module implemented on a Digilent BASYS Spartan-3 FPGA board. Our work, which earned second place in the aforementioned competition, demonstrates that current RTL designs are, indeed, quite vulnerable to hardware Trojan attacks.

Integrated Circuits (ICs) are sensible to a wide range of (passive, active, invasive, non-invasive) physical attacks. In this context, Hardware Trojans (HTs), that are malicious modifications of a circuit by an untrusted manufacturer, are one of the most challenging threats to mitigate. HTs aim to alter the functionality of the infected chip in a malicious way, e.g. under specific conditions known by the adversary. Fault attacks are a typical attack vector. However, for a HT to be exploitable by an adversary, it also has to be stealthy. For example, a HT that would directly inject exploitable faults in a block cipher may be spotted by analyzing its functional behavior (i.e. the positions and the distribution of the faulty values appearing). In this paper, we propose a stealthy HT instance leading to successful and hidden Statistical Fault Attacks (SFA). More precisely, the faults are injected when the chip is running under condition for which metastabilty occurs (i.e. with a increased clock frequency), leading to the apparition faults at random positions within the target implementation. In addition, an internal bit is set to a value known only by the adversary, allowing him to perform efficient SFA. Compared to classical SFA, the HT uses its control on the target to circumvent behavioral detection tests. Indeed, it also adds computation errors in the early rounds of the target cipher which are not exploitable via SFA.

Globalization of semiconductor manufacturing has brought about increasing concerns regarding possible infiltration of the Integrated Circuit (IC) supply chain by skilled and resourceful adversaries, with the intention of introducing malicious modifications (a.k.a hardware Trojans) which can be exploited to cause incorrect results, steal sensitive data, or even incapacitate a chip. While numerous prevention and detection solutions have been introduced in the recent, past, the vast majority of these efforts target digital circuits. Analog/RF ICs, however, are equally vulnerable and potentially even more attractive as attack targets, due to their wireless communication capabilities. Accordingly, in this chapter, we review existing research efforts in hardware Trojan detection in Analog/RF ICs. Specifically, using a wireless cryptographic IC as an experimentation platform, we demonstrate the effectiveness of side-channel fingerprinting along with advanced statistical analysis and machine learning methods in detecting hardware Trojans both after its manufacturing and after its deployment in its field of operation.)

Integrated Circuits (ICs) are suffering severer threats caused by Hardware Trojans (HTs), some of which hide in routine operations by coercing firmware or hardware. Along with conventional side-channel detection not always getting golden-chip, HTs become more difficult to detect. An improved Support Vector Machine (SVM) machine learning frameworks for this is proposed using system-level side-channel analysis. Cross validation experimental results on Field Programmable Gate Array (FPGA) show that in the condition of golden-chip, supervised SVM achieves 85.8% test accuracy in average. After grouping, outlier-removing and normalization, it rises by 4%. Even if golden-chip is out of hand, semi-supervised SVM has accuracy to judge HTs existence, averaging in 52.9%-79.5% under different test modes. Comparing with existing researches, this work verifies the efficiency of SVM for HT detection in instruction level, and points out the relationship between diversified learning conditions with detection performance.