TeSR: A robust Temporal Self-Referencing approach for Hardware Trojan detection

Intended malicious modification in the integrated circuits is referred to as Hardware Trojans, which has emerged as major security threat. The earlier approach, to keep check to these threats, like logic testing also known as functional testing is proved to be no longer effective for detecting large sequential Trojans which are very rarely triggered. Side channel analysis has been an effective approach for detection of such large sequential Trojans but the increasing process variations and decreasing Trojan size resulted in the reduction of Trojan detection sensitivity using this approach. All these approaches also require golden IC. In this paper, we propose leakage power analysis approach which does not require golden IC and the issue of process variations does not affect the detection sensitivity.

Malicious modification of integrated circuits (ICs) in untrusted foundry, referred to as “Hardware Trojan”, has emerged as a serious security threat. While side-channel analysis has been reported as an effective approach to detect hardware Trojans, increasing process variations in nanoscale technologies pose a major challenge, since process noise can easily mask the Trojan effect on a measured side-channel parameter, such as supply current. Besides, existing side-channel approaches suffer from reduced Trojan detection sensitivity with increasing design size. In this paper, we propose a novel scalable side-channel approach, named self-referencing, along with associated vector generation algorithm to improve the Hardware Trojan detection sensitivity under large process variations. It compares transient current signature of one region of an IC with that of another, thereby nullifying the effect of process noise by exploiting spatial correlation across regions in terms of process variations. To amplify the Trojan effect on supply current, we propose a region-based vector generation approach, which divides a circuit-under-test (CUT) into several regions and for each region, finds the test vectors which induce maximum activity in that region, while minimizing the activity in other regions. We show that the proposed side-channel approach is scalable with respect to both amount of process variations and design size. The approach is validated with both simulation and measurement results using an FPGA-based test setup for large designs including a 32-bit DLX processor core (~105 transistors). Results shows that our approach can find ultra-small (<0.01% area) Trojans under large process variations of up to ± 20% shift in transistor threshold voltage.

Hardware Trojans have emerged as a new threat to the security of chip and the reliability of computing systems. As such, methods of determining whether a “security chip” contains hardware Trojans are a research concern. This study proposes power relative variation (PRV) parameters to analysis the relation between test vectors and detection sensitivity. Following a brief introduction into Trojans and detection methods, we present the S-box circuit noise model in AES core and simulate the power tracks of various sizes of hardware Trojans using HSPICE. We also apply different sets of test vectors in 40 nm processing. Experimental results show that the power of the entire circuit is reduced by 41% and the PRV value increased 12.71% and 3.34% at most corresponding to combinational and sequential Trojan circuits. The valid test vectors can enhance the activity of hardware Trojans. They can also limit the noise from process, supply voltage, and temperature and extrude the features from the Trojan circuit to increase PRV value. As a result, a sample amount can be compressed at a reduced cost given a similar detection effect. Hence, the investigation into the influence of test vectors on the detection methods of hardware Trojans based on side-channel analysis is extremely important.

Hardware Trojans (HT) inserted in integrated circuits have received special attention of researchers. In this paper, we present firstly a novel HT detection technique based on path delays measurements. A delay model, which considers intra-die process variations, is established for a net. Secondly, we show how to detect HT using ElectroMagnetic (EM) measurements. We study the HT detection probability according to its size taking into account the inter-die process variations with a set of FPGA. The results show, for instance, that there is a probability greater than 95% with a false negative rate of 5% to detect a HT larger than 1.7% of the original circuit.

Hardware Trojan detection has emerged as a critical challenge to ensure security and trustworthiness of integrated circuits. A vast majority of research efforts in this area has utilized side-channel analysis for Trojan detection. Functional test generation for logic testing is a promising alternative but it may not be helpful if a Trojan cannot be fully activated or the Trojan effect cannot be propagated to the observable outputs. Side-channel analysis, on the other hand, can achieve significantly higher detection coverage for Trojans of all types/sizes, since it does not require activation/propagation of an unknown Trojan. However, they have often limited effectiveness due to poor detection sensitivity under large process variations and small Trojan footprint in side-channel signature. In this chapter, we address this critical problem through a novel side-channel-aware test generation approach, based on a concept of multiple excitation of rare switching (MERS) that can significantly increase Trojan detection sensitivity. (1) It presents in detail a scalable statistical test generation method, which can generate high-quality testset for creating high relative activity in arbitrary Trojan instances; (2) it analyzes the effectiveness of generated testset in terms of Trojan coverage; and (3) it describes two judicious reordering methods that can further tune the testset and greatly improve the side-channel sensitivity. Simulation results demonstrate that the tests generated by MERS can significantly increase the Trojans sensitivity, thereby making Trojan detection effective using side-channel analysis.

Hardware Trojans pose a significant threat to the security and integrity of cryptographic systems, particularly in Advanced Encryption Standard (AES) implementations, which are widely used in securing sensitive data. These malicious modifications to integrated circuits (ICs) can compromise the confidentiality and reliability of AES cryptographic operations by introducing covert backdoors, information leakage channels, or functional disruptions. Hardware Trojans are typically designed to evade detection during design-time validation and post-manufacturing testing, often activating only under specific triggers such as rare input patterns or environmental conditions. In AES systems, Trojans can manipulate the encryption process by leaking secret keys through side-channel information such as power consumption, timing variations, or electromagnetic emissions. Some Trojans directly alter the encryption algorithm, weakening the cryptographic strength and rendering encrypted data vulnerable to attacks. Attackers may also embed Trojans at the Register Transfer Level (RTL) or gate-level design, leveraging the inherent complexity of AES circuits to conceal their presence. Detection and mitigation of hardware Trojans in AES implementations are challenging due to their stealthy nature. Techniques such as side-channel analysis, functional verification, and static code analysis have been developed, but sophisticated Trojans often bypass these methods. Advanced countermeasures include runtime monitoring, hardware obfuscation, and Trojan-resilient design methodologies. This paper explores the implications of hardware Trojans in AES cryptographic systems, analysing their design, potential attack vectors, and impacts on data security. Furthermore, it discusses state-of-the-art detection and prevention techniques, highlighting gaps and future research directions. Given the critical role of AES in securing financial, military, and consumer data, addressing the hardware Trojan threat is paramount to ensuring trust in cryptographic hardware and safeguarding against adversarial exploitation.

An exquisitely sensitive variant-conscious post-silicon Hardware Trojan detection

In recent years, integrated circuits subject to hardware Trojans attack in the design and manufacturing process, the security of chip and hardware security was threatened. Some detection methods of have been proposed, the most common of those methods is based on side-channel signal analysis, however, since the effect of process noise, considering only the unilateral information that is difficult to effectively distinguish the noise and Trojans circuit. In this paper, the method still based on side-channel signal, but it is a combination of power and delay which was called the power-delay product (PDP). The idea proposed is verified by the benchmark circuit iscas85, the experimental results show that this method can effectively improve detection probability.

Nowadays, an integrated circuit can carry many functions which make them more challenging to design and manufacture. The involvement of the third party is not unusual which can open the possibilities for unauthorized modification by inserting illegal block called hardware trojan to perform some malicious functions. This issue raises attention in the field of hardware security to prevent the insertion of the hardware trojan and to detect its presence in a chip. Side channel analysis is considered as a prospective method, although there are several difficulties encountered. In this paper, we will implement cryptographic hardware that can encrypt information using Advanced Encryption Standards (AES) in a Field Programmable Gate Arrays (FPGA). Then, this reference model is subjected to the implantation of hardware trojan designed to leak the AES key. By using the side channel analysis and by adjusting the behavior of the hardware trojan, we will try to detect its presence using conventional instruments available in our labs. In the end, we can conclude the possibility for the end customer to detect the existence of hardware trojan and the design techniques of hardware trojan to evade the detection.

Small, low-cost embedded systems implemented as sequential circuits often do not contain scan chains. Malicious trojan circuits, which themselves may be state machines, inserted into such systems are hard to detect. We present an effective methodology to detect sequential trojan circuits inserted into sequential hardware designs without scan chains. The methodology consists of three steps: We use sequential testability metrics, model checking and signal tracing to progressively separate the trojan gates from legitimate circuit gates. We show experimental results demonstrating the effectiveness of the methodology using several test cases.

The high cost of integrated circuit chip production has driven more and more chip design companies to use overseas production services. Since the integrated circuit production cannot be closely monitored, the security of integrated circuit chips has become a major concern. Hardware Trojan (HT) insertion is one type of the hardware attack. HTs are extremely stealthy due to their small sizes and low triggering rates. HTs inserted during manufacturing can have minimum impact on the timing and power. In fact, this impact can be smaller than the timing and power variations caused by the process variations. Therefore, these HTs cannot be easily detected using traditional electrical methods. In this article, we propose a novel optical method, where we image the integrated circuit chip from the backside. Our method, can easily detect any replacements, modifications, or rearrangements of fill cells or functional cells for HT insertion. We use a noise-based detection method to achieve high HT detection rates in different testbenches. To further improve the robustness of our method, we strategically place high reflectance fill cells in the designs. Our approach provides high-resolution, nondestructive, and rapid means to detect HTs inserted during fabrication. We evaluate our approach using various hardware blocks where the HTs can occupy less than 0.1% of the total area or consist of fewer than three gates. In addition, we analyze our method with various magnitudes of noise, process variations, detection window sizes, and resolutions.

Here, the side-channel attack (SCA)-resistant cryptographic chip: a cryptographic circuit employs a voltage scaling technique is studied with hardware Trojan attacks. Two different types of hardware Trojans, sequential hardware Trojan and combinational hardware Trojan, are proposed to be embedded into the SCA-resistant cryptographic chip for leaking the secret key. Moreover, the sequential Trojan can only disclose a single bit of the secret key at a time, while the combinational Trojan is able to leak the whole bit of the secret key at once. As demonstrated in the results, only analysing ∼270 (150) power traces are sufficient to disclose the 8-bit secret key of the sequential (combinational) Trojan-infected chip to the adversary. Furthermore, both the sequential and combinational Trojan-infected chips can evade the testing of the power attack and be detected with the proposed statistical models successfully.

Hardware Trojans (HTs) pose a serious threat to integrated circuit (IC) security. Detection of HTs is extremely challenging due to their stealthy nature. Side-channel analysis techniques have emerged as promising approaches for HT detection by observing anomalies in physical parameters like power or delay. More recently, machine learning (ML) methods have been explored to enhance the accuracy and efficiency of side-channel based HT detection. Background: This paper presents a novel approach using machine learning techniques to detect stealthy hardware Trojans through side-channel analysis. Hardware Trojans, malicious modifications inserted into integrated circuits during manufacturing, pose significant threats to the integrity and security of electronic systems. Traditional methods of detecting these Trojans often rely on known signatures or specific patterns, making them ineffective against subtle and sophisticated attacks. Method: This paper provides a comprehensive review of research advancements in applying ML for side-channel based HT detection. First, an overview of HT attacks, their classification, threat models and detection challenges is presented. Next, various side-channel parameters like power, temperature, delay and electromagnetic emanations used for HT detection are discussed along with their merits and demerits. Furthermore, the application of supervised, unsupervised and semi-supervised ML algorithms for automated feature extraction and intelligent decision making is elucidated in detail. Result: Specifically, the data collection strategies, feature extraction techniques, ML models and performance evaluation metrics adopted in existing literature are critically reviewed. In addition, the limitations of current approaches and promising future research directions like on-chip ML implementation, hierarchical ML and explainable ML models tailored for HT detection are highlighted. Conclusion: Case studies on benchmark circuits are also presented to demonstrate the efficacy of ML-based side-channel HT detection methods. Through an extensive literature review and incisive analysis, this paper provides contemporary insights on the advancement of ML techniques to enable robust side-channel based HT detection for securing next-generation ICs.

This article introduces an on-chip anomaly monitoring system design approach that is based on thermal profiling and side-channel analysis. The strategy aims at the realization of nonintrusive hardware Trojan (HT) detection over the lifetime of the circuit under test (CUT). To evaluate the capability of the proposed HT detection system, the on-chip electrothermal coupling is modeled as part of the simulation technique, which associates local thermal activities with circuit-level power consumption using a standard electrical simulator. To monitor the thermal profiles on chips with high sensitivity to local temperature changes and the resilience to flicker noise, the sensor architecture described in this article is the first differential temperature sensor equipped with a chopping mechanism. A methodology is described to utilize principal component analysis (PCA) to extract critical information from the quantized output of the system for effective HT detection in the presence of noise. The complete sensor signal path of the system was designed and simulated with foundry-supplied device models (130-nm CMOS technology), and the impact due to process variations have been considered via Monte Carlo simulations. The results indicate that small Trojans with approximately 2 μW of power can be detected within the thermal profile of a CUT consuming more than 500 μW. As the first step to prove the feasibility of on-chip quantization in the HT detection system, a prototype 8-bit successive approximation register (SAR) analog-to-digital converter (ADC) was fabricated with 130-nm CMOS technology.

With the globalization of the manufacturing supply chain, the malicious modification existing in the middle of distrust is becoming an important security issue on the chip. These modifications are called hardware Trojan (HT). HT is difficult to detect due to its high concealment and diversity of implementation. HT detection based on the side channel is a relatively effective detection method because it does not need to trigger the Trojan or destroy the chip. However, detection based on the side channel faces two major challenges. Firstly, the side channel detection is quite dependent on the golden model. The second one relates to the accuracy of the samples. Side channel information of the chip comes from the hardware manufacturing process and implementation, so it is obviously affected by process variation. In the existing work, many self-reference detection methods have been proposed to solve the problem of missing golden models. However, the existing methods often have special requirements for the circuit structure (such as the need for self-similar structures in the circuit). And, they can hardly resist process variation. This paper combines design and detection. We select the power consumption generated at different times and construct two self-reference ‘knapsack’ to detect HT. The solution proposed in this article is a kind of self-reference method, but we need neither self-similar structures nor the same state of some clocks in the circuit. Meanwhile, by constructing the ‘knapsack,’ we reduce the impact of process variation on detection accuracy because the process variation in the two sets of power consumption is balanced.