Testing for Hardware Trojans: A Game-Theoretic Approach

ABSTRACTThe tremendous advancement in very large scale integration technology encourages chip designers to rely on commercial electronic design automation tools, offshore fabrication services, and outsourced intellectual property cores. As third-party involvement are more in chip design cycle, integrated circuits (IC) such as programmable logic devices (PLD) and application specific ICs (ASIC) are highly vulnerable to hardware Trojan (HT) attacks. HTs are malicious additions or modifications to existing circuit elements, which can be inserted at any stages of IC life cycle to modify/destroy the functionality, reduce reliability, leak sensitive information, etc. Besides, HT can be designed either as always on or triggered only under certain operating conditions. For example, HT attacks in safety critical applications such as nuclear power plant, space and defence will jeopardise the safety and security of the unit and cause serious consequences. Hence, it is most important to ensure that the chip being in use performs only the intended function. In this paper, an in-depth analysis of feasible HT attacks in PLD and ASIC life cycles are presented. Based on the extensive literature survey on HTs and their countermeasure techniques, the state of the art HT prevention, detection, and diagnosis techniques are recommended to the valid stages of PLD and ASIC life cycles. Therefore, incorporating possible HT defence solutions in respective phases of PLD/ASIC-based safety systems thwart them against HT attacks.

Recently, there are various methods for detecting the hardware trojans (HTs) in the integrated circuits (ICs). The circuit's logic representations of different types, structures, and functional characteristics should be different. Each type of circuit has its' own performance characteristics according to its' purpose. However, the traditional HTs detection methods adopt the same approach to deal with the multi-purpose hardware trojan. At the same time, as the scale of integrated circuits growing, the structures are more complex, and the functions are more refined. The current situation makes the traditional HTs detection methods weaker and even unfeasible. Therefore, we propose an HTs classified locating method based on machine learning, named ML-HTCL, which belongs to the static detection and locating method. In ML-HTCL, different purpose HTs were represented by different features. Due to the different features, the ML-HTCL employs the multi-layer BP neural network for the control signal type HTs and the one-class SVM for the information leakage HTs, respectively. To deal with the HTs completely, the boundary nets are considered for all data set, while those were ignored by the most existing methods due to the high detection error rate. After detection, the HTs' precise locations were achieved. To evaluate the ML-HTCL, 17 gate-level netlist benchmarks are used for training and testing by leave-one-out cross-validation. From the results, the ML-HTCL reaches 85.05% of TPR and 73.91% of TNR for all kinds of HTs, which performs better than the most existing methods.

Over the years, system on chip (SoC) designs have evolved extensively sophisticated in order to fulfil the need of increasing complexity of running applications driven by the advancement of VLSI technology. The next generation multiprocessor system on chip (MPSoC) integrates hundreds of processing elements on a single chip, expected to achieve high performance, low latency, and low-power consumption. Tiled chip multicore processors (TCMP) with network on chip (NoC) have become a foundation for the computation critical embedded and real-time systems. Faster time-to-market restraint and business competition compelled manufacturers to look for the prospects of manufacturing SoCs integrated with various third party intellectual property (3PIP). Usage of 3PIP gave rise to exploit the underlying interconnect while adding some unwanted malicious circuit known as hardware trojan (HT), making NoC vulnerable to get attacked. A tiniest manipulation of any communication attribute by HT can degrade the overall behaviour of the system significantly while impacting NoC performance metrics. In this paper, we present one of such study considering HT malign behaviour of manipulating the output port of each incoming flit from specific ports once genuine route computation takes place and re-directs all to one port causing disruption in tile communication.The proposed HT is intermittent in nature and activates for few cycles. We study the behaviour of proposed confluence attack and analyze its impact over network level. The empirical evaluation exhibits the misbehaviour of the packet communication in terms of wrong usage of VCs and extra hop distance overhead. To validate the proposed work, various performance metrics like buffer utilization, virtual channel utilization, number of flits processed, link utilization, and the like are analyzed. We also show that such HTs are difficult to detect due to marginal increase at malicious port traffic leaving no trace of malicious conduct.

In modern integrated circuit (IC) designs, intellectual property (IP) cores are often outsourced and designed by third-party vendors, resulting in the partial relinquishment of the control over the IC design flow. Thus, reliable verifications are required to mitigate the threat of hardware Trojans (HTs) which may be inserted into IP cores by malicious vendors. Existing trustiness verification methods cannot take the merit of high efficiency and accuracy at the same time. In this paper, we propose a multilevel fast trustiness verification framework based on feature analysis to detect HTs in third-party digital IP cores. The proposed framework combines flip-flop level and combinational logic level feature analysis to achieve both high efficiency and accuracy. Experimental results demonstrate that both explicitly and implicitly triggered HTs can be detected in very short time with a negligible false positive rate. More importantly, our framework has the unique advantage of being scalable to defend against future and stealthier HTs by adding new features into the framework.

Integrated Circuits (ICs) are the cardinal elements of modern electrical, electronic and electro-mechanical systems. Amid global outsourcing of ICs' design and fabrication and their growing applications in smart manufacturing or Industrie 4.0, various hardware security threats and issues of trust have also emerged. IC piracy, counterfeiting, and hardware Trojans (HTs) are some of the key hardware threats that merit the attention of manufacturing community. It is worth noting that the lower abstraction levels (ICs) are falsely assumed to operate securely. The proposition, therefore, is that if an operating system (higher abstraction level) is considered to be secure while operating on a compromised IC (lower abstraction level), would it be prudent to regard this implementation as secure? The purpose of this paper is to highlight IC level threats with an emphasis on hardware Trojans that pose a significant threat to smart manufacturing environment in the wake of Industrial Internet of Things (IIoT).

Praise for Signal Integrity Effects in Custom IC and ASIC Designs For the first time, this book is taking a closer look at the signal integrity problems faced by both high-performance and cost-performance applications, digital and mixed-signal integrated circuits. --Alina Deutsch, Research Staff Member, T.J. Watson Research Center, International Business Machines book surveys the latest literature on electrical integrity analysis and design and is, therefore, an invaluable resource for anyone designing systems-on-a-chip. --Kenneth L. Shepard, Professor, Columbia University book offers a tutorial guide to IC designers who want to move to the next level of chip design by unlocking the secrets of signal integrity. --Jake Buurma, Senior Vice President, Worldwide Research & Development, Cadence Design Systems, Inc. collection of papers...is the most comprehensive syllabus of important results for researchers and designers on the topic. I highly recommend to read it and to pay attention to the messages given by the papers of the collection. --Alberto Sangiovanni-Vincentelli, Professor, University of California Berkeley The editor has gathered together a collection of papers, both tutorial and advanced, that address a broad range of interconnect problems. --Jacob White, Professor, Massachusetts Institute of Technology Signal Integrity Effects in Custom IC and ASIC Designs compiles recent expert research papers in state-of-the-art IC (Integrated Circuits) design. It offers a detailed focus on all the major topics in understanding and modeling real-world IC signal integrity issues for CAD and IC design engineers, as well as graduate engineering students. Practical, in-depth discussion of interconnect effects, inductance effects, power grid and distribution noise, and substrate noise and coupling is included. This specialized coverage provides the knowledge necessary to overcome serious problems in new, more complicated IC designs, such as:Wired and wireless communications ICs Large custom analog mixed-signal ICs ASIC designs from 0.12 microns and above Integrated custom IC blocks in ASIC (Applications-Specific Integrated Circuit) designs

To reduce the cost of integrated circuit fabrication, a designer often submits layout masks to an untrusted foundry. Contingent on the sensitivity of the project, the cost-reduction benefit can become limited or eliminated due to the lack of security and control in an untrusted environment. Control of the design, components, and intellectual property is lost during the manufacturing step, giving an adversary the opportunity to compromise the integrated circuit. With low probability of detection, a malicious agent can insert extra circuitry in strategic locations and exfiltrate sensitive data or compromise functionality and reliability. The extra circuits are called hardware Trojans. Our project, the Automated Iterative Reverse Engineer, leverages image processing and computer vision techniques to compare the original designer's ideal GDS2 design layout to real-world micro-scopic images of the fabricated integrated circuit. Our previous work in Image Stitch Assembly and Multimodal Image Matching for Hardware Security provides a framework to leverage our Differential Image Transform and facilitate greater execution speed and higher quality matching between the ideal and real-world cases. As our data shows, the high-quality matching yields reliable mismatched areas to better indicate the presence of hardware Trojans.

Hardware Trojans are malicious changes to the design of integrated circuits (ICs) at different stages of the design and fabrication process. Different approaches have been developed to detect Trojans namely non-destructive and destructive testing. However, none of the previously developed methods can be used to detect all types of Trojans as they suffer from a number of disadvantages such as low speed of detection, low accuracy, low confidence level, and poor coverage of Trojan types. Majority of the hardware Trojans implemented in an IC will leave a footprint at the active layer. In this paper, we propose a new technique based on rapid backside SEM imaging and advanced computer vision algorithms to detect any subtle changes at the active region of transistors that can show the existence of a hardware Trojan. Here, we are only concerned with untrusted foundry problem, where it is assumed the attacker has access to a golden layout/image of the IC. This is a common threat model for those organizations that fully design their IC but need access to untrusted foundry for fabrication. SEM image from a backside thinned golden IC is compared with a low-quality SEM image of an IC under authentication (IUA). We perform image processing to both golden IC and IUA images to remove noise. We have developed a computer vision-based framework to detect hardware Trojans based on their structural similarity. The results demonstrate that our technique is quite effective at detecting Trojans and significantly faster than full chip reverse engineering. One of the major advantages of our technique is that it does not rely on the functionality of the circuit, rather the real physical structure to detect malicious changes performed by the untrusted foundry.

Globalization in the semiconductor industry enables fabless design houses to reduce their costs, save time, and make use of newer technologies. However, the offshoring of Integrated Circuit (IC) fabrication has negative sides, including threats such as Hardware Trojans (HTs) – a type of malicious logic that is not trivial to detect. One aspect of IC design that is not affected by globalization is the need for thorough verification. Verification engineers devise complex assets to make sure designs are bug-free, including assertions. This knowledge is typically not reused once verification is over. The premise of this paper is that verification assets that already exist can be turned into effective security checkers for HT detection. For this purpose, we show how assertions can be used as online monitors. To this end, we propose a security metric and an assertion selection flow that leverages Cadence JasperGold Security Path Verification (SPV). The experimental results show that our approach scales for industry-size circuits by analyzing more than 100 assertions for different Intellectual Properties (IPs) of the OpenTitan System-on-Chip (SoC). Moreover, our detection solution is pragmatic since it does not rely on the HT activation mechanism.

We report our experiences in designing and implementing several hardware Trojans within the framework of the Embedded System Challenge competition that was held as part of the Cyber Security Awareness Week (CSAW) at the Polytechnic Institute of New York University in October 2008. Due to the globalization of the Integrated Circuit (IC) manufacturing industry, hardware Trojans constitute an increasingly probable threat to both commercial and military applications. With traditional testing methods falling short in the quest of finding hardware Trojans, several specialized detection methods have surfaced. To facilitate research in this area, a better understanding of what Hardware Trojans would look like and what impact they would incur to an IC is required. To this end, we present eight distinct attack techniques employing Register Transfer Level (RTL) hardware Trojans to compromise the security of an Alpha encryption module implemented on a Digilent BASYS Spartan-3 FPGA board. Our work, which earned second place in the aforementioned competition, demonstrates that current RTL designs are, indeed, quite vulnerable to hardware Trojan attacks.

Fabrication of Integrated Circuits (ICs) is outsourced to third-party foundries to decrease time to market and production cost. Outsourcing renders the ICs vulnerable to malicious modifications. These malicious circuit modifications, known as Hardware Trojans (HTs), tamper with the integrity of intellectual property cores and hence, must be detected accurately. A highly accurate method for detecting HTs is through time-consuming physical inspection of reverse-engineered chips. Apparently, physically inspection of all suspected chips is unrealistic. Therefore, the knowledge gained from reverse engineering a single infected IC should be used to detect trojans non-invasively in other ICs. The extra malicious logic, in other suspected chips, can be triggered using suitable test patterns leading to its detection. In order to facilitate detection using test patterns, however, the HT should be mapped to the golden circuit, and automated tools should be used to find appropriate patterns. In this work, we explore the feasibility of this two-step methodology for HT detection by discussing the required steps and identifying the unsolved challenges in each step.

Through the Internet of Things (IoT), everything is connected remotely through a network, allowing smart environments to be created. The IoT will play a central role in every aspect of our daily lives, from toys to healthcare. The security of IoT devices is the most crucial concern. In this chapter, we will discuss hardware vulnerabilities in IoT devices that pose major threats to data transfer. Researchers focus on finding the major vulnerabilities and limitations of proposed countermeasures for IoT devices’ hardware security issues. Modern electronic hardware used in IoT systems consists mostly of interconnected integrated circuits, so hardware security directly affects integrated circuit security. Malicious modifications to integrated circuits are carried out in untrusted fabrication units by Hardware Trojans. Since these Hardware Trojans are stealthy, most of the detection schemes require a gold chip for measuring the side channels. In the existing Trojan detection schemes, false-positive and false-negative detections are possible because of process variation. As a result, this chapter provides an overview of the hardware security challenges with Hardware Trojans associated with IoT devices used in smart environments.

Integrated Circuits (ICs) are sensible to a wide range of (passive, active, invasive, non-invasive) physical attacks. In this context, Hardware Trojans (HTs), that are malicious modifications of a circuit by an untrusted manufacturer, are one of the most challenging threats to mitigate. HTs aim to alter the functionality of the infected chip in a malicious way, e.g. under specific conditions known by the adversary. Fault attacks are a typical attack vector. However, for a HT to be exploitable by an adversary, it also has to be stealthy. For example, a HT that would directly inject exploitable faults in a block cipher may be spotted by analyzing its functional behavior (i.e. the positions and the distribution of the faulty values appearing). In this paper, we propose a stealthy HT instance leading to successful and hidden Statistical Fault Attacks (SFA). More precisely, the faults are injected when the chip is running under condition for which metastabilty occurs (i.e. with a increased clock frequency), leading to the apparition faults at random positions within the target implementation. In addition, an internal bit is set to a value known only by the adversary, allowing him to perform efficient SFA. Compared to classical SFA, the HT uses its control on the target to circumvent behavioral detection tests. Indeed, it also adds computation errors in the early rounds of the target cipher which are not exploitable via SFA.

Integrated Circuits (ICs) are suffering severer threats caused by Hardware Trojans (HTs), some of which hide in routine operations by coercing firmware or hardware. Along with conventional side-channel detection not always getting golden-chip, HTs become more difficult to detect. An improved Support Vector Machine (SVM) machine learning frameworks for this is proposed using system-level side-channel analysis. Cross validation experimental results on Field Programmable Gate Array (FPGA) show that in the condition of golden-chip, supervised SVM achieves 85.8% test accuracy in average. After grouping, outlier-removing and normalization, it rises by 4%. Even if golden-chip is out of hand, semi-supervised SVM has accuracy to judge HTs existence, averaging in 52.9%-79.5% under different test modes. Comparing with existing researches, this work verifies the efficiency of SVM for HT detection in instruction level, and points out the relationship between diversified learning conditions with detection performance.

Hardware Trojans pose a serious threat to the expected functionality, performance, and security of integrated circuits (ICs). Many of the existing techniques for detection of hardware Trojans require the use of a “golden IC.” The golden IC is a fabricated instance of the design which is required to be free of Trojans and is used as a reference to verify the responses obtained from an IC under authentication. However identification and even existence of a golden IC may not be possible. In light of these challenges, techniques are desired which can detect a hardware Trojan without the need for a golden IC. This chapter gives an overview of golden-free Trojan detection.