Two Countermeasures Against Hardware Trojans Exploiting Non-Zero Aliasing Probability of BIST

Area-efficient high-coverage LBIST

Fabless semiconductor industry and government agencies have major impact on the security and trustworthiness of the integrated circuits (IC) underlying the sensitive fields and critical applications. Hardware Trojan has arisen more attentions to its detection and prevention methods in the recent years. In order to ensure the reliability and trustworthiness of integrated circuits, we propose a novel test pattern optimization approach based on ring oscillator network, which can select an optimal test pattern sets to maximize the switching activity of the sub-region. An optimal test pattern sets we select using this approach can efficiently activate the hardware Trojan inserted into this sub-region. Meanwhile, we exert these test patterns to circuit under test separately and perform side channel analysis to distinguish the minor difference of dynamic power between the trusted and un-trusted chips. In this paper, we have set up an automatic test platform to carry out side-channel analysis experiment. Experimental results demonstrate that we can easily achieve about 0.8 % Trojan detection resoultion.

DFT (Design for Testability) is a methodology of testing for manufacturing defects in a chip. DFT consists of scan, ATPG (Automatic test pattern generation) methodologies and the BIST (Built in self-test) methods. This paper explores ATPG for pattern generation and LBIST (Logic built-in self-test) for testing. LBIST is explored and tested using pseudorandom test pattern generation. The fault list created for undetected faults are dumped into ATPG and fault specific test patterns are generated. These patterns detect the random pattern resistant faults (which are undetected by pseudorandom testing patterns). Further, a smart compression algorithm is defined to compress the pattern which can be stored inside the chip for LBIST testing, with no added memory overhead, and the minimum extra hardware (which only comprises of combinational logic). The proposed algorithm has been reviewed and analyzed and it has been found that the fault coverage achieved is 86.01%.

Design and manufacturing challenges posed by the increasing transistor count and shrinking feature size in modern chips have significantly heightened the occurrence of defects. As a result, rigorous testing has become indispensable in the VLSI design process. Unfortunately, amidst the lengthy design cycles, test procedures often take a back seat, overshadowed by the primary focus on design development. To ensure high quality and reliability, it is imperative that any VLSI design be entirely fault-free before deployment. Design for Testability (DFT) techniques play a crucial role in facilitating error detection and ensuring robustness during testing phases. Among these techniques, Logic Built in Self-Test (LBIST) stands out for its effectiveness in achieving comprehensive fault coverage. Here it is implemented LBIST with a focus on enhancing fault coverage for a 16-bit test pattern using SFRG (Seed Flipping Ring Generator). This approach not only maximizes fault detection capabilities but also optimizes area and power efficiency compared to alternative pattern generators. By leveraging this test pattern, we aim to address the growing complexity and reliability demands of modern integrated circuits effectively. The code is written in HDL language with Verilog code, and it is implemented using Xilinx Vivado software tool.

While technology is being developed, design rules undergo a number of revisions. An initial lithography model built with test patterns before the revisions inherently become inaccurate for the revised patterns. Preparing a new test layout and updating a lithography model every time design rules are revised is not practical, and cannot be a solution. We prepare some synthetic patterns in addition to initial test patterns. Synthetic patterns originate from popular test pattern generator (TPG), while projected design rule changes are taken into account. A challenge is to sort out the synthetic patterns which are really necessary in building a generic lithography model when they are used together with test patterns. Each pattern, either synthetic or test, is identified in image parameter set (IPS) space. For each test pattern in IPS space, two concentric spheres are drawn; outer one indicating the region where revised versions of test pattern may exist, and inner one indicating the region which is well covered by test pattern alone. Synthetic patterns that reside in the region bounded by the two spheres are kept, while the others are dropped. Clustering is now performed on test patterns and synthetic patterns separately, and representative pattern is drawn from each cluster. When a set of representative patterns are used to build a lithography model in 10nm memory devices, it achieves 43.5% lower CD root mean square error (RMSE) for revised design layout compared with only using a set of initial test patterns.

Techniques for SAT-based constrained test pattern generation

Adaptive path-delay testing is a testing methodology that reduces redundant test patterns based on the measured process condition of a die under test (DUT). To improve testing efficiency, process conditions are clustered into a limited number of clusters, each of which has a corresponding set of test patterns. The test pattern set of a cluster must include all potential timing-critical paths of all process conditions in the cluster. Hence, high-quality clustering is needed to minimize redundant test paths. In this paper, we propose a new clustering heuristic to minimize the expected number of redundant test paths in adaptive path-delay testing. Our experimental results on randomly generated testcases show that the proposed clustering heuristic can reduce the expected number of test paths by up to 40% compared to the previous Greedy clustering algorithm of Uezono et al. [5]. To address unique attributes of an industrial testcase obtained from the authors of [5], we integrate the dynamic-programming restricted-partitioning technique of [1], which improves the expected number of test paths by up to 5% compared to the Greedy algorithm.

There have been reports of threats that cause electromagnetic information leakage by inserting Hardware Trojans (HT) into the signal traces around components on the printed circuit board (PCB). In this threat, the HT insertion is assumed not only at the manufacturing stage but also during the in-transit or in the field after shipment, and the threat may extend to devices that are not considered to be threatened by HT insertion implemented inside conventional ICs. This paper discusses the detection method for the HT insertion, which is implementable on a PCB without external measurement equipment. Additionally, we validate the method in more practical situations, detecting the HT on populated PCBs. The method employs an on-chip touch sensor to measure the changes in electrical characteristics caused by HT insertion. Specifically, HT insertion is detected by observing the change in capacitance and insulation resistance associated with HT insertion using the on-chip sensor, and detecting the difference from the measurement result when HT is not inserted to signal traces. In the experiment, we build an evaluation environment, which emulates a populated PCB, based on the HT insertion method reported in previous studies and observe the change in capacitance and insulation resistance on the connected signal trace using a microprocessor equipped with a constant current source and an analog-digital converter that constitute the on-chip sensor. Then, we show that HT insertion on the signal trace can be detected from the output values of the on-chip sensor before and after HT insertion.

Symbolic execution based test-patterns generation algorithm for hardware Trojan detection

After an integrated circuit (IC) design is complete, but before first silicon arrives from the manufacturing facility, the design team prepares a set of test patterns to isolate defective parts. Applying this test pattern set to every manufactured part reduces the fraction of defective parts erroneously sold to customers as defect-free parts. This fraction is referred to as the defect level (DL). However, many IC manufacturers quote defective part level, which is obtained by multiplying the defect level by one million to give the number of defective parts per million. Ideally, we could accurately estimate the defective part level by analyzing the circuit structure, the applied test-pattern set, and the manufacturing yield. If the expected defective part level exceeded some specified value, then either the test pattern set or (in extreme cases) the design could be modified to achieve adequate quality. Although the IC industry widely accepts stuck-at fault detection as a key test-quality figure of merit, it is nevertheless necessary to detect other defect types seen in real manufacturing environments. A defective-part-level model combined with a method for choosing test patterns that use site observation can predict defect levels in submicron ICs more accurately than simple stuck-at fault analysis.

Fabrication of Integrated Circuits (ICs) is outsourced to third-party foundries to decrease time to market and production cost. Outsourcing renders the ICs vulnerable to malicious modifications. These malicious circuit modifications, known as Hardware Trojans (HTs), tamper with the integrity of intellectual property cores and hence, must be detected accurately. A highly accurate method for detecting HTs is through time-consuming physical inspection of reverse-engineered chips. Apparently, physically inspection of all suspected chips is unrealistic. Therefore, the knowledge gained from reverse engineering a single infected IC should be used to detect trojans non-invasively in other ICs. The extra malicious logic, in other suspected chips, can be triggered using suitable test patterns leading to its detection. In order to facilitate detection using test patterns, however, the HT should be mapped to the golden circuit, and automated tools should be used to find appropriate patterns. In this work, we explore the feasibility of this two-step methodology for HT detection by discussing the required steps and identifying the unsolved challenges in each step.

Small gate delay faults (SDFs) are not detectable at-speed, if they can only be propagated along short paths. These hidden delay faults (HDFs) do not influence the circuit's behavior initially, but they may indicate design marginalities leading to early-life failures, and therefore they cannot be neglected. HDFs can be detected by faster-than-at-speed test (FAST), where typically several different frequencies are used to maximize the coverage. A given set of test patterns P potentially detects a HDF if it contains a test pattern sensitizing a path through the fault site, and the efficiency of FAST can be measured as the ratio of actually detected HDFs to potentially detected HDFs. The paper at hand targets maximum test efficiency with a minimum number of frequencies. The procedure starts with a test set for transition delay faults and a set of preselected equidistant frequencies. Timing-accurate simulation of this initial setup identifies the hard-to-detect faults, which are then targeted by a more complex timing-aware ATPG procedure. For the yet undetected HDFs, a minimum number of frequencies are determined using an efficient hypergraph algorithm. Experimental results show that with this approach, the number of test frequencies required for maximum test efficiency can be reduced considerably. Furthermore, test set inflation is limited as timing-aware ATPG is only used for a small subset of HDFs.

In this paper, we propose a novel test architecture called the pseudo-full scan (PFS) architecture to reduce test application time and power consumption simultaneously. We also present a test generation procedure to generate a set of test patterns that is suitable for the PFS architecture. The method reduces test application time and power consumption by (1) scanning only a fraction of the flip-flops, and (2) compressing the test vector sequence into a much shorter one. Experimental results show that our method has the advantages of reducing the test application time and power dissipation compared to the conventional scan methodology.

Hardware Trojans are an emerging threat that intrudes in the design and manufacturing cycle of the chips and has gained much attention lately due to the severity of the problems it draws to the chip supply chain. Hardware Typically, hardware Trojans are not detected during the usual manufacturing testing due to the fact that they are activated as an effect of a rare event. A class of published HTs are based on the geometrical characteristics of the circuit and claim to be undetectable, in the sense that their activation cannot be detected. In this work we study the effect of continuously monitoring the inputs of the module under test with respect to the detection of HTs possibly inserted in the module, either in the design or the manufacturing stage.

Parallel computing is widely utilized to speed up automatic test pattern generation (ATPG); however, most of today's parallel ATPGs are non-deterministic, which often leads to non-reproducible test pattern sets. This paper presents a fault-parallel test pattern generator: CPP-ATPG; it generates the same test pattern set regardless of the thread count and timing. Besides, it exhibits good speedup scalability as the thread count increases. These are achieved by the circular pipeline processing (CPP) principle, which guides the proposed parallel ATPG to preserve the task processing orders that are necessary to ensure ATPG determinism but with low inter-thread synchronization overhead. Furthermore, a multi-round test generation and compaction strategy is proposed to avoid possible test pattern inflation. Experimental results show that CPP-ATPG exhibits close-to-linear speedup for at least up to 12 threads.