Hardware Trojan Detection Research Articles

A Demonstration of a HT-Detection Method Based on Impedance Measurements of the Wiring Around ICs

Threats that cause malicious function such as information leakage and denial of service by adding hardware trojan (HT) to a device constructed using inexpensive elements at component level after shipment have been reported. The detection method after shipment, which is different from HT detection inside IC is required because of the easiness adding component-level HT to products. The testing method to detect modification on board will achieve the detection of component-level HT. In this brief, we focus on the HT implemented in the wiring connected to integrated circuits. Since the component connection constantly affects the impedance of the wiring, we propose a detection method for such HT implemented outside the IC by measuring the change in the impedance of the wiring. For the detection of malicious modification after shipment it is necessary to excite a pulse signal from the IC that achieves high security, such as a secure microcomputer, and observe the signal reflected inside the secure IC by the discontinuous portion of the impedance on the board. If the reflected signal is different from the shipping test, it can be judged that HT is mounted. We adopted time domain reflectometry (TDR) to realize the above method, and we demonstrate experimental result of component-level HT detection using TDR with measuring instrument and TDR from secure IC. As a result, a significant change in the amplitude due to the impedance change was obtained from the reflected wave measured inside the IC with and without the MOSFET used as the HT using this method.

OERCA: A Novel Approach for Hardware Trojan Detection Based on Combinatorial Testing

OERCA: A Novel Approach for Hardware Trojan Detection Based on Combinatorial Testing

Improving hardware Trojan detection using scan chain based ring oscillators

In recent years, the security of integrated circuits (ICs) has received more attention as usage of ICs made by untrustworthy foundries has increased in safety-critical systems [1]. In this paper, we introduce a novel approach for fingerprinting the delay of functional paths in a sequential circuit that have millions of transistors, like processors. We present a method for inserting Ring Oscillators (ROs) into scan chain for measuring the delay of each functional path inside the chip.Using the proposed method, the payload part of Trojans will be detected according to their size and cell types. Our method can be used by power-based Trojan detection approaches for finding the trigger part of Trojans. We also introduce an algorithm for quantifying the vulnerability of the nets. We show that a designer can achieve a good trade-off between area overhead reduction and security enhancement while evaluating the vulnerability degree of each net.

Hardware Trojan Detection Using the Order of Path Delay

Many fabrication-less design houses are outsourcing their designs to third-party foundries for fabrication to lower cost. This IC development process, however, raises serious security concerns on Hardware Trojans (HTs). Many design-for-trust techniques have been proposed to detect HTs through observing erroneous output or abnormal side-channel characteristics. Side-channel characteristics such as path delay have been widely used for HT detection and functionality verification, as the changes of the characteristics of the host circuit incurred by the inserted HT can be identified through proper methods. In this article, for the first time, we propose a two-phase technique, which uses the order of the path delay in path pairs to detect HTs. In the design phase, a full-cover path set that covers all the nets of the design is generated; meanwhile, in the set, the relative order of paths in path pairs is determined according to their delay. The order of the paths in path pairs serves as the fingerprint of the design. In the test phase, the actual delay of the paths in the full-cover set is extracted from the fabricated circuits, and the order of paths in path pairs is compared with the fingerprint generated in the design phase. A mismatch between them indicates the existence of HTs. Both process variations and measurement noise are taken into consideration. The efficiency and accuracy of the proposed technique are confirmed by a series of experiments, including the examination of both violated path pairs incurred by HTs and their false alarm rate.

Creation and Detection of Hardware Trojans Using Non-Invasive Off-The-Shelf Technologies

As a result of the globalisation of the semiconductor design and fabrication processes, integrated circuits are becoming increasingly vulnerable to malicious attacks. The most concerning threats are hardware trojans. A hardware trojan is a malicious inclusion or alteration to the existing design of an integrated circuit, with the possible effects ranging from leakage of sensitive information to the complete destruction of the integrated circuit itself. While the majority of existing detection schemes focus on test-time, they all require expensive methodologies to detect hardware trojans. Off-the-shelf approaches have often been overlooked due to limited hardware resources and detection accuracy. With the advances in technologies and the democratisation of open-source hardware, however, these tools enable the detection of hardware trojans at reduced costs during or after production. In this manuscript, a hardware trojan is created and emulated on a consumer FPGA board. The experiments to detect the trojan in a dormant and active state are made using off-the-shelf technologies taking advantage of different techniques such as Power Analysis Reports, Side Channel Analysis and Thermal Measurements. Furthermore, multiple attempts to detect the trojan are demonstrated and benchmarked. Our simulations result in a state-of-the-art methodology to accurately detect the trojan in both dormant and active states using off-the-shelf hardware.

Symbolic execution based test-patterns generation algorithm for hardware Trojan detection

Hardware Trojan detection is a very difficult challenge. However, the combination of symbolic execution and metamorphic testing is useful for detecting hardware Trojans in Verilog code. In this paper, symbolic execution and metamorphic testing were combined to detect internal conditionally triggered hardware Trojans in the register-transfer level design. First, control flow graphs of Verilog code were generated. Next, parallel symbolic execution and satisfiability modulo theories solver generated test patterns. Finally, metamorphic testing detected the hardware Trojans. The work used Trust-Hub benchmarks in experiments.

Hardware Trojan Detection Using an Advised Genetic Algorithm Based Logic Testing

Today, outsourced manufacturing of integrated circuit designs are prone to a range of malicious modifications of the circuitry called Hardware Trojans. HTs can alter the functionality of a circuit, leak secret information and initiate other possible malicious actions. HTs are activated in a very rare condition known by an intruder. Therefore, a group of HT detection methods tries to activate the HT circuitry by crafting test vectors. In this paper, we propose a logic testing based HT detection method using an advised genetic algorithm which creates effective test vectors, the so-called TRIAGE (hardware TR ojan detectI on using an A dvised G enetic algorithm based logic tE sting). The key contribution of this paper is to present a proper fitness function for the genetic algorithm providing better evaluation of the test vectors. The controllability, observability and transition probability factors of rare nodes have been considered in the fitness function. Simulation results indicate 80% reduction in generation time for test sets (on average) as compared to the previous work. On the other hand, reduced generation time for test vectors has been associated with an increase in trigger coverage. The coverage of the TRIAGE method for very hard to trigger Trojans increases by about 23% due to high efficiency of the proposed fitness function for the genetic algorithm.

Hardware Trojan Detection in Third-Party Digital Intellectual Property Cores by Multilevel Feature Analysis

In modern integrated circuit (IC) designs, intellectual property (IP) cores are often outsourced and designed by third-party vendors, resulting in the partial relinquishment of the control over the IC design flow. Thus, reliable verifications are required to mitigate the threat of hardware Trojans (HTs) which may be inserted into IP cores by malicious vendors. Existing trustiness verification methods cannot take the merit of high efficiency and accuracy at the same time. In this paper, we propose a multilevel fast trustiness verification framework based on feature analysis to detect HTs in third-party digital IP cores. The proposed framework combines flip-flop level and combinational logic level feature analysis to achieve both high efficiency and accuracy. Experimental results demonstrate that both explicitly and implicitly triggered HTs can be detected in very short time with a negligible false positive rate. More importantly, our framework has the unique advantage of being scalable to defend against future and stealthier HTs by adding new features into the framework.

Thermal maps based HT detection using spatial projection transformation

Hardware Trojan (HT) is increasingly becoming a serious problem in the information security field. Compared to other countermeasures, thermal maps based detection can mitigate process variation (PV) and have a higher accuracy. However, HT cannot be differentiated from the others directly from the original thermal maps. Therefore, in this study, the authors first propose a general HT detection framework based on difference temperature matrix, and introduce the PV mitigation mechanism. Then, they demonstrate how principal component analysis can implement spatial projection transformation and expose HT signal. Finally, they introduce their experimental setup and design, and then validate their countermeasure with Xilinx field programmable gate arrays which are configured with the pure AES circuit and the infected AES circuits. The power proportions (PPs) of HTs in the different infected AES circuits are various. The experimental results indicate that their proposed countermeasure can clearly detect HT with 0.14% small PP.

Detection of Hardware Trojan Based on Rare Trigger Multiple Excitation

In this paper, through the analysis of node for low turnover rate, we put forward a new method to generate test vector, and based on the node of the incentive for many times, for low turnover rate can significantly increase the Trojan detection sensitivity, in order to better the combination of side channel detection method for hardware Trojan detection. This paper puts forward several important contributions: 1) it provides detailed statistical method to generate test vector, it can generate high quality test vector, in any small Trojan instance is created in high relative activities; 2) it analyzes the effectiveness of the generated test vector in the Trojan coverage, and greatly improves the sensitivity of the side channel. The simulation results show that the test can significantly increase the sensitivity of the Trojan horse, so that the Trojan detection is more effective for the side channel analysis.

Securing Medical Devices Against Hardware Trojan Attacks Through Analog-, Digital-, and Physiological-Based Signatures

Corruption of data in embedded and medical devices can cause serious harm if not quickly detected. In this paper, we emphasize the part of the attack surface which entails inserting malicious hardware circuitry (Hardware Trojans) during the manufacturing process of a digital microchip. The Hardware Trojan (HT) is composed of a few gates and attempts to modify the functionality of the chip. Such types of extremely small HTs are hard to detect using other conventional offline HT detection methods, such as side-channel analysis and digital systems test techniques. In our approach, however, we focus on an online method for rapidly detecting HTs at runtime by checking for correct functionality of the underlying hardware. We present an architecture that addresses these threats by splitting the design into a two-chip approach where we generate signatures deep in the hardware during data harvesting, and we then check for these signatures during data processing and encryption for transmission. In addition, we take advantage of known physiological relationships between medical data to ensure the integrity of the data that is processed by the hardware. Our experimental results demonstrate the effectiveness of our HT detection architecture and show that not only can we detect such types of attacks but also that we can distinguish these attacks from actual health problems. Our synthesis results show that our architecture minimally impacts performance and area especially in light of the fact that most of our techniques rely on digital logic modules which are already typically present in modern digital chips for test and other purposes.

Hardware Trojan detection and localization based on local detectors

Hardware Trojans are one of the serious threats with detrimental, irreparable effects on the functionality, security, and performance of digital integrated circuits. It is difficult to detect Trojans because of their diversity in size and performance. While the majority of current methods focus on Trojan detection during chip testing, run-time techniques can be employed to gain unique advantages. This paper proposes a method based on the online scalable detection technique, which eliminates the need for a reference chip. Involving local detectors, this technique assesses the variations in the logical values of each node to find out whether there are Trojans. This method excludes time and power measurements, which are common parameters in most conventional methods. The detectors provide Trojan-localization capability in our proposed technique. Two remarkable features of this technique are low power and low area overhead. The results are reported by simulation and implementation of common benchmarks, which show the high Trojan detection rate of the proposed method.

Hardware Trojan detection by timing measurement: Theory and implementation

Due to outsourcing of chip product chain, hardware is vulnerable to be attacked. For example, an attacker who has access to hardware fabrication process can alter the genuine hardware with insertion of concealed hardware elements (Hardware Trojan). Microelectronic circuits are almost always a part of hardware devices, so microelectronic circuit Hardware Trojan (HT) detection becomes a key aspect in hardware security. A novel microelectronic HT detection circuit based on timing analysis is proposed in this paper. The detection circuit can be adopted in combinational and sequential microelectronic circuits. The proposed technique is implemented in IBM 90 nm CMOS process and Xilinx ISE FPGA. Based on experimental results, with one detection circuit embedded in testing-path, an HT with size that is 2.81% of host-circuit size is detectable at detection probability of 90% with a 10% probability of a false positives. Both detectable HT size and detection probability can be improved by adding more detection circuits to testing-path. The probability of false positives is controlled by the testing clock period.

A Side-Channel Analysis for Hardware Trojan Detection Based on Path Delay Measurement

Hardware Trojan Horses (HTHs) are malicious modifications inserted in Integrated Circuit during fabrication steps. The HTHs are very small and can cause damages in circuit function. They cannot be detected by conventional testing methods. Due to dangerous effects of them, Hardware Trojan Detection has become a major concern in hardware security. In this paper, a new HTH detection method is presented based on side-channel analysis that uses path delay measurement. In this method, we find and observe the paths that Trojans have most effect on them. Most of the previous works add some structures to the circuit and need a large overhead cost. But, in our method, there is no modification in the circuit and we can use it for testing the circuits received after fabrication. The proposed method is evaluated with Xilinx FPGA over a number of test circuits. The results show that measuring the delays on 20 paths with an accuracy of 0.01[Formula: see text]ns can detect more than 80% of Trojans.

Detection of Malicious Circuitry using Transition Probability Based Node Reduction Technique

In recent years, serious concerns have been raised against the tampering of integrated circuits due to outsourcing of circuits for fabrication. It has led to the addition of malicious circuitry known as Hardware Trojan. In this paper, a transition probability based node reduction technique for faster and efficient Hardware Trojan (HT) detection has been attempted. In the proposed method, the fact that the least controllable and observable nodes or the nodes with least transition probability are more vulnerable as Trojan sites is taken into consideration. The nodes that have lesser activity than the threshold are the candidate nodes. At each candidate node, segmentation is done for further leakage power analysis to detect the presence of Trojans. Experimental results observed on ISCAS’85 and ISCAS’89 benchmark circuits illustrate that the proposed work can achieve remarkable node reduction upto 78.81% and time reduction upto 58.7%. It was also observed that the circuit activity can be increased by varying the input probability. Hence, for further reduction in the Trojan activation time, the weighted input probability was obtained.

Golden-Free Processor Hardware Trojan Detection Using Bit Power Consistency Analysis

Processor is the core chip of modern information system, which is severely threatened by hardware Trojan. Side-channel analysis is the most promising method for hardware Trojan detection. However, most existing detection methods require golden chips as reference, which significantly increases the test cost and complexity. In this paper, we propose a golden-free detection method that exploits the bit power consistency of processor. For the data activated processor hardware Trojan, the power model of processor is modified. Two decomposition methods of power signal are proposed: the differential bit power consistency analysis and the contradictory equations solution. With the proposed method, each bit power can be calculated. The bit consistency based detection algorithms are proposed, the deviation boundaries are obtained by statistical analysis. Experimental measurements were done on field programmable gate array chip with open source 8051 core and hardware Trojans. The results showed that the differences between the two methods were very small. The data activated processor hardware Trojans were detected successfully.

ESCALATION: Leveraging Logic Masking to Facilitate Path-Delay-Based Hardware Trojan Detection Methods

Hardware Trojan (HT), intellectual property (IP) piracy, and overproduction of integrated circuit (IC) are three threats that may happen in untrusted fabrication foundries. HTs are malicious circuitry changes in the IC layout. They affect side-channels (IC parameters) such as path-delay or power consumption. Therefore, HT detection methods based on side-channel analysis have been proposed. They can detect an HT only if its effects on side-channels are significant among the alteration of side-channels, caused by process1 and environment2 variations. IC design modifications at different abstraction levels have been proposed to facilitate HT detection methods after fabrication, such as modifying a circuit to make the paths3 of the circuit more sensitive to HTs. Such modifications are known as design-for-trust (DfTr). In addition, key-based modifications have been proposed to protect IPs/ICs from IP piracy and IC overproduction. This approach is known as masking or obfuscation, and it modifies a circuit such that it does not correctly work without applying a correct key. In this work, we propose a DfTr method based on leveraging the masking approach. It improves HT detection methods based on path-delay analysis. As a matter of fact, the delay of shorter paths varies less than that of longer ones. Therefore, the objective of the proposed DfTr is to generate fake short paths for nets that only belong to long paths. Our layout level experiments show that the proposed DfTr masks the functionality of circuits and, on average, increases the HT detectability of path-delay-based detection methods by 10%.

Behavioral-level hardware trust: Analysis and enhancement

Hardware IPs are mostly presented in Register Transfer Level (RTL) description. Although considerable attention has been paid to hardware Trojan detection and design-for-trust at gate level and lower levels, so far there have been few methods at RT Level and behavioral RTL. We propose an approach to analyze circuit susceptibility to Trojan at the behavioral level, based on controllability analysis. We propose three design-for-trust methods, which reduce circuit vulnerability to hardware Trojans by increasing the probability of Trojan detection. We use side-channel Trojan detection method based on power consumption to evaluate Trojan detection probability. Our proposed methods can improve Trojan detection probability by up to 5 times, with negligible hardware overhead.

Self-Reference-Based Hardware Trojan Detection

Outsourcing of the chip product chain makes hardware vulnerable to be attacked. For example, an attacker who has access to hardware fabrication process can alter the genuine hardware with the insertion of concealed hardware elements [hardware Trojan (HT)]. Therefore, microelectronic circuit HT detection becomes a key step of chip production. A self-reference-based power-analysis microelectronic circuit HT detection methodology is proposed in this paper. The detection method is implemented in 90-nm CMOS process. Based on simulation results, our proposed technique can detect HTs with areas that are 0.013% of the host-circuitry. ISCAS benchmarks are used to evaluate efficiency of the developed method.

Thermal images based Hardware Trojan detection through differential temperature matrix

Insertions of Hardware Trojan result in unexpected harm to integrated circuits, and will change the characteristics of integrated circuits, such as thermal characteristics. In this paper, we proposed a Hardware Trojan detection method based on differential temperature matrix analysis. The matrix includes 750 differential thermal images data which were obtained from two differences between the testing chips and the golden chip, and the matrix shows each pixel’s differential temperature value from thermal image and provides a novel insight to investigate the impact of Trojan. During experiment procedure, many programmable heating modules were distributed in chips to interfere with Trojan detection. Experimental results show that Trojan insertion could increase the differential temperature, and expand the density distribution of differential temperature at the same time. The proposed method can achieve effective and accurate detection result, Trojan with only a logical gate size has been detected and located in two proportions of logic units occupied between Trojan and programmable heating modules, the proportions are 0.45% and 0.29%, respectively.