Hardware Trojan Detection Research Articles

Process Variation-Resistant Golden-Free Hardware Trojan Detection through a Power Side Channel

With the globalization of the manufacturing supply chain, the malicious modification existing in the middle of distrust is becoming an important security issue on the chip. These modifications are called hardware Trojan (HT). HT is difficult to detect due to its high concealment and diversity of implementation. HT detection based on the side channel is a relatively effective detection method because it does not need to trigger the Trojan or destroy the chip. However, detection based on the side channel faces two major challenges. Firstly, the side channel detection is quite dependent on the golden model. The second one relates to the accuracy of the samples. Side channel information of the chip comes from the hardware manufacturing process and implementation, so it is obviously affected by process variation. In the existing work, many self-reference detection methods have been proposed to solve the problem of missing golden models. However, the existing methods often have special requirements for the circuit structure (such as the need for self-similar structures in the circuit). And, they can hardly resist process variation. This paper combines design and detection. We select the power consumption generated at different times and construct two self-reference ‘knapsack’ to detect HT. The solution proposed in this article is a kind of self-reference method, but we need neither self-similar structures nor the same state of some clocks in the circuit. Meanwhile, by constructing the ‘knapsack,’ we reduce the impact of process variation on detection accuracy because the process variation in the two sets of power consumption is balanced.

Detection of Unusual Thermal Activities in a Semiconductor Chip Using Backside Infrared Thermal Imaging

Abstract Rapid detection of hardware Trojans on a semiconductor chip that may run malicious processes on the chip is a critical and ongoing security need. Several approaches have been investigated in the past for hardware Trojan detection, mostly based on changes in circuit parameters due to Trojan activity. Chip temperature is one such parameter that is closely related to the degree of Trojan activity. This paper carries out backside infrared (IR) imaging of a two-die three-dimensional integrated circuit (3D IC) thermal test chip in order to detect unusual thermal activities on the chip. Four distinct image processing algorithms are evaluated and compared in terms of speed, accuracy, and occurrence of false positives and negatives. The impact of background thermal activity and finite duration of Trojan activity on the accuracy of detection is investigated. Within the parameter space tested in this work, the histogram method is found to be the most effective at Trojan detection in the 3D IC. Modifications in data analysis techniques are proposed that improve Trojan detection performance. This work may help develop thermal imaging as a means for real-time Trojan detection and enhancement of security of modern semiconductor chips, including 3D ICs.

Towards bidirectional LUT-level detection of hardware Trojans

FPGAs are field-programmable and reconfigurable integrated circuits; consequently, they entail numerous security concerns. For example, malicious functions such as hardware Trojans (HTs), can be inserted into the circuits in both development and deployment stages, as malicious fabrication and modification are possible even after deployment. Therefore, to detect HTs in FPGAs effectively, it is necessary to exploit both netlists available at the development stage and bitstreams available at deployment stage; this is in contrast with existing approaches, which require source code or gate-level netlists. In achieving this, we encounter two major challenges: effectively exploiting FPGA netlists closer to bitstreams for HTs detection and reverse-engineering bitstreams to netlists at an acceptable level. To address these problems, we develop a bidirectional mechanism for detecting HTs in FPGAs at any stage. To the best of our knowledge, this is the first study on bidirectional HT detection in FPGAs. To address the first challenge, we focus on LUT-level netlists; regarding the second challenge, we directly reverse-engineer bitstreams to LUT-level netlists. For HTs detection, we employ features extracted from LUT-level netlists, which can also be derived from reversed bitstreams and used to identify HTs. We design and implement our system for experimental studies. The experiments achieve a TPR of more than 99.3% and an FPR of less than 0.15% for 15 TrustHub benchmarks in forward and backward (reverse) directions for FPGA Virtex-5 devices.

On-Chip Thermal Profiling to Detect Malicious Activity: System-Level Concepts and Design of Key Building Blocks

This article introduces an on-chip anomaly monitoring system design approach that is based on thermal profiling and side-channel analysis. The strategy aims at the realization of nonintrusive hardware Trojan (HT) detection over the lifetime of the circuit under test (CUT). To evaluate the capability of the proposed HT detection system, the on-chip electrothermal coupling is modeled as part of the simulation technique, which associates local thermal activities with circuit-level power consumption using a standard electrical simulator. To monitor the thermal profiles on chips with high sensitivity to local temperature changes and the resilience to flicker noise, the sensor architecture described in this article is the first differential temperature sensor equipped with a chopping mechanism. A methodology is described to utilize principal component analysis (PCA) to extract critical information from the quantized output of the system for effective HT detection in the presence of noise. The complete sensor signal path of the system was designed and simulated with foundry-supplied device models (130-nm CMOS technology), and the impact due to process variations have been considered via Monte Carlo simulations. The results indicate that small Trojans with approximately 2 μW of power can be detected within the thermal profile of a CUT consuming more than 500 μW. As the first step to prove the feasibility of on-chip quantization in the HT detection system, a prototype 8-bit successive approximation register (SAR) analog-to-digital converter (ADC) was fabricated with 130-nm CMOS technology.

MaxSense

Detection of hardware Trojans is vital to ensure the security and trustworthiness of System-on-Chip (SoC) designs. Side-channel analysis is effective for Trojan detection by analyzing various side-channel signatures such as power, current, and delay. In this article, we propose an efficient test generation technique to facilitate side-channel analysis utilizing dynamic current. While early work on current-aware test generation has proposed several promising ideas, there are two major challenges in applying it on large designs: (i) The test generation time grows exponentially with the design complexity, and (ii) it is infeasible to detect Trojans, since the side-channel sensitivity is marginal compared to the noise and process variations. Our proposed work addresses both challenges by effectively exploiting the affinity between the inputs and rare (suspicious) nodes. The basic idea is to quickly find the profitable ordered pairs of test vectors that can maximize side-channel sensitivity. This article makes two important contributions: (i) It proposed an efficient test generation algorithm that can produce the first patterns in the test vectors to maximize activation of suspicious nodes using an SMT solver, and (ii) it developed a genetic-algorithm based test generation technique to produce the second patterns in the test vectors to maximize the switching in the suspicious regions while minimizing the switching in the rest of the design. Our experimental results demonstrate that we can drastically improve both the side-channel sensitivity (62× on average) and time complexity (13× on average) compared to the state-of-the-art test generation techniques.

Accelerating hardware security verification and vulnerability detection through state space reduction

Model checking is an effective technique for formal verification of hardware security properties in order to detect security vulnerabilities. However, a major challenge lies in state space explosion. In this work, we propose methods to accelerate hardware security verification and vulnerability detection through state space reduction. Specifically, we reduce state space of formal model by performing value reduction and transition relation reduction. The control flow and data dependent graphs control the process of value reduction and transition relation reduction. In addition, we provide an approach that allows the automated mining of security properties from register-transfer-level hardware designs. Experimental results using Trust-HUB benchmarks have demonstrated that our proposed methods can significantly reduce the complexity of the formal model and thus the formal security verification time for hardware Trojan detection.

AVATAR: NN-Assisted Variation Aware Timing Analysis and Reporting for Hardware Trojan Detection

This paper presents AVATAR, a learning-assisted Trojan testing flow to detect hardware Trojans placed into fabricated ICs at an untrusted foundry, without needing a Golden IC. AVATAR is a side-channel delay-based testing solution that is assisted by a learning model (process watchdog) for tracking the process drift and systematic process variation. AVATAR’s process watchdog model is trained using a limited number of test samples, collected at test time, to tightly correlate the Static Timing Analysis results (generated at design time) to the test results (generated from clock frequency sweeping test). The experimental results confirm that AVATAR detects over 98% of (small) Trojans inserted in the selected benchmarks. We have complemented our proposed solution with a diagnostic test that 1) further reduces the false-positive rate of AVATAR Trojan detection to zero or near zero, and 2) pinpoints the net-location of the Trojan Trigger or Payload.

An Evolutionary Algorithm for Non-Destructive Reverse Engineering of Integrated Circuits

In hardware Trojan detection technology, destructive reverse engineering can restore an original integrated circuit with the highest accuracy. However, this method has a much higher overhead in terms of time, effort, and cost than bypass detection. This study proposes an algorithm, called mixed-feature gene expression programming, which applies non-destructive reverse engineering to the chip with bypass detection data. It aims to recover the original integrated circuit hardware, or else reveal the unknown circuit design in the chip.

Brain-Inspired Golden Chip Free Hardware Trojan Detection

Since 2007, the use of side-channel measurements for detecting Hardware Trojan (HT) has been extensively studied. However, the majority of works either rely on a golden chip, or they rely on methods that are not robust against subtle acceptable changes that would occur over the life-cycle of an integrated circuit (IC). In this paper, we propose using a brain-inspired architecture called Hierarchical Temporal Memory (HTM) for HT detection. Similar to the human brain, our proposed solution is resilient against <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">natural</i> changes that might happen in the side-channel measurements while being able to accurately detect abnormal behavior of the chip when the HT gets triggered. We use a self-referencing method for HT detection, which eliminates the need for the golden chip. The effectiveness of our approach is evaluated using TrustHub benchmarks, which shows 92.20% detection accuracy on average.

Generating Adversarial Examples for Hardware-Trojan Detection at Gate-Level Netlists

Generating Adversarial Examples for Hardware-Trojan Detection at Gate-Level Netlists

Design Space Exploration for Reducing Cost of Hardware Trojan Detection and Isolation during Architectural Synthesis

In past years, software used to be the main concern of computer security, and the hardware was assumed to be safe. However, Hardware Trojans, which are a malicious alteration to the circuit, pose a threat to the security of a system. Trojans may be distributed across different components of the system and can bring down the security by communicating with each other. Redundancy and vendor diversity-based methods exist to detect Hardware Trojans, but with an increase in the hardware overhead. This work proposes a novel vendor allocation procedure to reduce the hardware cost that comes with Trojan detection methods. To further reduce the cost by minimizing resource requirements, an evolutionary algorithm-based Design Space Exploration methodology is proposed with options for loop unrolling and operation chaining. For reducing the cost of hardware Trojan detection and isolation, the proposed algorithm extends an existing implementation of Firefly algorithm. The proposed method is compared with the existing algorithms, using cost-based and Pareto-based evaluations. The results obtained demonstrate the ability of the new algorithm in achieving better solutions with a 77% reduction in cost when compared to the previous solutions.

Hardware Trojan Designs Based on High-Low Probability and Partitioned Combinational Logic With a Malicious Reset Signal

To counteract logic-testing methods and trust verification methods for hardware Trojan (HT) detection, two HT design strategies based on high-low probability and partitioned combinational logic with a malicious reset signal are proposed. Using these two strategies, a power consumption HT and a forced reset HT are designed in a self-developed RISC-V processor. The processor is implemented using SMIC 55nm CMOS technology. Experiments show that, compared to the HTs designed with low-probability nets, the HTs designed with high-low probability strategy can reduce the triggering probability by 87.5%. The HT designed by partitioning combinational logic strategy can increase the false positive rate of HT to 40%. The result can defeat FANCI effectively. In order to enhance the stealth of the HTs, we partitioned combinational logic by using flip-flops with a malicious reset signal. The reset signal participates as a part of the trigger condition, which significantly reduces the trigger probability of HTs.

Golden Chip-Free Trojan Detection Leveraging Trojan Trigger’s Side-Channel Fingerprinting

Hardware Trojans (HTs) have become a major threat for the integrated circuit industry and supply chain and have motivated numerous developments of HT detection schemes. Although the side-channel HT detection approach is among the most promising solutions, most of the previous methods require a trusted golden chip reference. Furthermore, detection accuracy is often influenced by environmental noise and process variations. In this article, a novel electromagnetic (EM) side-channel fingerprinting-based HT detection method is proposed. Different from previous methods, the proposed solution eliminates the requirement of a trusted golden fabricated chip. Rather, only the genuine RTL code is required to generate the EM signatures as references. A factor analysis method is utilized to extract the spectral features of the HT trigger’s EM radiation, and then a k -means clustering method is applied for HT detection. Experimentation on two selected sets of Trust-Hub benchmarks has been performed on FPGA platforms, and the results show that the proposed framework can detect all dormant HTs with a high confidence level.

On-Chip Trust Evaluation Utilizing TDC-Based Parameter-Adjustable Security Primitive

Field-programmable gate arrays (FPGAs) are integrated circuits (ICs) that can be reconfigured to the desired functionalities, without manufacturing dedicated chips. Due to their programmable nature, FPGAs have been prevalent in the large majority of modern systems. This raises high demands for verifying the security of circuit implementations on FPGAs, since they are vulnerable to hardware trojans (HTs) that can be inserted through modified configuration files. In this article, we propose an on-chip security framework to ensure the trustworthiness of circuit implementations on FPGAs at runtime. The core of the framework is a time-to-digital converter (TDC)-based hardware security primitive that can be predeployed on FPGAs to verify whether the FPGA-based designs are tampered with or corrupted by HTs. The parameter-adjustable TDC sensor, which is the primary component of the primitive, is carefully designed, adjusted, and implemented, thus the TDC sensor can monitor the transient voltage fluctuations within FPGAs with a high resolution. Versus statistical data analysis, tiny abnormal variations introduced by the Trojan insertion and activation are distinguished. Experimental results on Xilinx Spartan-6 FPGAs demonstrate the effectiveness of the proposed TDC-based on-chip trust evaluation framework and HT detection method.

Probabilistic Hardware Trojan Attacks on Multiple Layers of Reconfigurable Network Infrastructure

Over the past decades, there has been an exponential growth in the number of connected devices, often without well-thought out security mechanisms in place for the relevant network standards and protocols. As a result, security loopholes have been discovered and widely exploited for these vulnerable connected devices, often with devastating consequences. As a countermeasure to these attacks, subsequently some of these original network standards have been enhanced with addition of security features, e.g., the original insecure Ethernet protocol (IEEE 802.3) was supplemented by the IEEE 802.1AE Media Access Control Security (MACSec) standard. In this paper, we present a network packet redirection attack on reconfigurable network devices, specifically a MACSec-enabled NetFPGA-SUME based Ethernet switch, as well as on a NetFPGA-SUME based IPv4 router, by means of Hardware Trojan (HT) insertion. Our HT design is probabilistic in its functionality, with multi-level trigger mechanism. In the MAC layer attack, an activated HT redirects a frame to an incorrect port leading to possible eavesdropping by a malicious attacker as well as denial-of-service, while in the network layer attack, upon activation it forwards all IP packets through a sub-optimal router port causing a denial-of-service attack on the receiver. The proposed HT evades most state-of-the-art HT detection schemes, while having very low resource footprint. We present the complete architecture, detailed description of the mode of operation, and implementation of the HT, with promising experimental results.

MacLeR: Machine Learning-Based Runtime Hardware Trojan Detection in Resource-Constrained IoT Edge Devices

Traditional learning-based approaches for run-time Hardware Trojan detection require complex and expensive on-chip data acquisition frameworks and thus incur high area and power overhead. To address these challenges, we propose to leverage the power correlation between the executing instructions of a microprocessor to establish a machine learning-based run-time Hardware Trojan (HT) detection framework, called MacLeR. To reduce the overhead of data acquisition, we propose a single power-port current acquisition block using current sensors in time-division multiplexing, which increases accuracy while incurring reduced area overhead. We have implemented a practical solution by analyzing multiple HT benchmarks inserted in the RTL of a system-on-chip (SoC) consisting of four LEON3 processors integrated with other IPs like vga_lcd, RSA, AES, Ethernet, and memory controllers. Our experimental results show that compared to state-of-the-art HT detection techniques, MacLeR achieves 10\% better HT detection accuracy (i.e., 96.256%) while incurring a 7x reduction in area and power overhead (i.e., 0.025% of the area of the SoC and <0.07% of the power of the SoC). In addition, we also analyze the impact of process variation and aging on the extracted power profiles and the HT detection accuracy of MacLeR. Our analysis shows that variations in fine-grained power profiles due to the HTs are significantly higher compared to the variations in fine-grained power profiles caused by the process variations (PV) and aging effects. Moreover, our analysis demonstrates that, on average, the HT detection accuracy drop in MacLeR is less than 1% and 9% when considering only PV and PV with worst-case aging, respectively, which is ~10x less than in the case of the state-of-the-art ML-based HT detection technique.

Hardware Trojan detection research based on MLP

In view of the variety of Hardware Trojan (HT) and the difficulty of obtaining unknown Trojan characteristics in side-channel signals by conventional methods. In this paper, MLP was selected to establish the network model by means of supervised learning, the method took supervised learning ways to build neural network model for feature extraction and discrimination of side channel information. A verification system was set up based on FPGA to obtain side-channel information. The results show that the detection rate of the MLP is more than 1% higher than that of the traditional support vector machine (SVM) method when detecting the hardware Trojan horse with the parent circuit area of 2%.

Exposing Hardware Trojans in Embedded Platforms via Short-Term Aging

We demonstrate a novel technique that employs transistor short-term aging effects in integrated circuits (ICs) to detect hardware Trojans in embedded systems. In advanced technology nodes (≤ 45 nm), voltage scaling in combination with short-term aging opens doors for short-term degradations. The induced short-term degradations result in dynamic variation of delays along various paths within the IC. Aging degradation generated under fast voltage switching from high to low results in bit errors at the circuit output. Our experiments use short-term aging-aware standard cell libraries to show the effectiveness of short-term aging to detect hardware Trojans. We extract a rich set of features that capture bit error patterns at the outputs of the IC. We use a one class SVM-based classifier that uses these features to learn the distribution of bit errors at the outputs of a clean IC. We discern the deviation in the pattern of bit errors due to a Trojan in the IC from the baseline distribution. To reiterate, the method uses the model of a clean IC. Furthermore, it is robust against chip-to-chip variations. We illustrate the technique on six Trojans from Trust-Hub spanning two cryptographic chips and an embedded PIC microcontroller. Our approach detects Trojans with an accuracy ≥ 95%. It is easier to detect Trojans in an optimized-netlist circuit as more paths are close to the critical path. Even when the circuit is not optimized (i.e., when very few paths are close to the critical path), short-term aging plus mild overclocking can detect Trojans with high accuracy.

Part I: Evaluation for Hardware Trojan Detection Based on Electromagnetic Radiation

Hardware Trojan (HT) is increasingly becoming a major threat in the filed of hardware security. Recently, researchers are taking a high value on the side-channel countermeasures. Meanwhile, the electromagnetic radiation (EMR) based method is one of the most promising schemes to ensure whether integrated circuit (IC) is HT-infected or not. In this paper, we focus on the ability evaluation for existing EMR based methods to implement the HT detection. We propose the noise model based on analyses of noise sources during HT detection using EMR. Then, we study the effect caused by several types of noises in this model. According to these analyses, we discuss the limitation for EMR based methods in two special scenarios, and propose an evaluation scheme to evaluate the detection capability for using EMR analysis to identify HTs. Finally, we exemplify our scheme with some experiments. Experimental results on FPGA show the effectiveness of EMR based methods as well as their limitations.

TRAP-GATE: A Probabilistic Approach to Enhance Hardware Trojan Detection and its Game Theoretic Analysis

Rescuing Hardware from malware attacks is a great challenge today. Moreover detecting the presence of malicious intrusion using low-cost techniques is very challenging especially when it is believed that hardware Trojans are integrated into the rarely excited nodes. Though logical testing is admitted to be the accurate way to check the functional correctness of the circuit, the method becomes inefficient for circuits requiring humongous number of test patterns to activate the hardware trojan. This paper proposes a probabilistic approach to generate a set of test patterns that activate the Trojan explicitly by observing the incorrect responses to the applied test patterns. Our experimental result in ISCAS’85 benchmark circuits show that the test patterns generated by our approach enclose all nets where there is a high chance for trojan insertion. We stress that though our results are circuit specific, the proposed approach is generic and hence it can be applied to any digital circuit. In fact, we demonstrate that for the C880 circuit, our approach requires only 217 inputs to be tested whereas the naive approach needs 260 test patterns. In addition to the experimental results, we use a game-theoretic framework to show the effectiveness of our approach in generating trojan activating test patterns compared to naive and ATPG testing process.