Hardware Trojan Horses Research Articles

DETON: DEfeating hardware Trojan horses in microprocessors through software ObfuscatioN

Hardware Trojan Horses (HTHs) represent today a serious issue not only for academy but also for industry because of the dramatic complexity and dangerousness attackers can count on. It has been shown that HTHs can be inserted in modern and complex microprocessors allowing the attacker to run malicious software, to acquire root privileges and to steal secret user information. In this paper we propose DETON, an automatic methodology for software manipulation aimed at introducing obfuscation in programs’ execution to protect microprocessor-based systems against information stealing HTHs. The high-level goal of DETON is to produce an obfuscated version of the program under protection in order to allow a trusted execution over a (possibly) untrusted CPU-based system. The obfuscated program will then be the one actually executed on the target hardware platform. DETON is fully integrated in the classical software design flow since it takes the output of the compiler, i.e., the assembly code of the program to be protected, and it produces a modified version of the assembly code which is in turn fully compatible with the underlying target HW platform. DETON aims at (i) reducing the amount of sensitive information exposed to the attacker by spreading it through microprocessor’s registers and by submerging it among garbage information, and (ii) reducing the time for which sensitive information is exposed to the attacker by scrambling data among microprocessor’s registers. We present a set of guidelines, requirements and metrics aimed at driving and assessing software obfuscation against always-on information-stealing HTHs and we then present the DETON framework. We assessed DETON on the Ariane version of the 64 bit RISC-V microprocessor running a set of real-world benchmark programs for embedded systems.

Is your FPGA bitstream Hardware Trojan-free? Machine learning can provide an answer

Software exploitable Hardware Trojan Horses (HTHs) inserted into commercial CPUs allow the attacker to run his/her own software or to gain unauthorized privileges. Recently a novel menace raised: HTHs inserted by CAD tools. A consequence of such scenario is that HTHs must be considered a serious threat not only by academy but also by industry. In this paper we try to answer to the following question: can Machine Learning (ML) help designers of microprocessor softcores implemented onto SRAM-based FPGAs at detecting HTHs introduced by the employed CAD tool during the generation of the bitstream? We present a comparative analysis of the ability of several ML models at detecting the presence of HTHs in the bitstream by exploiting a previously performed characterization of the microprocessor softcore and an associated ML training. An experimental analysis has been carried out targeting the IBEX RISC-V microprocessor running a set of benchmark programs. A detailed comparison of multiple ML models is conducted, showing that many of them achieve accuracy above 98%, and κ values above 0.97. By identifying the most effective ML models and the best features to be employed, this paper lays the foundation for the integration of a ML-based bitstream verification flow.

Ransomware Attack as Hardware Trojan: A Feasibility and Demonstration Study

The integrated circuit (IC) ecosystem, today, is widely distributed. Usually, a handful of companies is involved in the development of a single chip – an environment that presents many opportunities for malicious activities such as the insertion of hardware trojan horses. This work presents a specialized form of a hardware trojan that is able to mount a hardware-based ransomware attack, an attack that previously only existed in the software domain. This attack is therefore termed a hardware ransomware and is the main contribution of this work. As case studies, two architectures of the hardware ransomware are presented, along with a silicon demonstration in 65nm CMOS. In order to discuss the detectability of the malicious logic, the hardware ransomware is inserted in a complex system on chip (SoC). The experimental results show how an adversary can effortlessly insert the ransomware logic: the baseline SoC has a representative area utilization factor of 59.97% and, after the trojan is inserted, the area utilization factor increases by 0.73% to 60.70%. The inserted logic is also responsible for an increase of approximately 2% in static power – well within process variation margins. Finally, this paper discusses the implications of such an attack at length, showing that from the implementation and technological side, there are no barriers for an adversary to devise a hardware ransomware.

Deton: Defeating Hardware Trojan Horses in Microprocessors Through Software Obfuscation

Deton: Defeating Hardware Trojan Horses in Microprocessors Through Software Obfuscation

An Obfuscation Method Based on CFGLUTs for Security of FPGAs

There are many different ways of securing FPGAs to prevent successful reverse engineering. One of the common forms is obfuscation methods. In this paper, we proposed an approach based on obfuscation to prevent FPGAs from successful reverse engineering and, as a result, Hardware Trojan Horses (HTHs) insertion. Our obfuscation method is using ConFiGurable Look Up Tables (CFGLUTs). We suggest to insert CFGLUTs randomly or based on some optional parameters in the design. In this way, some parts of the design are on a secure memory, which contains the bitstream of the CFGLUTs so that the attacker does not have any access to it. We program the CFGLUTs in run-time to complete the bitstream of the FPGA and functionality of the design. If an attacker can reverse engineer the bitstream of the FPGA, he cannot detect the design because some part of it is composed of CFGLUTs, which their bitstream is on a secure memory. The first article uses CFGLUTs for securing FPGAs against HTHs insertion, which are results of reverse engineering. Our methods do not have any power and hardware overhead but 32 clock cycles time overhead.

Hardware Trojan Horse Detection through Improved Switching of Dormant Nets

Covert Hardware Trojan Horses (HTH) introduced by malicious attackers during the fabless manufacturing process of integrated circuits (IC) have the potential to cause malignant functions within the circuit. This article employs a Design-for-Security technique to detect any HTHs present in the circuit by inserting tri-state buffers (TSB) in the ICs that inject the internal nets with weighted logic values during the test phase. This increases the transitions in the logic values of the nets within the IC, thereby stimulating any inserted HTH circuits. The TSBs are efficiently inserted in the IC considering various circuit parameters and testability measures to bolster the transitions in logic values of the nets throughout the IC while minimising the area overhead. Simulation results show a significant increase in transitions in logic values within HTH triggers using this method, thus aiding in their detection through side-channel analysis or direct activation of the payload.

Securing RSA hardware accelerators through residue checking

Circuits for the hardware acceleration of cryptographic algorithms are ubiquitously deployed in consumer and industrial products. Although being secure from a mathematical point of view, such accelerators may expose several vulnerabilities strictly related to the hardware implementation. Differential fault analysis (DFA) and hardware Trojan horses (HWTs) may be exploited to steal secret information from the circuit or to interfere with its nominal functioning. It is therefore important to protect cryptographic hardware accelerators against such attacks in an efficient way. In this paper, we propose a lightweight technique for protecting circuits implementing the RSA algorithm against DFA and HWTs at runtime. The proposed solution relies on residue checking which is a well-known technique belonging to traditional fault tolerance. Residue checking is here applied to RSA circuits in order to detect any modification of the output of the circuit possibly induced by the occurrence of a fault or the activation of a HWT. When this happens, the protection technique reacts to the attack by obfuscating the circuit's output (i.e. generating a random output). An experimental campaign (99% confidence and 1% error) demonstrated that, when dealing with DFA, the proposed solution detected 100% of the fault attacks that leaked information to the attacker. Moreover, we applied the proposed technique to all the HWT infected implementations of the RSA algorithm available in the Trust-Hub benchmark suite achieving a 100% HWT detection. The overhead introduced by the proposed solution is a maximum area increase below 3%, about 18% dynamic power consumption increase while it has no impact on the operating frequency.

Minimization of WCRT with Recovery Assurance from Hardware Trojans for Tasks on FPGA-based Cloud

Dynamic partial reconfiguration (DPR) enabled FPGA-based Cloud architecture acts as a flexible and efficient shared environment to facilitates application support to users’ request at low cost. While on one hand we need to handle a variety of tasks, such as periodic or sporadic, deadline or non-deadline, high or low critical tasks from the point of producing correct results, on the other hand we are constrained to use untrusted FPGA-based application IP blocks procured from various third-party vendors, which may contain hardware Trojan horse (HTH) affecting throughput and reliability of the Cloud. We propose Trojan-aware processing of tasks by monitored execution of a task on different untrusted cores, and then one more execution is done upon detection of hardware Trojan effects. For this stringent scheduling environment, the proposed dynamic scheduling algorithm is also properly extended to guarantee successful recovery from Trojan effects for all accepted tasks. Experimental results show that our algorithm improves worst-case-response-time for all tasks including non-deadline tasks and achieves lower task rejection rate for the deadline tasks, through judicious non-uniform partitioning of FPGAs based on supported jobs and subsequent better resource utilization, compared to that for existing Trojan-aware scheduling techniques.

Hardware Trojan detection research based on MLP

In view of the variety of Hardware Trojan (HT) and the difficulty of obtaining unknown Trojan characteristics in side-channel signals by conventional methods. In this paper, MLP was selected to establish the network model by means of supervised learning, the method took supervised learning ways to build neural network model for feature extraction and discrimination of side channel information. A verification system was set up based on FPGA to obtain side-channel information. The results show that the detection rate of the MLP is more than 1% higher than that of the traditional support vector machine (SVM) method when detecting the hardware Trojan horse with the parent circuit area of 2%.

Split-Chip Design to Prevent IP Reverse Engineering

Split-chip design combines integrated circuits (ICs) from two or more disparate (trusted and untrusted) foundries to create an integrated system on a chip. This approach thwarts IP theft, hardware Trojan horse (HTH) insertion, and overbuilding by any single untrustworthy foundry. This study uses two silicon demonstration vehicles in 16-nm technology as proofs of the split-chip concept.

On the feasibility of using evolvable hardware for hardware Trojan detection and prevention

Evolvable hardware (EH) architectures are capable of changing their configuration and behavior dynamically based on inputs from the environment. In this paper, we investigate the feasibility of using EH to prevent Hardware Trojan Horses (HTHs) from being inserted, activated, or propagated in a digital electronic chip. HTHs are malicious hardware components that intend to leak secret information or cause malfunctioning at run-time in the chip in which they are integrated. We hypothesize that EH can detect internal circuit errors at run-time and reconfigure to a state in which the errors are no longer present. We implement a Virtual Reconfigurable Circuit (VRC) on a Field-Programmable Gate Array (FPGA) that autonomously and periodically reconfigures itself based on an Evolutionary Algorithm (EA). New VRC configurations are generated with an on-chip EA engine.We show that the presented approach is applicable in a scenario in which (1) the HTH-critical areas in the circuit are known in advance, and (2) the VRC is a purely combinatorial circuit, as opposed to the on-chip memory holding the golden reference, which requires one or more cycles to be read/written. We compare two different approaches for protecting the system against HTHs: Genetic Programming (GP) and Cartesian Genetic Programming (CGP). The paper reports on experiments on four benchmark circuits and gives an overview of both the limitations and the added value of the presented approaches.

Dynamic power-aware scheduling of real-time tasks for FPGA-based cyber physical systems against power draining hardware trojan attacks

The present era has witnessed deployment of reconfigurable hardware or field-programmable gate arrays (FPGAs) in diverse domains like automation and avionics, which are cyber physical in nature. Such cyber physical systems are associated with strict power budgets. Efficient real-time task-scheduling strategies exist that ensure execution of maximum number of tasks within the power budget. However, these do not consider hardware threats into account. Recent literature has exposed the existence of hardware trojan horses (HTHs). HTHs are malicious circuitry that remain dormant during testing and evade detection, but get activated at runtime to jeopardize operations. HTHs can be etched into the FPGA fabric by adversaries in the untrustworthy foundries, during fabrication of the FPGAs. Even vendors selling reconfigurable intellectual properties or bitstreams that configure the FPGA fabric for task operation may insert HTHs during writing the bitstream codes. HTHs may cause a variety of attacks which may affect the basic security primitives of the system like its integrity, confidentiality or availability. In this work, we explore how power draining ability of HTHs may reduce lifetime of the system. A self-aware approach is also proposed which detects the affected resources of the system and eradicates their use in future to facilitate system reliability. An offline–online scheduling strategy is proposed for periodic tasks which can ensure reliability of their operations till the expected lifetime of the system. Accommodating non-periodic tasks in the periodic task schedule based on available power is also focused. For experimentation, we consider tasks associated with EPFL benchmarks and demonstrate results based on the metric task success rate for periodic tasks and metric task rejection rate for non-periodic tasks.

Semi-device-independent quantum money

The seminal idea of quantum money, not forgeable due to laws of Quantum Mechanics, proposed by Stephen Wiesner, has laid the foundations for the Quantum Information Theory in the early ’70s. Recently, several other schemes for quantum currencies have been proposed, all, however, relying on the assumption that the quantum source device, acts according to its specification. This makes several known quantum money protocols vulnerable to the so-called hardware Trojan horse attacks. We, therefore, study the following problem: to what extent quantum money schemes can be made independent from the inner working of source and verification-devices used by the honest parties (bank and mint) in creating and processing the quantum money? Drawing inspirations from the semi-device-independent quantum key distribution protocol, we introduce the first scheme of quantum money with this assumption partially relaxed, along with the proof of its unforgeability. Finally, we formulate and discuss a quantum analog of the Oresme–Copernicus–Gresham’s law of economy, that may hold in the future.

Criticality based reliability against hardware Trojan attacks for processing of tasks on reconfigurable hardware

An important aspect of mixed critical systems is to execute tasks of varied criticality on the same platform. The property of full or partial reconfiguration at runtime of reconfigurable hardware or field programmable gate arrays (FPGAs) has satisfied this criterion and facilitated the processing of mixed critical tasks directly on hardware, with the aid of reconfigurable intellectual properties (IPs) or bitstreams procured from various third party IP (3PIP) vendors. However, the existing literature in this arena does not consider the associated hardware threats. Such threats are particularly dangerous as related malware like Hardware Trojan Horses (HTHs) remain dormant during testing and evade detection, but get activated at runtime and jeopardize mission critical applications. Though several works exist on hardware security, none focus on reliability driven mixed critical task processing on reconfigurable hardware against HTH attacks. In this work, we initially explore how HTHs implanted by 3PIP vendors in the bitstreams may cause active attacks. Then, we develop strategies to ensure reliability for processing of mixed critical tasks on reconfigurable hardware. Both periodic and non-periodic, i.e. aperiodic or sporadic tasks are considered. We also focus on resource constrained environments, where we adhere to frequency scaling to facilitate accommodation of tasks on limited resources. We experiment with a variety of bitstreams and performance evaluation is performed via metrics such as task success rate, task rejection rate and task preemption rate.

Stigmergy-Based Security for SoC Operations From Runtime Performance Degradation of SoC Components

The semiconductor design industry of the embedded era has embraced the globalization strategy for system on chip (SoC) design. This involves incorporation of various SoC components or intellectual properties (IPs), procured from various third-party IP (3PIP) vendors. However, trust of an SoC is challenged when a supplied IP is counterfeit or implanted with a Hardware Trojan Horse. Both roots of untrust may result in sudden performance degradation at runtime. None of the existing hardware security approaches organize the behavior of the IPs at the low level, to ensure timely completion of SoC operations. However, real-time SoC operations are always associated with a deadline, and a deadline miss due to sudden performance degradation of any of the IPs may jeopardize mission-critical applications. We seek refuge to the stigmergic behavior exhibited in insect colonies to propose a decentralized self-aware security approach. The self-aware security modules attached with each IP works based on the Observe-Decide-Act paradigm and not only detects vulnerability but also organizes behavior of the IPs dynamically at runtime so that the high-level objective of task completion before a deadline is ensured. Experimental validation and low overhead of our proposed security modules over various benchmark IPs and crypto SoCs depict the prospects of our proposed mechanism.

A Hardware Trojan Attack on FPGA-Based Cryptographic Key Generation: Impact and Detection

True Random Number Generator (TRNG) circuits are important components of cryptographic systems. Lack of statistical randomness in the generated bitstreams from a TRNG can result in compromised keys, leading to serious security breaches. In this paper, we describe a Hardware Trojan Horse (HTH)-based attack on the TRNG of an FPGA-based cryptosystem, that results in reduced entropy and increased predictability of the generated keys. The proposed HTH does not cause any functional failure in the cryptosystem, and its impact is undetectable by analysis of the compromised bitstream using standard statistical randomness testing software suites (NIST, two enhanced versions of NIST Dieharder, and LIL-tests), and by a circuit-level HTH detection technique using Transition Effect Ring Oscillator (TERO). Finally, we show that the impact of the HTH can be detected by applying Wavelet Transform on the compromised bitstream.

A Side-Channel Analysis for Hardware Trojan Detection Based on Path Delay Measurement

Hardware Trojan Horses (HTHs) are malicious modifications inserted in Integrated Circuit during fabrication steps. The HTHs are very small and can cause damages in circuit function. They cannot be detected by conventional testing methods. Due to dangerous effects of them, Hardware Trojan Detection has become a major concern in hardware security. In this paper, a new HTH detection method is presented based on side-channel analysis that uses path delay measurement. In this method, we find and observe the paths that Trojans have most effect on them. Most of the previous works add some structures to the circuit and need a large overhead cost. But, in our method, there is no modification in the circuit and we can use it for testing the circuits received after fabrication. The proposed method is evaluated with Xilinx FPGA over a number of test circuits. The results show that measuring the delays on 20 paths with an accuracy of 0.01[Formula: see text]ns can detect more than 80% of Trojans.

On the effects of ring oscillator length and hardware Trojan size on an FPGA-based implementation of AES

The recent trend in a wide range of application domains, from the Internet of Things to space communications, is to deploy computing systems on FPGA devices. Modern FPGA technology encompasses billions of gates integrated in a single chip. In this setting, it is easier for an attacker to inject or introduce additional, malicious logic or to modify an existing one in order to cause abnormal behavior. As a result, new security requirements arise from the design process perspective. A Ring Oscillator (RO) is an established technique to realize a digital sensor in FPGA designs to detect additional or modified malicious circuit, i.e., a hardware Trojan horse or simply a Trojan. Variable-length Ring Oscillators (VLROs) were proposed in the literature as an advanced detection mechanism for run-time configuration of RO length to avoid bypassing. Here, we expand VLROs effectiveness studies in two families of Trojans (combinational and sequential) and Trojans of varying size. We analyze the effect of the Trojan size and the length of the RO on the ability to detect malicious logic injected in a reference FPGA implementation of the AES cryptographic algorithm.

Remote dynamic partial reconfiguration: A threat to Internet-of-Things and embedded security applications

The advent of the Internet of Things has motivated the use of Field Programmable Gate Array (FPGA) devices with Dynamic Partial Reconfiguration (DPR) capabilities for dynamic non-invasive modifications to circuits implemented on the FPGA. In particular, the ability to perform DPR over the network is essential in the context of a growing number of Internet of Things (IoT)-based and embedded security applications. However, the use of remote DPR brings with it a number of security threats that could lead to potentially catastrophic consequences in practical scenarios. In this paper, we demonstrate four examples where the remote DPR capability of the FPGA may be exploited by an adversary to launch Hardware Trojan Horse (HTH) attacks on commonly used security applications. We substantiate the threat by demonstrating remotely-launched attacks on Xilinx FPGA-based hardware implementations of a cryptographic algorithm, a true random number generator, and two processor based security applications - namely, a software implementation of a cryptographic algorithm and a cash dispensing scheme. The attacks are launched by on-the-fly transfer of malicious FPGA configuration bitstreams over an Ethernet connection to perform DPR and leak sensitive information. Finally, we comment on plausible countermeasures to prevent such attacks.

A Flexible Online Checking Technique to Enhance Hardware Trojan Horse Detectability by Reliability Analysis

Hardware Trojan Horses have emerged as great threats to modern electronic design and manufacturing practices. Because of their inherent surreptitious nature, test vector generation to detect hardware Trojan horses is a difficult problem. Efficient online detection techniques can be more effective in detection of hardware Trojan horses. In this paper, we propose a low-overhead detection technique which inserts malicious logic detection circuitry at netlist sites chosen by an algorithm that employs an intelligent and accurate analysis of fault propagation through logic gates. Proactive system-level countermeasures can be activated on detection of malicious logic, thereby avoiding disastrous system failure. Experimental results on benchmark circuits show close to 100 percent HTH detection coverage when our proposed technique is employed, as well as acceptable overheads.