Hardware Trojan Insertion Research Articles

Interdiction in practice—Hardware Trojan against a high-security USB flash drive

As part of the revelations about the NSA activities, the notion of interdiction has become known to the public: the interception of deliveries to manipulate hardware in a way that backdoors are introduced. Manipulations can occur on the firmware or at hardware level. With respect to hardware, FPGAs are particular interesting targets as they can be altered by manipulating the corresponding bitstream which configures the device. In this paper, we demonstrate the first successful real-world FPGA hardware Trojan insertion into a commercial product. On the target device, a FIPS-140-2 level 2 certified USB flash drive from Kingston, the user data are encrypted using AES-256 in XTS mode, and the encryption/decryption is processed by an off-the-shelf SRAM-based FPGA. Our investigation required two reverse-engineering steps, related to the proprietary FPGA bitstream and to the firmware of the underlying ARM CPU. In our Trojan insertion scenario, the targeted USB flash drive is intercepted before being delivered to the victim. The physical Trojan insertion requires the manipulation of the SPI flash memory content, which contains the FPGA bitstream as well as the ARM CPU code. The FPGA bitstream manipulation alters the exploited AES-256 algorithm in a way that it turns into a linear function which can be broken with 32 known plaintext-ciphertext pairs. After the manipulated USB flash drive has been used by the victim, the attacker is able to obtain all user data from the ciphertexts. Our work indeed highlights the security risks and especially the practical relevance of bitstream modification attacks that became realistic due to FPGA bitstream manipulations.

Vulnerability Analysis of a Circuit Layout to Hardware Trojan Insertion

While the horizontal integrated circuit design process is extensively practiced, untrusted foundries can impose significant threats on the security of final products. A carefully inserted extra circuitry as a hardware trojan in a circuit layout can interfere with circuit functionality under very rare circumstances with inconsiderable footprints. In this paper, we introduce a novel layout-level vulnerability analysis flow to evaluate the susceptibility of a circuit layout’s regions to hardware Trojan insertion. We also present several metrics based on a circuit layout to quantify the possibility of hardware Trojan insertion in a specific region of layout. Results of applying our flow to several benchmarks have revealed considerably high vulnerability of circuit layouts to hardware Trojan insertion. Furthermore, several Trojans are implemented and inserted in layout regions with different vulnerabilities to evaluate the effectiveness of our new metrics. Our novel layout-level vulnerability analysis flow makes it possible to quantitatively determine the vulnerability of different implementations of a circuit and analyze the susceptibility of each corner of circuit layout to different types of functional Trojans.

Cost-efficient Acceleration of Hardware Trojan Detection Through Fan-Out Cone Analysis and Weighted Random Pattern Technique

Fabless semiconductor industry and government agencies have raised serious concerns about tampering with inserting hardware Trojans (HTs) in an integrated circuit supply chain in recent years. In this paper, a low hardware overhead acceleration method of the detection of HTs based on the insertion of 2-to-1 MUXs as test points is proposed. In the proposed method, the fact that one logical gate has a significant impact on the transition probability of the logical gates in its logical fan-out cone is utilized to optimize the number of the inserted MUXs. The nets which have smaller transition probability than the user-specified threshold and minimal logical depth from the primary inputs are selected as the candidate nets. As for each candidate net, only its input net with smallest signal probability is required to be inserted the MUXs-based test points. The procedure repeats until the minimal transition probability of the entire circuit is not smaller than the threshold value. In order to further optimize the number of required insertions and reduce the overhead, the weighted random pattern technique is also applied. Experiment results on ISCAS’89 benchmark circuits show that our proposed method can achieve remarkable improvement of transition probability with on average 9.50% power, 2.37% delay, and 10.26% area penalty.

Fault Analysis-Based Logic Encryption

Globalization of the integrated circuit (IC) design industry is making it easy for rogue elements in the supply chain to pirate ICs, overbuild ICs, and insert hardware Trojans. Due to supply chain attacks, the IC industry is losing approximately $4 billion annually. One way to protect ICs from these attacks is to encrypt the design by inserting additional gates such that correct outputs are produced only when specific inputs are applied to these gates. The state-of-the-art logic encryption technique inserts gates randomly into the design, but does not necessarily ensure that wrong keys corrupt the outputs. Our technique ensures that wrong keys corrupt the outputs. We relate logic encryption to fault propagation analysis in IC testing and develop a fault analysis-based logic encryption technique. This technique enables a designer to controllably corrupt the outputs. Specifically, to maximize the ambiguity for an attacker, this technique targets 50% Hamming distance between the correct and wrong outputs (ideal case) when a wrong key is applied. Furthermore, this 50% Hamming distance target is achieved using a smaller number of additional gates when compared to random logic encryption.

A Novel Built-In Self-Authentication Technique to Prevent Inserting Hardware Trojans

With the rapid globalization of the semiconductor industry, hardware Trojans have become a significant threat to government agencies and enterprises that require secure and reliable systems for their critical applications. Because of the diversity of hardware Trojans and the randomness associated with process variations, hardware Trojan detection is a challenging problem. In this paper, we propose a novel technique, called built-in self-authentication (BISA), which can be used to make hardware Trojan insertion by untrusted Graphic Data System (GDSII) developer and untrusted foundry considerably more difficult and easier to detect. The unused spaces in the circuit layout represent the best opportunity to insert Trojans by these entities. BISA works by eliminating this spare space and filling it with functional filler cells, instead of nonfunctional filler cells. A self-testing procedure generates a digital signature that will be different if any BISA cells are changed because of hardware Trojan insertion. We demonstrate that BISA can be applied to any flat or bottom-up hierarchical design with negligible overhead in terms of area, power, and timing.

Guest Editorial

Guest Editorial

Hardware Trojans: current challenges and approaches

More and more manufacturers outsource parts of the design and fabrication of integrated circuits (ICs) for cost reduction. Recent publications show that such outsourcing can pose serious threats to governments and corporations, as they lose control of the development process. Until now, the threat of hardware Trojans is mostly considered during fabrication. Third party intellectual properties (IPs) are also gaining importance as companies wish to reduce costs and shorten the time-to-market. Through this study, the authors argue that the threat of Trojans is spread throughout the whole IC development chain. They give a survey of both hardware Trojan insertion possibilities and detection techniques. Furthermore, they identify the key vulnerabilities at each stage of IC development and describe costs of hardware Trojan insertion and detection. This way, the threat level based on feasibility of Trojan insertion and the practicability of Trojan detection techniques is evaluated. Lately, detection techniques address the issue of including third party IP. However, those techniques are not sufficient and need more research to effectively protect the design. In this way, the authors’ analysis provides a solid base to identify the issues during IC development, which should be addressed with higher priority by all entities involved in the IC development.

A New Testing Method for Hardware Trojan Detection

Abstract This paper presents a partitioning approach to improve the Trojan detection process. The proposed transition probability based method tries to partition combinational circuits for pseudo exhaustive testing. The nodes of digital circuit in which the transition probability is less than predefined threshold mark as the potential point for hardware Trojan insertion. Thus, our objective is new circuit partitioning method to increase the transition probability of the potential points. We propose I-PIFAN partitioning algorithm in which the optimal size of primary input cone (N) and Fan-out (F) values are selected to partition a given combinational circuit. The partitioning method determines the optimal values of N and F to increase the transition probability and minimize 1) the number of test vector, 2) the number of partitions and 3) the critical path delay. This work ensures that all nodes with low transition probability pass the threshold after partitioning. The proposed algorithm reduces the test time of digital combinational circuits and improves Trojan detection quality. The partitioning method is applied to the ISCAS’85 benchmark circuits and the simulation results show the test vectors reduction and improvement of transition probabilities.

Hardware Trojan Insertion by Direct Modification of FPGA Configuration Bitstream

In this work, we have demonstrated the feasibility of hardware Trojan insertion in circuits mapped on FPGAs by direct modification of the FPGA configuration bitstream. The main challenge of this attack proved to be the lack of sufficient information in the public domain about the bitstream format and the internal architecture and configurability of the FPGA. Nevertheless, we were able to show that under certain constraints on the functionality, size and placement of the Trojan on the FPGA, it is possible to modify the configuration bitstream by a software program to insert a hardware Trojan in the design. The main strength of the attack lies in the fact that since the modification is at the configuration bitstream level, it bypasses all predeployment design validation mechanisms. We also propose some techniques to prevent the demonstrated attack. We hope that this work will raise awareness among FPGA users about the potency of the threat posed by this relatively simple attack and its improved variants. .

A Novel Technique for Improving Hardware Trojan Detection and Reducing Trojan Activation Time

Fabless semiconductor industry and government agencies have raised serious concerns about tampering with inserting hardware Trojans in an integrated circuit supply chain in recent years. Most of the recently proposed Trojan detection methods are based on Trojan activation to observe either a faulty output or measurable abnormality on side-channel signals. Time to activate a hardware Trojan circuit is a major concern from the authentication standpoint. This paper analyzes time to generate a transition in functional Trojans. Transition is modeled by geometric distribution and the number of clock cycles required to generate a transition is estimated. Furthermore, a dummy scan flip-flop insertion procedure is proposed aiming at decreasing transition generation time. The procedure increases transition probabilities of nets beyond a specific threshold. The relation between circuit topology, authentication time, and the threshold is carefully studied. The simulation results on s38417 benchmark circuit demonstrate that, with a negligible area overhead, our proposed method can significantly increase Trojan activity and reduce Trojan activation time.