Hardware Trojan Research Articles

Improving Hardware Trojan Detection Coverage by Utilizing Features at Different Abstraction Levels

In this paper, we introduced a solution to improve hardware Trojan (HT) detection coverage by analyzing features at different abstraction levels. We demonstrated our solution with a supervised classification of HT branching statement (BS) in register-transfer-level (RTL) description. The proposed classifier was trained with a double-abstraction-level feature vector consisting of features extracted at RTL and gate level (GL). In the experiment, we evaluated the HT detection coverage of the trained classifier by applying them on 24 self-designed HT circuits. The proposed classifier achieved the highest 87.5% HT detection coverage with 81.25% true positive rate (TPR), 88.44% true negative rate (TNR), and 88.24% accuracy (ACC). The result proved that the double-abstraction-level feature vector outperformed the single-abstraction-level feature vector with a higher HT detection coverage.

Detection method of Golden Chip-Free Hardware Trojan based on the combination of ResNeXt structure and attention mechanism

Since 2007, the use of side-channel data to detect hardware Trojans (HT) has been widely studied. Machine learning methods are widely used in the detection of hardware Trojans, but with the development of integrated circuits (IC), machine learning methods are not able to obtain a higher accuracy rate compared to deep learning. In this paper, we propose to use an architecture inspired by the ResNeXt network architecture and combine it with an attention mechanism, referred to as the Attention-Res-Attention (ARA) network. Firstly, the side channel data are extracted by convolutional layer with features and focus on important points under the attention module; then, the feature map enters the ResNeXt architecture that achieves classification accuracy improvement by adding the attention module; finally, the data are classified by the fully connected layer. Our proposed solution is observable to natural variations that may occur in side-channel measurements, and can accurately detect abnormal behavior of the chip when HT is triggered. And using a self-referential method for HT detection eliminates the need for a golden chip. The effectiveness of the method proposed in this paper is evaluated based on the AES series hardware Trojans publicly provided by TrustHub. Experimental results show that the method proposed in this paper has a high accuracy rate when a single Trojan exists, and can effectively detect the existence of hardware Trojans. And when a variety of hardware Trojans exist at the same time, the method used in this paper can effectively distinguish the types of hardware Trojans, and the highest average accuracy rate reached 97% during the experiment. Compared with the existing deep learning methods, the network model in this paper has higher classification accuracy.

A comprehensive survey on hardware-assisted malware analysis and primitive techniques

Malware poses an extremely dangerous threat to the digital world, significantly impacting various domains such as smart cities, intelligent transportation, wireless sensor networks (WSNs), and the Internet of Vehicles (IoV). In the Internet of Things (IoT) context, which includes various applications, security threats, and vulnerabilities are high, especially for resource-constrained single-board devices. One of the critical challenges is the presence of unauthorised access to IoT devices that attempt to replicate authorized devices by mimicking their hardware and software specifications. This review paper provides a comprehensive overview of the security issues related to various hardware-level attacks, memory attacks, hardware Trojans, and their countermeasures in different domains. In addition, the paper addresses the study of hardware malware and explores their detection techniques for hardware-based malware, including side-channel and chip-based attacks using machine learning. Using primitive hardware techniques, such as Physically Unclonable Functions (PUFs), to generate the unique key for the device by preventing unauthorised access to the hardware during authentication for different domains is thoroughly investigated with different security features. This review analyzes the different types of PUFs, their characteristics, and their use for various security tasks, including device authentication and the key generation process. It critically evaluates the strengths and limitations of the PUF-based approach and identifies potential research directions to overcome the existing challenges.

An exquisitely sensitive variant-conscious post-silicon Hardware Trojan detection

Hardware Trojans, malicious modifications or additions to circuit elements, are often introduced during outsourced stages of IC manufacturing. Their presence in hardware security platforms became a concern after incidents like the Syrian RADAR failure and the Kill-switch incident. Existing Trojan detection techniques mostly focus on netlist-level identification and overlook process variation challenges in post-silicon ICs. In this work, we introduce a novel golden free and highly sensitive detection method that addresses process variations and various sources of noise. Our approach achieves enhanced detection sensitivity by (i) utilizing an efficient circuit partitioning method that takes into account post-silicon noises, ensuring post-silicon validation through pre-silicon analysis, (ii) implementing a technique to mitigate the impact of systematic and random variations within and between dies, (iii) developing a variation-aware test pattern generation approach that utilizes a bit-flipping technique, leading to low transition net switching and increasing the likelihood of activating Trojans. We evaluate the sensitivity of our detection approach using a custom tool called relative power difference (RPD). To validate our method, we conduct experiments on the ISCAS’89 benchmark and the AES-128 circuit, testing against various Trojans reported in the literature. Our results demonstrate outstanding detection sensitivity for inserted Trojans across different levels of noise.

Structural and SCOAP Features Based Approach for Hardware Trojan Detection Using SHAP and Light Gradient Boosting Model

Structural and SCOAP Features Based Approach for Hardware Trojan Detection Using SHAP and Light Gradient Boosting Model

Graph based heterogeneous feature extraction for enhanced hardware Trojan detection at gate-level using optimized XGBoost algorithm

The requirement of reduced production costs in the domain of integrated circuit(IC) manufacturing and constrained time-to-market are met at the cost of a plethora of security concerns in chip design. In the fourth industrial revolution, where system-on-chip forms the backbone of various electronics, malicious hardware modules known as hardware Trojans within the third-party intellectual property impose a significant security threat. The flexibility and ease of intrusion provided in the earlier stages of design, known as the pre-silicon stage, make it vulnerable to these hardware attacks. Such a scenario further emphasizes the need for effective pre-silicon detection schemes. Since this stage is more vulnerable to hardware attacks. Most existing pre-silicon schemes rely on domain knowledge for feature extraction to develop knowledge-driven but exhibit limited Trojan space exploration. Hence, a proposal that comprises four major stages, viz., multifaceted heterogeneous feature extraction, dynamic hybrid sampling, mutual information-based feature selection, and genetic algorithm-based optimization, has been attempted to handle the challenges. Experimentation on TRIT-TC benchmark circuits resulted in a better predictive value for the chosen test circuits, which proves that the proposal outperforms existing schemes.

A New ATPG and Online Monitoring based Technique for Hardware Trojan Detection

Hardware Trojan (HT) is the most severe security threat during an integrated circuit (IC) development. The logic testing based pre-silicon techniques fail to detect the HT inserted during fabrication, whereas the existing ATPG based approaches provide low coverage and are inefficient to trigger hard-to-activate sites. Further, the existing online monitoring techniques fail to detect the Trojans effectively and do not provide any opportunity to fix/reject the design. Therefore, a new HT detection technique is proposed that combines ATPG and online monitoring to detect all the stealthy Trojans effectively. This paper first proposes a new ATPG algorithm that generates the patterns to activate the Trojan. Further, a new modified HT detection (checker) logic is proposed that is selectively inserted in the original design to effectively observe the effect of activated Trojan during post-silicon testing and online monitoring. The proposed checker logic eliminates the masking problem and can also observe the effects of those HTs, which could not propagate to the output. The experimental evaluation on ISCAS benchmarks shows that our algorithm provides 4.5× higher trigger coverage and does not leave any feasible rare-node inactivated. Further, the proposed checker effectively observes malicious behavior without additional overhead over the existing checker. The insertion of our checker at 25% low observability nodes in ISCAS benchmarks requires only 0.189% area overhead.

Hardware Trojan Insertion in Finalized Layouts: From Methodology to a Silicon Demonstration

Owning a high-end semiconductor foundry is a luxury very few companies can afford. Thus, fabless design companies outsource integrated circuit fabrication to third parties. Within foundries, rogue elements may gain access to the customer’s layout and perform malicious acts, including the insertion of a hardware trojan (HT). Many works focus on the structure/effects of a HT, while very few have demonstrated the viability of their HTs in silicon. Even fewer disclose how HTs are inserted or the time required for this activity. Our work details, for the first time, how effortlessly a HT can be inserted into a finalized layout by presenting an insertion framework based on the engineering change order flow. For validation, we have built an ASIC prototype in 65nm CMOS technology comprising of four trojaned cryptocores. A side-channel HT is inserted in each core with the intent of leaking the cryptokey over a power channel. Moreover, we have determined that the entire attack can be mounted in a little over one hour. We also show that the attack was successful for all tested samples. Finally, our measurements demonstrate the robustness of our SCT against skews in the manufacturing process.

TVF: A Metric for Quantifying Vulnerability Against Hardware Trojan Attacks

The need for metrics for quantifying trustworthiness of electronic hardware against diverse threats on its integrity and confidentiality has greatly increased due to the increasing reliance on the untrusted global supply chain. Hardware Trojans, or malicious design alterations, has emerged as a major threat to hardware integrity and garnered significant interest in recent times due to its catastrophic potential. Effective protection against hardware Trojan attacks, however, requires well-defined metrics, which fall into two broad classes: 1) measure of a design’s vulnerability to Trojan insertion and 2) measure of effectiveness of a defense solution—a design or verification/test approach—against Trojan attacks, which is often represented as Trojan coverage. The former is important to assess the level of difficulty an adversary would encounter to insert a hard-to-detect Trojan. Previous efforts have assigned vulnerability as a function of the number of suspect nets identified in a design or are required to enumerate a subspace of Trojans. However, these values simplify the problem of hardware Trojan insertion and leave much of the subsequent analysis regarding the viable Trojan space unmeasured. In this article, we address this critical gap by presenting Trojan vulnerability factor ( TVF), a metric for quantifying a design’s vulnerability to Trojan insertion via maximal clique analysis. With such analysis, we can frame the threat to more accurately represent the Trojan behavior and quantify the level of effort required for a designer to cover these Trojan triggers without needing to directly consider Trojan trigger sizes. We also introduce soft thresholding to account for suspect nets, which lie at the boundary of a design. Experimental results highlight the benefits of the proposed approach over existing Trojan vulnerability metrics. Finally, we demonstrate scalability to large designs through partitioning and clique sampling-based estimations.

EVHA: Explainable Vision System for Hardware Testing and Assurance—An Overview

Due to the ever-growing demands for electronic chips in different sectors, semiconductor companies have been mandated to offshore their manufacturing processes. This unwanted matter has made security and trustworthiness of their fabricated chips concerning and has caused the creation of hardware attacks. In this condition, different entities in the semiconductor supply chain can act maliciously and execute an attack on the design computing layers, from devices to systems. Our attack is a hardware Trojan that is inserted during mask generation/fabrication in an untrusted foundry. The Trojan leaves a footprint in the fabrication through addition, deletion, or change of design cells. To tackle this problem, we propose EVHA (Explainable Vision System for Hardware Testing and Assurance) in this work, which can detect the smallest possible change to a design in a low-cost, accurate, and fast manner. The inputs to this system are scanning electron microscopy images acquired from the integrated circuits under examination. The system output is the determination of integrated circuit status in terms of having any defect and/or hardware Trojan through addition, deletion, or change in the design cells at the cell level. This article provides an overview on the design, development, implementation, and analysis of our defense system.

A Cost-Driven Method for Deep-Learning-Based Hardware Trojan Detection.

The Cyber-Physical System and even the Metaverse will become the second space in which human beings live. While bringing convenience to human beings, it also brings many security threats. These threats may come from software or hardware. There has been a lot of research on managing malware, and there are many mature commercial products, such as antivirus software, firewalls, etc. In stark contrast, the research community on governing malicious hardware is still in its infancy. Chips are the core component of hardware, and hardware Trojans are the primary and complex security issue faced by chips. Detection of hardware Trojans is the first step for dealing with malicious circuits. Due to the limitation of the golden chip and the computational consumption, the existing traditional detection methods are not applicable to very large-scale integration. The performances of traditional machine-learning-based methods depend on the accuracy of the multi-feature representation, and most of the methods may lead to instability because of the difficulty of extracting features manually. In this paper, employing deep learning, a multiscale detection model for automatic feature extraction is proposed. The model is called MHTtext and provides two strategies to balance the accuracy and computational consumption. After selecting a strategy according to the actual situations and requirements, the MHTtext generates the corresponding path sentences from the netlist and employs TextCNN for identification. Further, it can also obtain non-repeated hardware Trojan component information to improve its stability performance. Moreover, a new evaluation metric is established to intuitively measure the model's effectiveness and balance: the stabilization efficiency index (SEI). In the experimental results for the benchmark netlists, the average accuracy (ACC) in the TextCNN of the global strategy is as high as 99.26%, and one of its stabilization efficiency index values ranks first with a score of 71.21 in all comparison classifiers. The local strategy also achieved an excellent effect, according to the SEI. The results show that the proposed MHTtext model has high stability, flexibility, and accuracy, in general.

Using Approximate Circuits Against Hardware Trojans

Hardware Trojans (HTs) are malicious alterations in Integrated Circuits (ICs) that pose an important threat to safety-critical systems. Many techniques based on logic testing or side-channel analysis have been proposed in the literature aiming at detecting such malicious modifications in fabricated ICs. The detection of HTs is becoming more challenging with the shrinking of the technology and the impact of process variations. Therefore there is a need to neutralize the effect of HTs when the typical detection mechanism fails. In this work, we propose to tackle the effect of HTs by leveraging fault-tolerant techniques like Triple Modular Redundancy (TMR). More specifically, we propose to use an approximate TMR in order to neutralize the effects of HTs while saving area and increasing the complexity of inserting HTs. The efficiency of the proposed approach has been evaluated by using the ISCAS’85 benchmarks and stealthy ad-hoc HTs.

A cycle-level recovery method for embedded processor against HT tamper

As the core of Internet of Things (IoT), embedded processors are being used more and more extensive. However, embedded processors face various hardware security issues such as hardware trojans (HT) and code tamper attacks. In this paper, a cycle-level recovery method for embedded processor against HT tamper is proposed, which builds two hardware-implementation units, a General-Purpose Register (GPRs) backup unit and a PC rollback unit. Once a HT tamper is detected, the two units will carry out fast recovery through rolling back to the exact PC address corresponding to the wrong instruction and resuming the instruction execution. An open RISC-V core of PULPino is adopted for recovery mechanism verification, the experimental results and hardware costs show that the proposed method could guarantee the processor restore from abnormal state in real time with a reasonable hardware overhead.

Verification of serialising instructions for security against transient execution attacks

AbstractTransient execution attacks such as Spectre and Meltdown exploit speculative execution in modern microprocessors to leak information via cache side‐channels. Software solutions to defend against many transient execution attacks employ the lfence serialising instruction, which does not allow instructions that come after the lfence to execute out‐of‐order with respect to instructions that come before the lfence. However, errors and Trojans in the hardware implementation of lfence can be exploited to compromise the software mitigations that use lfence. The aforementioned security gap has not been identified and addressed previously. The authors provide a formal method solution that addresses the verification of lfence hardware implementation. The authors also show how hardware Trojans can be designed to circumvent lfence and demonstrate that their verification approach will flag such Trojans as well. The authors have demonstrated the efficacy of our approach using RSD, which is an open source RISC‐V based superscalar out‐of‐order processor.

Empirical study on security verification and assessment of neural network accelerator

With the significant success of machine learning, there are plenty of innovative neural network designs nowadays. The related applications become more and more pervasive in our daily life, even in life-critical domains such as autopilot and medical diagnosis, etc. In these domains, whether the AI-based system is “secure” or not is a critical issue. In this work, we first present six Hardware Trojan attacks with demonstrations of their impacts on the hardware design of neural networks. When data leakage occurs, we encode the leakage data to the output and make it more difficult to be detected. Most of our attacks can either achieve more than 98% attack success rate or leak out confidential data without causing any functional violation, with less than 1.5% overhead. We also discuss how to effectively and efficiently detect these Hardware Trojans with formal verification methods and further propose a risk assessment process to constitute a priority guidance to suggest security verification tasks of neuron network hardware. Based on our results, we strongly suggest that security specification and total verification are essential to neuron network designs.

Hardware Trojan Mitigation Technique in Network-on-Chip (NoC)

Due to globalization in the semiconductor industry, malevolent modifications made in the hardware circuitry, known as hardware Trojans (HTs), have rendered the security of the chip very critical. Over the years, many methods have been proposed to detect and mitigate these HTs in general integrated circuits. However, insufficient effort has been made for hardware Trojans (HTs) in the network-on-chip. In this study, we implement a countermeasure to congeal the network-on-chip hardware design in order to prevent changes from being made to the network-on-chip design. We propose a collaborative method which uses flit integrity and dynamic flit permutation to eliminate the hardware Trojan inserted into the router of the NoC by a disloyal employee or a third-party vendor corporation. The proposed method increases the number of received packets by up to 10% more compared to existing techniques, which contain HTs in the destination address of the flit. Compared to the runtime HT mitigation method, the proposed scheme also decreases the average latency for the hardware Trojan inserted in the flit’s header, tail, and destination field up to 14.7%, 8%, and 3%, respectively.

Hardware Trojan Detection Method Based on Dual Discriminator Assisted Conditional Generation Adversarial Network

Hardware Trojans are usually implanted by making malicious changes to a chip circuit, which can destroy chip functions or expose sensitive information once activated. The hardware Trojan detection method based on side channel information has now become one of the most widely used detection methods. However, due to the influence of the deviation of the acquisition equipment and the noise of the actual chip working environment, insufficient acquisition of useful information of the collected side channel information occurs, affecting the final results. To address the problem, this paper proposes a detection method based on a dual discriminator assisted conditional generation adversarial network (D2ACGAN), which combines the benefits of CGAN, ACGAN, and D2GAN models and can learn a variety of valid information of the tested chip. It can distinguish between side channel data with and without hardware Trojan and classify hardware Trojan using the extended data. Furthermore, to compare the performance of the proposed model, we use the existing CGAN and ACGAN models equally for side channel information expansion and hardware Trojan detection. Finally, the designed hardware Trojan is implanted in an encryption chip for generating data quality evaluation experiments and model method performance experiments. The results show that the average detection accuracy of the D2ACGAN-based hardware Trojan classification model can reach 97.08%, which is better than the detection models based on CNN, SVM, etc. The D2ACGAN model also outperforms the CGAN and ACGAN models in terms of generated data and hardware Trojan classification.

Delay based hardware Trojan detection exploiting spatial correlations to suppress variations

Hardware Trojan detection is a crucial problem with many dimensions and high complexity. Side channel analysis based methods are advantageous for not requiring Trojan activation but deeply suffer from process variations, the inability to detect small Trojans as well as the requirement for golden chips. In this paper, a non-invasive, golden chip free delay based hardware Trojan detection method is proposed. It exploits the inherent spatial correlations to suppress the Trojan hiding effect of the variations. The method is verified using post-manufacturing simulations under an elaborative variation model considering both inter and intra die components. The results reveal that although delay-alone approach fails to detect minimal Trojans, the proposed method achieves the detection securing more than 91% percent of a circuit on average. Moreover, if the trigger detection in cooperation with the payload detection is utilized, the detection probability exceeds 99%.

Securing FPGAs in IoT: a new run-time monitoring technique against hardware Trojan

Securing FPGAs in IoT: a new run-time monitoring technique against hardware Trojan

Split and Eliminate: A Region-Based Segmentation for Hardware Trojan Detection

Using third-party intellectual properties (3PIP) has been a norm in IC design development process to meet the time-to-market demand and at the same time minimizing the cost. But this flow introduces a threat, such as hardware trojan, which may compromise the security and trustworthiness of underlying hardware, like disclosing confidential information, impeding normal execution and even permanent damage to the system. In years, different detections methods are explored, from just identifying if the circuit is infected with hardware trojan using conventional methods to applying machine learning where it identifies which nets are most likely are hardware trojans. But the performance is not satisfactory in terms of maximizing the detection rate and minimizing the false positive rate. In this paper, a new hardware trojan detection approach is proposed where gate-level netlist is segmented into regions first before analyzing which nets might be hardware trojans. The segmentation process depends on the nets' connectivity, more specifically by looking on each fanout points. Then, further analysis takes place by means of computing the structural similarity of each segmented region and differentiate hardware trojan nets from normal nets. Experimental results show 100% detection of hardware trojan nets inserted on each benchmark circuits and an overall average of 1.38% of false positive rates which resulted to a higher accuracy with an average of 99.31%.