Advancing the state-of-the-art in hardware Trojans design

Abstract

Abstract-Electronic Design Automation (EDA) industry heavily reuses third party IP cores. These IP cores are vulnerable to insertion of Hardware Trojans (HTs) at design time by third party IP core providers or by malicious insiders in the design team. State of the art research has shown that existing HT detection techniques, which claim to detect all publicly available HT benchmarks, can still be defeated by carefully designing new sophisticated HTs. The reason being that these techniques consider the HT landscape to be limited only to the publicly known HT benchmarks, or other similar (simple) HTs. However the adversary is not limited to these HTs and may devise new HT design principles to bypass these countermeasures. In this paper, we discover certain crucial properties of HTs which lead to the definition of an exponentially large class of Deterministic Hardware Trojans H D that an adversary can (but is not limited to) design. The discovered properties serve as HT design principles, based on which we design a new HT called XOR-LFSR and present it as a 'proof-of-concept' example from the class H D . These design principles help us understand the tremendous ways an adversary has to design a HT, and show that the existing publicly known HT benchmarks are just the tip of the iceberg on this huge landscape. This work, therefore, stresses that instead of guaranteeing a certain (low) false negative rate for a small constant set of publicly known HTs, a rigorous HT detection tool should take into account these newly discovered HT design principles and hence guarantee the detection of an exponentially large class (exponential in number of wires in IP core) of HTs with negligible false negative rate.

Holistic hardware Trojan design of trigger and payload at gate level with rare switching signals eliminated

“…Fig. 1b depicts the Trojan model proposed in [8]. The stealthiness of trigger circuit is implemented by a combination of rare switching signals, such as C m ¼ C m1 C m2 ; Á Á Á ; C mk .…”

“…3. Resistance to the state-of-the-art detections 3.1 Activation probability Activation probability is a basic evaluation criterion for Trojan stealthiness analysis in activation based detections, [7,9]; b. XOR-LFSR structure in [8] a b c d The difference between trigger activation and Trojan activation lies in the dependency between trigger and payload signals. For simplicity, we suppose that trigger signal and payload signal are independent and Trojan circuit will make some difference to the original circuit when trigger condition is satisfied.…”

“…For Trojan research, many Trojan benchmarks have been proposed [6,7,8,9,10,11,12,13,14,15,16]. To keep dormant in functional verification, hardware Trojan is usually triggered by some rare conditions, which is the so-called trigger condition.…”

“…The traditional digital Trojan design methodology can be divided into two categories, the first exploits the rare transition signals in the original design [6,7,9,15], and the second attempts to partition the Trojan circuit into smaller parts and stages [12,14]. A uniform distribution of states is acquired by linear feedback shift register in [8], but low transition wire is still created when generating rare condition by combinational circuits. All these Trojans implement their rare conditions rely on one or more low activity or low testability signals, which may be detected by logic analysis detections, such as unused logic analysis [21,22], activation based analysis [23,24,25], Sandia Controllability/Observability based analysis [17,18] and probability analysis [19,20].…”

On a New Hardware Trojan Attack on Power Budgeting of Many Core Systems

“…DoS attack enabled by hardware Trojan (HT) is becoming a serious threat to modern many-core chips [3], [13]. Various circuit level HT detection techniques have been proposed, based on logic testing and side channel analysis during the post-silicon test/validation process [1], [14].…”