Hardware Trojan horse benchmark via optimal creation and placement of malicious circuitry

Abstract

This paper proposes Hardware Trojan (HT) placement techniques that yield challenging HT detection benchmarks. We develop three types of one-gate HT benchmarks based on switching power, leakage power, and delay measurements that are commonly used in HT detection. In particular, we employ an iterative searching algorithm to find rarely switching locations, an aging-based approach to create ultralow power HT, and a backtracking-based reconvergence identification method to determine the non-observable delay paths. The simulation results indicate that our HT attack benchmarks provide the most challenging representative test cases for the evaluation of side-channel based HT detection techniques.

VeriTrust: Verification for Hardware Trust

“…The HTs used in our experiments are obtained from two sources: the Trust-Hub website [18] and some related papers [3,[11][12][13]16], detailed in Appendix B. We do not directly conduct experiments on those circuits in which HTs are originally inserted, because verification tests required by both [11] and VeriTrust for HT detection are not available.…”

“…Given the huge state-space that HTs can hide within a reasonably sized circuit, attackers can easily employ a trigger condition that has extremely low probability to be activated with verification tests. Various HT designs have been shown in the literature (e.g., [16,17]) in recent years, and the Trust-Hub website [18] has released a set of HT benchmark circuits with different triggers and payloads.…”

“…As a result, the extensive simulation/emulation is likely to detect this type of HTs. From this perspective, bug-based HT is usually not a good choice for attackers in terms of the stealthy requirement, and almost all HT designs appeared in the literature (e.g., [3,[11][12][13][16][17][18]) belong to the parasite-based type, as discussed in the following.…”

“…The HTs used in our experiments are obtained from two sources: the Trust-Hub website [18] and some related papers [3,[11][12][13]16], as summarized in Table 1. To be specific, there are 33 HTs, wherein 24 HTs are inserted into the HDL source code at the register-transfer level (RTL) while the other 9 HTs are inserted into netlist.…”

Advancing the state-of-the-art in hardware Trojans design

“…Further works construct and detect HTs that use side channels [19], [20], [21]. Such HTs remain implicitly on, and have usually no effect on the normal functionality of the circuit.…”