New Testing Procedure for Finding Insertion Sites of Stealthy Hardware Trojans

Abstract

Hardware Trojans (HTs) are malicious alterations to a circuit. These modifications can be inserted either during the design phase or during the fabrication process. Due to the diversity of Hardware Trojans, detecting and/or locating them are challenging tasks. Numerous approaches have been proposed to address this problem. Methods based on logic testing consist in trying to activate potential HTs and detect erroneous outputs during test. However, HTs are stealthy in nature i.e. mostly inactive unless they are triggered by a very rare condition. The activation of a HT is therefore a major challenge. In this paper, we propose a new testing procedure dedicated to identifying where a possible HT may be easily inserted and generating the test patterns that are able to excite these sites. The selection of the sites is based on the assumption that the HT (i) is triggered by signals with low controllability, (ii) combines them using gates in close proximity in the circuit's layout, and (iii) without introducing new gates in critical paths.

Efficient triggering of Trojan hardware logic

“…The assumption of rareness is challenged for practical reasons (time complexity to derive an appropriate test suite, as discussed in [22]) as well as because rare triggering conditions can be constructed by combining conditions that are not so rare [23]. It is beneficial to shift the focus towards providing metrics of the coverage of the input vector space.…”

In-situ Trojan authentication for invalidating hardware-Trojan functions

“…Otherwise we must throw it away to avoid security leakage. For example, we can use the methods such as in [2], [5], [6], [11], [14], [19], which identify whether a given netlist is HT-inserted or not. If we can accurately identify whether the netlist is HT-inserted or not, we can decide whether to use it, redesign it, or throw it away.…”

“…They are classified into anti-reverse engineering [10], [15], vulnerability analysis [13], HT detection [2], [4]- [6], [8], [11], [14], [16], [19], [21]. test point insertion [18], logic obfuscation [9], [12], HT prevention [20], and HT removing [7].…”

Using outliers to detect stealthy hardware trojan triggering?

“…HTs detection methods on fabricated ICs are commonly divided into two categories: methods based on side-channel analysis [6][7][8], or logic testing [9][10][11]. In both cases the goal is to test ICs after fabrication to ensure that they are HT free.…”

“…Logic testing methods consist in activating potential HTs in order to provoke an error on circuit's outputs [9][10][11]. A HT model is presented in [9], decomposing the HT into to parts: the trigger and the payload (cf.…”