Self-referencing: A Scalable Side-Channel Approach for Hardware Trojan Detection

Abstract

Malicious modification of integrated circuits (ICs) in untrusted foundry, referred to as "Hardware Trojan", has emerged as a serious security threat. While side-channel analysis has been reported as an effective approach to detect hardware Trojans, increasing process variations in nanoscale technologies pose a major challenge, since process noise can easily mask the Trojan effect on a measured side-channel parameter, such as supply current. Besides, existing side-channel approaches suffer from reduced Trojan detection sensitivity with increasing design size. In this paper, we propose a novel scalable side-channel approach, named self-referencing, along with associated vector generation algorithm to improve the Hardware Trojan detection sensitivity under large process variations. It compares transient current signature of one region of an IC with that of another, thereby nullifying the effect of process noise by exploiting spatial correlation across regions in terms of process variations. To amplify the Trojan effect on supply current, we propose a region-based vector generation approach, which divides a circuit-undertest (CUT) into several regions and for each region, finds the test vectors which induce maximum activity in that region, while minimizing the activity in other regions. We show that the proposed side-channel approach is scalable with respect to both amount of process variations and design size. The approach is validated with both simulation and measurement results using an FPGA-based test setup for large designs including a 32-bit DLX processor core (∼ 10 5 transistors). Results shows that our approach can find ultra-small (<0.01% area) Trojans under large process variations of up to ± 20% shift in transistor threshold voltage.

VeriTrust: Verification for Hardware Trust

“…Most existing HT detection techniques consider HTs inserted during fabrication and use side-channel analysis for HT detection (e.g., power-based analysis [6], timing-based analysis [7], and current-based analysis [8]). To reduce the sensitivity of SCA-based HT detection methods on the process variation, several gate-level characterization (GLC) techniques were proposed for HT detection recently [9,10].…”

“…Most prior works on HT detection are based on side-channel analysis (SCA) (e.g., [6][7][8][9][10]). The idea behind is that a HT will affect some side-channel signatures, such as path delay and supply current, Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page.…”

Electromagnetic Transmission of Intellectual Property Data to Protect FPGA Designs

“…Hardware Trojan is also used to cause or amplify side-channel leakage of cryptographic hardware [25]. Note that using side channels to detect a hardware Trojan has also been the subject of several studies [26], [27], [28].…”

HTOutlier: Hardware Trojan detection with side-channel signature outlier identification

“…Since traditional VLSI testing techniques are not suitable for HT detection without knowledge of the HT and trigger conditions [3], the mainstream HT detection method is side-channel analysis. The idea behind is that HTs must affect some side-channel signatures, e.g., path delay [4,5], supply current [6,7,8] or power consumption [9], even when functionally-unactivated.…”