SPARTA-COTS: A Laser Probing Approach for Sequential Trojan Detection in COTS Integrated Circuits

Stern, Andrew; Mehta, Dhwani; Tajik, Shahin; Guin, Ujjwal; Farahmandi, Farimah; Tehranipoor, Mohammad

doi:10.1109/paine49178.2020.9337728

Cited by 13 publications

(5 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The test-based and run-time defenses discussed in Section 5.3 are post-silicon HT detection methods. Other post-silicon HT detection methods include: (a) destructive reverse-engineering, which involves de-packaging and delayering the chip, imaging the chip's layers, and using software to stitch together the prepared images, thereby recovering the layout and netlist, which thereafter can be carefully examined to detect the presence of HTs [66], [67]; (b) non-destructive side-channel analysis to expose the HT location, for example using optical circuit analysis [68], electromagnetic emanation (EM) measurements [69], [70], [71], thermal map analysis [72], backscattering [73], and laser probing [74]; and (c) using on-chip monitors, i.e., current sensors [75], thermal sensors [76], and invariance checkers [77], for run-time HT detection.…”

Section: Related Prevention and Detection De-fense Mechanismsmentioning

confidence: 99%

Leaking Wireless ICs via Hardware Trojan-Infected Synchronization

Diaz-Rizo¹,

Aboushady²,

Stratigopoulos³

2023

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

We propose a Hardware Trojan (HT) attack in wireless Integrated Circuits (ICs) that aims at leaking sensitive information within a legitimate transmission. The HT is hidden inside the transmitter modulating the sensitive information into the preamble of each transmitted frame which is used for the synchronization of the transmitter with the receiver. The data leakage does not affect synchronization and is imperceptible by the inconspicuous nominal receiver as it does not incur any performance penalty in the communication. A knowledgeable rogue receiver, however, can recover the data using signal processing that is too expensive and impractical to be used during run-time in nominal receivers. The HT mechanism is designed at circuit-level and is embedded entirely into the digital section of the RF transceiver having a tiny footprint. The proposed HT attack is demonstrated with measurements on a hardware platform. We demonstrate the stealthiness of the attack, i.e., its ability to evade defenses based on testing and run-time monitoring, and the robustness of the attack, i.e., the ability of the rogue receiver to recover the leaked information even under unfavorable channel conditions.

show abstract

Section: Related Prevention and Detection De-fense Mechanismsmentioning

confidence: 99%

Leaking Wireless ICs via Hardware Trojan-Infected Synchronization

Diaz-Rizo¹,

Aboushady²,

Stratigopoulos³

2023

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

show abstract

“…This concept is represented in Figure 4, where the state elements (i.e., DFFs) of a design are stitched together to form a scan-chain, while the Trojan FFs are excluded from the same. Stern et al exploited this notion to detect Trojans using a non-destructive backside laser probing approach [48]. This approach relies on finding the location of sequential elements (FFs) for a hardware Trojan.…”

Section: B Sequential Trojan Detectionmentioning

confidence: 99%

“…Upon comparing the two sets of EOFM images, the locations of the malicious FFs are determined. Figure 5 shows the processed EOFM images from the experimentation conducted in [48] on Trust-hub benchmark circuits. The red boxes in Figure 5.…”

Section: B Sequential Trojan Detectionmentioning

confidence: 99%

See 1 more Smart Citation

Survey of Recent Developments for Hardware Trojan Detection

Jain¹,

Zhou

Guin

2021

2021 IEEE International Symposium on Circuits and Systems (ISCAS)

Self Cite

View full text Add to dashboard Cite

The outsourcing of the design and manufacturing of Integrated Circuits (ICs) poses a severe threat to our critical infrastructures as an adversary can exploit them by bypassing the security features by activating a hardware Trojan. These malicious modifications in the design introduced at an untrusted fabrication site can virtually leak any secret information from a secure system to an adversary. This paper discusses all three different hardware Trojan models, such as combinational, sequential, and analog Trojans. We provide a survey of the recent advancements in Trojan detection techniques classified based on their applicability to different Trojans types. We describe a practical approach recently developed using the characterization of Electro-Optical Frequency Mapping (EOFM) images of the chip to detect a hardware Trojan by identifying malicious state elements. This survey also presents open problems with Trojan detection and suggests future research directions in hardware Trojan detection.

show abstract

“…HT designs are becoming increasingly sophisticated [2]- [4] making the development of countermeasures very challenging. Countermeasures include pre-silicon prevention of HT insertion (i.e., based on functional filler cells [5], logic obfuscation [6], camouflaging [7], or split manufacturing [8]), detection of the presence of HTs prior to IC usage (i.e., based on logic testing tools [9], Information Flow Tracking (IFT) [10], and sidechannel analysis [11], [12]), and detection of HT activation during run-time (i.e., based on on-chip monitors [13]).…”

Section: Introductionmentioning

confidence: 99%

Circuit-to-Circuit Attacks in SoCs via Trojan-Infected IEEE 1687 Test Infrastructure

Portolan

Pavlidis²,

Natale

et al. 2022

2022 IEEE International Test Conference (ITC)

View full text Add to dashboard Cite

We demonstrate a Hardware Trojan (HT)-based circuit-to-circuit attack mechanism in the context of Systemson-Chip (SoCs). The HT trigger is hidden inside the attacking circuit and the HT payload travels from the attacking circuit to the victim circuit via the test infrastructure. The common test infrastructure is configured accordingly by the HT so as to propagate the HT payload. We demonstrate the capability of this HT to perform a denial-of-service attack on an industrial Analog-to-Digital Converter (ADC) connected to a IEEE 1687 test infrastructure.

show abstract

SPARTA-COTS: A Laser Probing Approach for Sequential Trojan Detection in COTS Integrated Circuits

Cited by 13 publications

References 22 publications

Leaking Wireless ICs via Hardware Trojan-Infected Synchronization

Leaking Wireless ICs via Hardware Trojan-Infected Synchronization

Survey of Recent Developments for Hardware Trojan Detection

Circuit-to-Circuit Attacks in SoCs via Trojan-Infected IEEE 1687 Test Infrastructure

Contact Info

Product

Resources

About