Thermal Scans for Detecting Hardware Trojans

Abstract

It is well known that companies have been outsourcing their IC production to countries where it is simply not possible to guarantee the integrity of final products. This relocation trend creates a need for methodologies and embedded design solutions to identify counterfeits but also to detect potential Hardware Trojans (HT). Hardware Trojans are tiny pieces of hardware that can be maliciously inserted in designs for several purposes ranging from denial of service, programmed obsolescence etc. They are usually stealthy and characterized by small area and power overheads. Their detection is thus a challenging task. Various solutions have been investigated to detect Hardware Trojans. We focus in this paper on the use of thermal near field scans to that aim. Therefore we first introduce and characterize a low cost, large bandwidth (20 kHz) thermal scanning system with the high detectivity required to detect small Hardware Trojans. Then, we experimentally demonstrate its efficiency on different test cases.

Hardware Trojans in Reconfigurable Computing

“…Columns two, four, and six of the table show that the consumer flow, in this case, would be irrelevant/not applicable. It can also be observed from Table 3.4 that the Trojan can be detected by any of the parties in a short amount of time which might be fast in comparison to the side-channel analysis technique based on the EM [97] and thermal scans [87] where the additional time is required to collect and process the EM and thermal signals.…”

Breaking Mobile Firmware Encryption through Near-Field Side-Channel Analysis

“…In some cases, the attacker can have access to the cryptoprocessor hardware outside of the secure boot context. If so, lock-in thermography [5] of the SoC can help at identifying areas of interest precisely [10]. 1 Lock-in thermography is based on thermal analysis of the die using infrared (IR) measurements.…”

A Hardware Trojan Detection Method Based on Structural Features of Trojan and Host Circuits

“…Usually a HT is quietly hidden in its host circuit and can only be triggered in rare conditions [5]. To detect the silent HTs, currently there are three categories of method: logic testing [6]- [10], side-channel analysis [11]- [16] and feature analysis [17]- [22]. Logic testing approaches [6]- [10] attempt to generate a large number of test vectors to activate unknown HTs and propagate their effects to the output ports.…”