Potential Trigger Detection for Hardware Trojans

• Published in: IEEE transactions on computer-aided design of integrated circuits and systems Vol. 37; no. 7; pp. 1384 - 1395
• Main Authors: Zou, Minhui, Cui, Xiaotong, Shi, Liang, Wu, Kaijie
• Format: Journal Article
• Language: English
• Published: IEEE 01.07.2018
• Subjects: Fabrication; Globalization; Hardware; Hardware Trojan (HT); nets activeness; Registers; state transition; Switches; total state; Trojan horses
• ISSN: 0278-0070; 1937-4151
• DOI: 10.1109/TCAD.2017.2753201

Due to the globalization trend of IC industry, more and more chips are designed and/or fabricated by foreign companies and foundries. Among all the consequences of this globalization trend, the possible existence of stealthy-inserted hardware Trojans (HTs) has raised a great security concern. Without the awareness of the end users or the original designers of host circuits, HTs are usually inserted stealthily at one of the outsourced design or fabrication stages, remain (almost) harmless to the host on dormant mode, and upon triggered will disturb the functions and/or leak the secrets carried by the host. It could become a serious security leak of the systems built on top of infected chips. Identifying whether a circuit carries an HT is thus of the utmost importance to mission-critical applications. Speaking from the point of HT designers, nets with extreme state probabilities could be used to create rare state combination for the purpose of HT triggering. Besides, HT designers seek nets with low switching probabilities to insert their HTs in order not to increase power leakage. We denote the nets with extreme state probability as extreme nets and the nets with low switching probability as inactive nets. It is commonly believed that in order to minimize the chance of accidental triggering or power analysis, they would be better to choose, among all the nets of the host, the nets that with extreme state probabilities (extreme nets) or the nets that barely switch (inactive nets) to construct the trigger parts of their HTs, respectively. However, a net of a circuit experiences very different state probabilities and switching probabilities on test mode and function mode, and existing works have only considered the former. The nets with low activeness on both test mode and function mode hence will be the "best candidates." In this paper we will first build the ground on finding the nets with low activeness on function mode, and then propose a fast heuristic method approach. The method runs in minimal complexity, has high accuracy, and is tested on popular benchmarks and large-sized circuits.