Early chronic aluminium exposure impairs long-term potentiation and depression to the rat dentate gyrus in vivo

Ju-tao Chen,M. Wang,D. Ruan,J. She

DOI: https://doi.org/10.1016/S0306-4522(02)00138-0

IF: 3.708

2002-07-19

Neuroscience

Abstract:

What problem does this paper attempt to address?

Hardware Trojans in Chips: A Survey for Detection and Prevention

Chen Dong,Yi Xu,Ximeng Liu,Fan Zhang,Guorong He,Yuzhong Chen

DOI: https://doi.org/10.3390/s20185165

IF: 3.9

2020-01-01

Sensors

Abstract:Diverse and wide-range applications of integrated circuits (ICs) and the development of Cyber Physical System (CPS), more and more third-party manufacturers are involved in the manufacturing of ICs. Unfortunately, like software, hardware can also be subjected to malicious attacks. Untrusted outsourced manufacturing tools and intellectual property (IP) cores may bring enormous risks from highly integrated. Attributed to this manufacturing model, the malicious circuits (known as Hardware Trojans, HTs) can be implanted during the most designing and manufacturing stages of the ICs, causing a change of functionality, leakage of information, even a denial of services (DoS), and so on. In this paper, a survey of HTs is presented, which shows the threatens of chips, and the state-of-the-art preventing and detecting techniques. Starting from the introduction of HT structures, the recent researches in the academic community about HTs is compiled and comprehensive classification of HTs is proposed. The state-of-the-art HT protection techniques with their advantages and disadvantages are further analyzed. Finally, the development trends in hardware security are highlighted.
TROP: TRust-aware OPportunistic Routing in NoC with Hardware Trojans

Syam Sankar,Ruchika Gupta,John Jose,Sukumar Nandi

DOI: https://doi.org/10.1145/3639821

IF: 1.447

2024-02-15

ACM Transactions on Design Automation of Electronic Systems

Abstract:Multiple software and hardware intellectual property (IP) components are combined on a single chip to form Multi-Processor Systems-on-Chips (MPSoCs). Due to the rigid time-to-market constraints, some of the IPs are from outsourced third parties. Due to the supply-chain management of IP blocks being handled by unreliable third-party vendors, security has grown as a crucial design concern in the MPSoC. These IPs may get exposed to certain unwanted practises like the insertion of malicious circuits called Hardware Trojan (HT) leading to security threats and attacks, including sensitive data leakage or integrity violations. A Network-on-Chip (NoC) connects various units of an MPSoC. Since it serves as the interface between various units in an MPSoC, it has complete access to all the data flowing through the system. This makes NoC security a paramount design issue. Our research focuses on a threat model where the NoC is infiltrated by multiple HTs that can corrupt packets. Data integrity verified at the destination’s network interface (NI) triggers re-transmissions of packets if the verification results in an error. In this article, we propose an opportunistic trust-aware routing strategy that efficiently avoids HT while ensuring that the packets arrive at their destination unaltered. Experimental results demonstrate the successful movement of packets through opportunistically selected neighbours along a trust-aware path free from the HT effect. We also observe a significant reduction in the rate of packet re-transmissions and latency at the expense of incurring minimum area and power overhead.

computer science, software engineering, hardware & architecture
Socio-network Analysis of RTL Designs for Hardware Trojan Localization

Sheikh Ariful Islam,Farha Islam Mime,S M Asaduzzaman,Farzana Islam

DOI: https://doi.org/10.48550/arXiv.1912.10312

2019-12-22

Abstract:The recent surge in hardware security is significant due to offshoring the proprietary Intellectual property (IP). One distinct dimension of the disruptive threat is malicious logic insertion, also known as Hardware Trojan (HT). HT subverts the normal operations of a device stealthily. The diversity in HTs activation mechanisms and their location in design brings no catch-all detection techniques. In this paper, we propose to leverage principle features of social network analysis to security analysis of Register Transfer Level (RTL) designs against HT. The approach is based on investigating design properties, and it extends the current detection techniques. In particular, we perform both node- and graph-level analysis to determine the direct and indirect interactions between nets in a design. This technique helps not only in finding vulnerable nets that can act as HT triggering signals but also their interactions to influence a particular net to act as HT payload signal. We experiment the technique on 420 combinational HT instances, and on average, we can detect both triggering and payload signals with accuracy up to 97.37%.

Cryptography and Security
TPAD: Hardware Trojan Prevention and Detection for Trusted Integrated Circuits

Tony F. Wu,Karthik Ganesan,Yunqing Alexander Hu,H.-S. Philip Wong,Simon Wong,Subhasish Mitra

DOI: https://doi.org/10.1109/TCAD.2015.2474373

2015-08-25

Abstract:There are increasing concerns about possible malicious modifications of integrated circuits (ICs) used in critical applications. Such attacks are often referred to as hardware Trojans. While many techniques focus on hardware Trojan detection during IC testing, it is still possible for attacks to go undetected. Using a combination of new design techniques and new memory technologies, we present a new approach that detects a wide variety of hardware Trojans during IC testing and also during system operation in the field. Our approach can also prevent a wide variety of attacks during synthesis, place-and-route, and fabrication of ICs. It can be applied to any digital system, and can be tuned for both traditional and split-manufacturing methods. We demonstrate its applicability for both ASICs and FPGAs. Using fabricated test chips with Trojan emulation capabilities and also using simulations, we demonstrate: 1. The area and power costs of our approach can range between 7.4-165% and 0.07-60%, respectively, depending on the design and the attacks targeted; 2. The speed impact can be minimal (close to 0%); 3. Our approach can detect 99.998% of Trojans (emulated using test chips) that do not require detailed knowledge of the design being attacked; 4. Our approach can prevent 99.98% of specific attacks (simulated) that utilize detailed knowledge of the design being attacked (e.g., through reverse-engineering). 5. Our approach never produces any false positives, i.e., it does not report attacks when the IC operates correctly.

Hardware Architecture,Cryptography and Security
HOACS: Homomorphic Obfuscation Assisted Concealing of Secrets to Thwart Trojan Attacks in COTS Processor

Tanvir Hossain,Matthew Showers,Mahmudul Hasan,Tamzidul Hoque

2024-02-15

Abstract:Commercial-off-the-shelf (COTS) components are often preferred over custom Integrated Circuits (ICs) to achieve reduced system development time and cost, easy adoption of new technologies, and replaceability. Unfortunately, the integration of COTS components introduces serious security concerns. None of the entities in the COTS IC supply chain are trusted from a consumer's perspective, leading to a ''zero trust'' threat model. Any of these entities could introduce hidden malicious circuits or hardware Trojans within the component, allowing an attacker in the field to extract secret information (e.g., cryptographic keys) or cause a functional failure. Existing solutions to counter hardware Trojans are inapplicable in such a zero-trust scenario as they assume either the design house or the foundry to be trusted and consider the design to be available for either analysis or modification. In this work, we have proposed a software-oriented countermeasure to ensure the confidentiality of secret assets against hardware Trojans that can be seamlessly integrated in existing COTS microprocessors. The proposed solution does not require any supply chain entity to be trusted and does not require analysis or modification of the IC design. To protect secret assets in an untrusted microprocessor, the proposed method leverages the concept of residue number coding (RNC) to transform the software functions operating on the asset to be fully homomorphic. We have implemented the proposed solution to protect the secret key within the Advanced Encryption Standard (AES) program and presented a detailed security analysis. We also have developed a plugin for the LLVM compiler toolchain that automatically integrates the solution in AES. Finally, we compare the execution time overhead of the operations in the RNC-based technique with comparable homomorphic solutions and demonstrate significant improvement.

Cryptography and Security
Hardware Trojan Detection through Information Flow Security Verification

Adib Nahiyan,Mehdi Sadi,Rahul Vittal,Gustavo Contreras,Domenic Forte,Mark Tehranipoor

DOI: https://doi.org/10.1109/TEST.2017.8242062

2018-03-12

Abstract:Semiconductor design houses are increasingly becoming dependent on third party vendors to procure intellectual property (IP) and meet time-to-market constraints. However, these third party IPs cannot be trusted as hardware Trojans can be maliciously inserted into them by untrusted vendors. While different approaches have been proposed to detect Trojans in third party IPs, their limitations have not been extensively studied. In this paper, we analyze the limitations of the state-of-the-art Trojan detection techniques and demonstrate with experimental results how to defeat these detection mechanisms. We then propose a Trojan detection framework based on information flow security (IFS) verification. Our framework detects violation of IFS policies caused by Trojans without the need of white-box knowledge of the IP. We experimentally validate the efficacy of our proposed technique by accurately identifying Trojans in the trust-hub benchmarks. We also demonstrate that our technique does not share the limitations of the previously proposed Trojan detection techniques.

Cryptography and Security
Analog hardware trojan design and detection in OFDM based wireless cryptographic ICs

Liakot Ali,Farshad

DOI: https://doi.org/10.1371/journal.pone.0254903

IF: 3.7

2021-07-29

PLoS ONE

Abstract:Due to Hardware Trojan (HT), trustworthiness of Integrated Circuit (IC) supply chain is a burning issue in Semiconductor Industry nowadays. Over the last decade, extensive research has been carried on HT detection methods for digital circuits. However, the HT issue remains largely unexplored in the domain of Analog Mixed Signal (AMS)/ RF circuit where it is now an appealing target for the attackers. The increasing popularity of Orthogonal Frequency Division Multiplexing (OFDM) based wireless cryptographic ICs in modern communication systems makes it a lucrative target for HT-based attacks which could have a devastating impact on data security. This paper presents a trigger-based Hardware Trojan Threat model that exploits the extended cyclic prefix (ECP) property of the OFDM communication scheme to leak the secret encryption key over low noise Additive White Gaussian Channel (AWGN) and developed a Cyclic Prefix (CP) checker based detection mechanism named "SENTRY" to detect such trojans once it is triggered.
Preventing Hardware Trojans in Switch Chip Based on Payload Decoupling

Ke Sone,Binghao Yan,Xiangyu Li,Qinrang Liu,Ling OuYang

DOI: https://doi.org/10.23919/jcc.2021.08.008

2021-01-01

China Communications

Abstract:Hardware Trojans in integrated circuit chips have the characteristics of being covert, destructive, and difficult to protect, which have seriously endangered the security of the chips themselves and the information systems to which they belong. Existing solutions generally rely on passive detection techniques. In this paper, a hardware Trojans active defense mechanism is designed for network switching chips based on the principle of encryption algorithm. By encoding the data entering the chip, the argot hidden in the data cannot trigger the hardware Trojans that may exist in the chip, so that the chip can work normally even if it is implanted with a hardware Trojans. The proposed method is proved to be effective in preventing hardware Trojans with different trigger characteristics by simulation tests and practical tests on our secure switching chip.
Dynamic FPGA Detection and Protection of Hardware Trojan: A Comparative Analysis

Amr Alanwar,Mona A. Aboelnaga,Yousra Alkabani,M. Watheq El-Kharashi,Hassan Bedour

DOI: https://doi.org/10.48550/arXiv.1711.01010

2017-11-03

Cryptography and Security

Abstract:Hardware Trojan detection and protection is becoming more crucial as more untrusted third parties manufacture many parts of critical systems nowadays. The most common way to detect hardware Trojans is comparing the untrusted design with a golden (trusted) one. However, third-party intellectual properties (IPs) are black boxes with no golden IPs to trust. So, previous attempts to detect hardware Trojans will not work with third-party IPs. In this work, we present novel methods for Trojan protection and detection on field programmable gate arrays (FPGAs) without the need for golden chips. Presented methods work at runtime instead of test time. We provide a wide spectrum of Trojan detection and protection methods. While the simplest methods have low overhead and provide limited protection mechanisms, more sophisticated and costly techniques are introduced that can detect hardware Trojans and even clean up the system from infected IPs. Moreover, we study the cost of using the FPGA partial reconfiguration feature to get rid of infected IPs. In addition, we discuss the possibility to construct IP core certificate authority that maintains a centralized database of unsafe vendors and IPs. We show the practicality of the introduced schemes by implementing the different methodologies on FPGAs. Results show that simple methods present negligible overheads and as we try to increase security the delay and power overheads increase.
Hardware Trojan Insertion in Finalized Layouts: From Methodology to a Silicon Demonstration

Tiago D. Perez,Samuel Pagliarini,Tiago Perez

DOI: https://doi.org/10.1109/tcad.2022.3223846

IF: 2.9

2022-01-01

IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems

Abstract:Owning a high-end semiconductor foundry is a luxury very few companies can afford. Thus, fabless design companies outsource integrated circuit fabrication to third parties. Within foundries, rogue elements may gain access to the customer’s layout and perform malicious acts, including the insertion of a hardware trojan (HT). Many works focus on the structure/effects of an HT, while very few have demonstrated the viability of their HTs in silicon. Even fewer disclose how HTs are inserted or the time required for this activity. Our work details, for the first time, how effortlessly an HT can be inserted into a finalized layout by presenting an insertion framework based on the engineering change order flow. For validation, we have built an ASIC prototype in 65-nm CMOS technology comprising of four trojaned cryptocores. A side-channel HT is inserted in each core with the intent of leaking the cryptokey over a power channel. Moreover, we have determined that the entire attack can be mounted in a little over one hour. We also show that the attack was successful for all tested samples. Finally, our measurements demonstrate the robustness of our side-channel trojan against skews in the manufacturing process.

engineering, electrical & electronic,computer science, interdisciplinary applications, hardware & architecture
Evasive Hardware Trojan through Adversarial Power Trace

Behnam Omidi,Khaled N. Khasawneh,Ihsen Alouani

2024-01-05

Abstract:The globalization of the Integrated Circuit (IC) supply chain, driven by time-to-market and cost considerations, has made ICs vulnerable to hardware Trojans (HTs). Against this threat, a promising approach is to use Machine Learning (ML)-based side-channel analysis, which has the advantage of being a non-intrusive method, along with efficiently detecting HTs under golden chip-free settings. In this paper, we question the trustworthiness of ML-based HT detection via side-channel analysis. We introduce a HT obfuscation (HTO) approach to allow HTs to bypass this detection method. Rather than theoretically misleading the model by simulated adversarial traces, a key aspect of our approach is the design and implementation of adversarial noise as part of the circuitry, alongside the HT. We detail HTO methodologies for ASICs and FPGAs, and evaluate our approach using TrustHub benchmark. Interestingly, we found that HTO can be implemented with only a single transistor for ASIC designs to generate adversarial power traces that can fool the defense with 100% efficiency. We also efficiently implemented our approach on a Spartan 6 Xilinx FPGA using 2 different variants: (i) DSP slices-based, and (ii) ring-oscillator-based design. Additionally, we assess the efficiency of countermeasures like spectral domain analysis, and we show that an adaptive attacker can still design evasive HTOs by constraining the design with a spectral noise budget. In addition, while adversarial training (AT) offers higher protection against evasive HTs, AT models suffer from a considerable utility loss, potentially rendering them unsuitable for such security application. We believe this research represents a significant step in understanding and exploiting ML vulnerabilities in a hardware security context, and we make all resources and designs openly available online:

Cryptography and Security,Hardware Architecture,Machine Learning
SIMCom: Statistical Sniffing of Inter-Module Communications for Run-time Hardware Trojan Detection

Faiq Khalid,Syed Rafay Hasan,Osman Hasan,Muhammad Shafique

DOI: https://doi.org/10.1016/j.micpro.2020.103122

2020-05-24

Abstract:Timely detection of Hardware Trojans (HTs) has become a major challenge for secure integrated circuits. We present a run-time methodology for HT detection that employs a multi-parameter statistical traffic modeling of the communication channel in a given System-on-Chip (SoC), named as SIMCom. The main idea is to model the communication using multiple side-channel information like the Hurst exponent, the standard deviation of the injection distribution, and the hop distribution jointly to accurately identify HT-based online anomalies (that affects the communication without affecting the protocols or control signals). At design time, our methodology employs a "property specification language" to define and embed assertions in the RTL, specifying the correct communication behavior of a given SoC. At run-time, it monitors the anomalies in the communication behavior by checking the execution patterns against these assertions. For illustration, we evaluate SIMCom for three SoCs, i.e., SoC1 ( four single-core MC8051 and UART modules), SoC2 (four single-core MC8051, AES, ethernet, memctrl, BasicRSA, RS232 modules), and SoC3 (four single-core LEON3 connected with each other and AES, ethernet, memctrl, BasicRSA, RS23s modules microcontrollers). The experimental results show that with the combined analysis of multiple statistical parameters, SIMCom is able to detect all the benchmark Trojans (available on trust-hub) with less than 1% area and power overhead.

Cryptography and Security,Machine Learning
Optimized Lightweight Hardware Trojan-Based Fault Attack on DES

Fan Zhang,Yiran Zhang,Shengwen Shi,Shize Guo,Ziyuan Liang,Samiya Qureshi,Congyuan Xu

DOI: https://doi.org/10.1109/PADSW.2018.8644906

2018-01-01

Abstract:An optimized lightweight Hardware Trojan (HT)based fault attack is proposed, especially for those resource-constrained environments such as IoT networks. Firstly, Algebraic fault analysis (AFA)is introduced to evaluate different fault models and search for the optimal one. Next, considering the limited resource, a lightweight HT is carefully designed which only flips one bit of the circuit in IoT device. Finally, AFA is applied again to exploit the fault and recover the secret key. An illustrative attack is demonstrated on DES implemented on an FPGA platform, SASEBO-GII. This paper shows that, for single bit fault injection at different rounds or different indexes in the same round, the reduced key search space of DES varies. The proposed technique can search for the optimal fault model, guide the lightweight Hardware Trojan design and automatically recover the secret key. Only one fault is required to recover the secret key of DES, which improves the stealthiness of the designed Hardware Trojan in IoT networks. The entire attack framework can also be applied to other block ciphers such as AES and PRESENT.
Network-on-Chip Firewall: Countering Defective and Malicious System-on-Chip Hardware

Michael LeMay,Carl A. Gunter

DOI: https://doi.org/10.1007/978-3-319-23165-5_19

2017-01-17

Abstract:Mobile devices are in roles where the integrity and confidentiality of their apps and data are of paramount importance. They usually contain a System-on-Chip (SoC), which integrates microprocessors and peripheral Intellectual Property (IP) connected by a Network-on-Chip (NoC). Malicious IP or software could compromise critical data. Some types of attacks can be blocked by controlling data transfers on the NoC using Memory Management Units (MMUs) and other access control mechanisms. However, commodity processors do not provide strong assurances regarding the correctness of such mechanisms, and it is challenging to verify that all access control mechanisms in the system are correctly configured. We propose a NoC Firewall (NoCF) that provides a single locus of control and is amenable to formal analysis. We demonstrate an initial analysis of its ability to resist malformed NoC commands, which we believe is the first effort to detect vulnerabilities that arise from NoC protocol violations perpetrated by erroneous or malicious IP.

Cryptography and Security
Hardware Trojan Attacks on the Reconfigurable Interconnections of Field-Programmable Gate Array-Based Convolutional Neural Network Accelerators and a Physically Unclonable Function-Based Countermeasure Detection Technique

Jia Hou,Zichu Liu,Zepeng Yang,Chen Yang

DOI: https://doi.org/10.3390/mi15010149

IF: 3.4

2024-01-20

Micromachines

Abstract:Convolutional neural networks (CNNs) have demonstrated significant superiority in modern artificial intelligence (AI) applications. To accelerate the inference process of CNNs, reconfigurable CNN accelerators that support diverse networks are widely employed for AI systems. Given the ubiquitous deployment of these AI systems, there is a growing concern regarding the security of CNN accelerators and the potential attacks they may face, including hardware Trojans. This paper proposes a hardware Trojan designed to attack a crucial component of FPGA-based CNN accelerators: the reconfigurable interconnection network. Specifically, the hardware Trojan alters the data paths during activation, resulting in incorrect connections in the arithmetic circuit and consequently causing erroneous convolutional computations. To address this issue, the paper introduces a novel detection technique based on physically unclonable functions (PUFs) to safeguard the reconfigurable interconnection network against hardware Trojan attacks. Experimental results demonstrate that by incorporating a mere 0.27% hardware overhead to the accelerator, the proposed hardware Trojan can degrade the inference accuracy of popular neural network architectures, including LeNet, AlexNet, and VGG, by a significant range of 8.93% to 86.20%. The implemented arbiter-PUF circuit on a Xilinx Zynq XC7Z100 platform successfully detects the presence and location of hardware Trojans in a reconfigurable interconnection network. This research highlights the vulnerability of reconfigurable CNN accelerators to hardware Trojan attacks and proposes a promising detection technique to mitigate potential security risks. The findings underscore the importance of addressing hardware security concerns in the design and deployment of AI systems utilizing FPGA-based CNN accelerators.

chemistry, analytical,nanoscience & nanotechnology,instruments & instrumentation,physics, applied
Golden Reference-Free Hardware Trojan Localization Using Graph Convolutional Network

Rozhin Yasaei,Sina Faezi,Mohammad Abdullah Al Faruque

DOI: https://doi.org/10.1109/tvlsi.2022.3191683

2022-09-30

IEEE Transactions on Very Large Scale Integration (VLSI) Systems

Abstract:The globalization of the integrated circuit (IC) supply chain has moved most of the design, fabrication, and testing process from a single trusted entity to various untrusted third-party entities worldwide. The risk of using untrusted third-Party Intellectual Property (3PIP) is the possibility for adversaries to insert malicious modifications known as Hardware Trojans (HTs). These HTs can compromise the integrity, deteriorate the performance, deny the service, and alter the functionality of the design. While numerous HT detection methods have been proposed in the literature, the crucial task of HT localization is overlooked. Moreover, a few existing HT localization methods have several weaknesses: reliance on a golden reference, inability to generalize for all types of HT, lack of scalability, low localization resolution, and manual feature engineering/property definition. To overcome their shortcomings, we propose a novel, golden reference-free HT localization method at the pre-silicon stage by leveraging graph convolutional network (GCN). In this work, we convert the circuit design into its intrinsic data structure, graph, and extract the node attributes. Afterward, the graph convolution performs automatic feature extraction for nodes to classify the nodes as Trojan or benign. Our approach is automated and does not burden the designer with manual code review. It locates the Trojan signals with 99.6% accuracy, 93.1% -score, and a false-positive rate below 0.009%.

engineering, electrical & electronic,computer science, hardware & architecture
The State-of-the-art in EDA tools: the Hardware Trojan Confrontation Framework

Fan Zhang,Chen Dong,Wucheng Hu,Jinghui Chen,Guorong He

DOI: https://doi.org/10.1109/IAEAC47372.2019.8997863

2019-01-01

Abstract:EDA tools almost completely automate the current chip design. However, EDA tools are all provided by third-party companies, therefore the credibility of EDA tools and the trust issues brought by their process libraries have attracted people's attention. Given these problems, this paper proposes a self-training hardware Trojan confrontation framework based on machine learning embedded in EDA tools. The framework focuses on the gate-level netlist files generated during the integrated chip comprehensive optimization phase, thereby detects, locates and deletes hardware Trojans that may appear. The experimental results show that the framework can achieve more than 85% detection effect for unknown hardware Trojans. Moreover, for known hardware Trojans, this framework can achieve almost 100% detection. Accordingly, hardware Trojans can be located and deleted.
SCARF: Securing Chips with a Robust Framework against Fabrication-time Hardware Trojans

Mohammad Eslami,Tara Ghasempouri,Samuel Pagliarini

DOI: https://doi.org/10.1109/TC.2024.3449082

2024-08-28

Abstract:The globalization of the semiconductor industry has introduced security challenges to Integrated Circuits (ICs), particularly those related to the threat of Hardware Trojans (HTs) - malicious logic that can be introduced during IC fabrication. While significant efforts are directed towards verifying the correctness and reliability of ICs, their security is often overlooked. In this paper, we propose a comprehensive approach to enhance IC security from the front-end to back-end stages of design. Initially, we outline a systematic method to transform existing verification assets into potent security checkers by repurposing verification assertions. To further improve security, we introduce an innovative technique for integrating online monitors during physical synthesis - a back-end insertion providing an additional layer of defense. Experimental results demonstrate a significant increase in security, measured by our introduced metric, Security Coverage (SC), with a marginal rise in area and power consumption, typically under 20%. The insertion of online monitors during physical synthesis enhances security metrics by up to 33.5%. This holistic approach offers a comprehensive and resilient defense mechanism across the entire spectrum of IC design.

Cryptography and Security,Hardware Architecture
A Pragmatic Methodology for Blind Hardware Trojan Insertion in Finalized Layouts

Alexander Hepp,Tiago Perez,Samuel Pagliarini,Georg Sigl

DOI: https://doi.org/10.48550/arXiv.2208.09235

2022-08-19

Cryptography and Security

Abstract:A potential vulnerability for integrated circuits (ICs) is the insertion of hardware trojans (HTs) during manufacturing. Understanding the practicability of such an attack can lead to appropriate measures for mitigating it. In this paper, we demonstrate a pragmatic framework for analyzing HT susceptibility of finalized layouts. Our framework is representative of a fabrication-time attack, where the adversary is assumed to have access only to a layout representation of the circuit. The framework inserts trojans into tapeout-ready layouts utilizing an Engineering Change Order (ECO) flow. The attacked security nodes are blindly searched utilizing reverse-engineering techniques. For our experimental investigation, we utilized three crypto-cores (AES-128, SHA-256, and RSA) and a microcontroller (RISC-V) as targets. We explored 96 combinations of triggers, payloads and targets for our framework. Our findings demonstrate that even in high-density designs, the covert insertion of sophisticated trojans is possible. All this while maintaining the original target logic, with minimal impact on power and performance. Furthermore, from our exploration, we conclude that it is too naive to only utilize placement resources as a metric for HT vulnerability. This work highlights that the HT insertion success is a complex function of the placement, routing resources, the position of the attacked nodes, and further design-specific characteristics. As a result, our framework goes beyond just an attack, we present the most advanced analysis tool to assess the vulnerability of HT insertion into finalized layouts.
T-TER: Defeating A2 Trojans with Targeted Tamper-Evident Routing

Timothy Trippel,Kang G. Shin,Kevin B. Bush,Matthew Hicks

DOI: https://doi.org/10.48550/arXiv.1906.08842

2020-10-28

Abstract:Since the inception of the Integrated Circuit (IC), the size of the transistors used to construct them has continually shrunk. While this advancement significantly improves computing capability, fabrication costs have skyrocketed. As a result, most IC designers must now outsource fabrication. Outsourcing, however, presents a security threat: comprehensive post-fabrication inspection is infeasible given the size of modern ICs, so it is nearly impossible to know if the foundry has altered the original design during fabrication (i.e., inserted a hardware Trojan). Defending against a foundry-side adversary is challenging because---even with as few as two gates---hardware Trojans can completely undermine software security. Researchers have attempted to both detect and prevent foundry-side attacks, but all existing defenses are ineffective against Trojans with footprints of a few gates or less. We present Targeted Tamper-Evident Routing (T-TER), a preventive layout-level defense against untrusted foundries, capable of thwarting the insertion of even the stealthiest hardware Trojans. T-TER is directed and routing-centric: it prevents foundry-side attackers from routing Trojan wires to, or directly adjacent to, security-critical wires by shielding them with guard wires. Unlike shield wires commonly deployed for cross-talk reduction, T-TER guard wires pose an additional technical challenge: they must be tamper-evident in both the digital (deletion attacks) and analog (move and jog attacks) domains. We address this challenge by developing a class of designed-in guard wires, that are added to the design specifically to protect security-critical wires. T-TER's guard wires incur minimal overhead, scale with design complexity, and provide tamper-evidence against attacks.

Cryptography and Security

Early chronic aluminium exposure impairs long-term potentiation and depression to the rat dentate gyrus in vivo

Hardware Trojans in Chips: A Survey for Detection and Prevention

TROP: TRust-aware OPportunistic Routing in NoC with Hardware Trojans

Socio-network Analysis of RTL Designs for Hardware Trojan Localization

TPAD: Hardware Trojan Prevention and Detection for Trusted Integrated Circuits

HOACS: Homomorphic Obfuscation Assisted Concealing of Secrets to Thwart Trojan Attacks in COTS Processor

Hardware Trojan Detection through Information Flow Security Verification

Analog hardware trojan design and detection in OFDM based wireless cryptographic ICs

Preventing Hardware Trojans in Switch Chip Based on Payload Decoupling

Dynamic FPGA Detection and Protection of Hardware Trojan: A Comparative Analysis

Hardware Trojan Insertion in Finalized Layouts: From Methodology to a Silicon Demonstration

Evasive Hardware Trojan through Adversarial Power Trace

SIMCom: Statistical Sniffing of Inter-Module Communications for Run-time Hardware Trojan Detection

Optimized Lightweight Hardware Trojan-Based Fault Attack on DES

Network-on-Chip Firewall: Countering Defective and Malicious System-on-Chip Hardware

Hardware Trojan Attacks on the Reconfigurable Interconnections of Field-Programmable Gate Array-Based Convolutional Neural Network Accelerators and a Physically Unclonable Function-Based Countermeasure Detection Technique

Golden Reference-Free Hardware Trojan Localization Using Graph Convolutional Network

The State-of-the-art in EDA tools: the Hardware Trojan Confrontation Framework

SCARF: Securing Chips with a Robust Framework against Fabrication-time Hardware Trojans

A Pragmatic Methodology for Blind Hardware Trojan Insertion in Finalized Layouts

T-TER: Defeating A2 Trojans with Targeted Tamper-Evident Routing