Investigation of subthreshold resonances with the Trojan horse method

G. Baur,S. Typel,G.Baur,S.Typel

DOI: https://doi.org/10.48550/arXiv.nucl-th/0604057

2006-04-24

Nuclear Theory

Abstract:It is pointed out that the Trojan horse method is a suitable tool to investigate subthreshold resonances.

What problem does this paper attempt to address?

Trojan Awakener: Detecting Dormant Malicious Hardware Using Laser Logic State Imaging (Extended Version)

Thilo Krachenfels,Jean-Pierre Seifert,Shahin Tajik

DOI: https://doi.org/10.48550/arXiv.2107.10147

2023-02-02

Abstract:The threat of hardware Trojans (HTs) and their detection is a widely studied field. While the effort for inserting a Trojan into an application-specific integrated circuit (ASIC) can be considered relatively high, especially when trusting the chip manufacturer, programmable hardware is vulnerable to Trojan insertion even after the product has been shipped or during usage. At the same time, detecting dormant HTs with small or zero-overhead triggers and payloads on these platforms is still a challenging task, as the Trojan might not get activated during the chip verification using logical testing or physical measurements. In this work, we present a novel Trojan detection approach based on a technique known from integrated circuit (IC) failure analysis, capable of detecting virtually all classes of dormant Trojans. Using laser logic state imaging (LLSI), we show how supply voltage modulations can awaken inactive Trojans, making them detectable using laser voltage imaging techniques. Therefore, our technique does not require triggering the Trojan. To support our claims, we present three case studies on 28 and 20 SRAM- and flash-based field-programmable gate arrays (FPGAs). We demonstrate how to detect with high confidence small changes in sequential and combinatorial logic as well as in the routing configuration of FPGAs in a non-invasive manner. Finally, we discuss the practical applicability of our approach on dormant analog Trojans in ASICs.

Cryptography and Security
A Symbolic Approach to Detecting Hardware Trojans Triggered by Don't Care Transitions

Ruochen Dai,Tuba Yavuz

DOI: https://doi.org/10.48550/arXiv.2111.03989

2021-11-07

Abstract:Due to the globalization of Integrated Circuit (IC) supply chain, hardware trojans and the attacks that can trigger them have become an important security issue. One type of hardware Trojans leverages the don't care transitions in Finite State Machines (FSMs) of hardware designs. In this paper, we present a symbolic approach to detecting don't care transitions and the hidden Trojans. Our detection approach works at both RTL and gate-level, does not require a golden design, and works in three stages. In the first stage, it explores the reachable states. In the second stage, it performs an approximate analysis to find the don't care transitions. In the third stage, it performs a state-space exploration from reachable states that have incoming don't care transitions to find behavioral discrepancies with respect to what has been observed in the first stage. We also present a pruning technique based on the reachability of FSM states. We present a methodology that leverages both RTL and gate-level for soundness and efficiency. Specifically, we show that don't care transitions must be detected at the gate-level, i.e., after synthesis has been performed, for soundness. However, under specific conditions, Trojan detection can be performed more efficiently at RTL. Evaluation of our approach on a set of benchmarks from OpenCores and TrustHub and using gate-level representation generated by two synthesis tools, Yosys and Synopsis Design Compiler (SDC), shows that our approach is both efficient (up to 10X speedup w.r.t. no pruning) and precise (0% false positives) in detecting don't care transitions and the Trojans that leverage them. Additionally, the total analysis time can achieve up to 3.40X (using Yosys) and 2.52X (SDC) speedup when synthesis preserves the FSM structure and the Trojan detection is performed at RTL.

Symbolic Computation
The State-of-the-art in EDA tools: the Hardware Trojan Confrontation Framework

Fan Zhang,Chen Dong,Wucheng Hu,Jinghui Chen,Guorong He

DOI: https://doi.org/10.1109/IAEAC47372.2019.8997863

2019-01-01

Abstract:EDA tools almost completely automate the current chip design. However, EDA tools are all provided by third-party companies, therefore the credibility of EDA tools and the trust issues brought by their process libraries have attracted people's attention. Given these problems, this paper proposes a self-training hardware Trojan confrontation framework based on machine learning embedded in EDA tools. The framework focuses on the gate-level netlist files generated during the integrated chip comprehensive optimization phase, thereby detects, locates and deletes hardware Trojans that may appear. The experimental results show that the framework can achieve more than 85% detection effect for unknown hardware Trojans. Moreover, for known hardware Trojans, this framework can achieve almost 100% detection. Accordingly, hardware Trojans can be located and deleted.
Title : Detection of Mechanical Resonance of a Single-Electron Transistor by Direct Current Year : 2010 Version : Final

Y. Pashkin,T. F. Li,J. Pekola,O. Astafiev,D. Knyazev,F. Hoehne,H. Im,Y. Nakamura,J. Tsai

2015-01-01

Abstract:All material supplied via Aaltodoc is protected by copyright and other intellectual property rights, and duplication or sale of all or part of any of the repository collections is not permitted, except that material may be duplicated by you for your research use or educational purposes in electronic or print form. You must obtain permission for any other use. Electronic or print copies may not be offered, whether for sale or otherwise to anyone who is not an authorised user.
Theory of the Trojan-Horse Method

S. Typel,G. Baur

DOI: https://doi.org/10.1016/S0003-4916%2803%2900060-5

2002-08-29

Abstract:The Trojan-Horse method is an indirect approach to determine the energy dependence of S-factors of astrophysically relevant two-body reactions. This is accomplished by studying closely related three-body reactions under quasi-free scattering conditions. The basic theory of the Trojan-Horse method is developed starting from a post-form distorted wave Born approximation of the T-matrix element. In the surface approximation the cross section of the three-body reaction can be related to the S-matrix elements of the two-body reaction. The essential feature of the Trojan-Horse method is the effective suppression of the Coulomb barrier at low energies for the astrophysical reaction leading to finite cross sections at the threshold of the two-body reaction. In a modified plane wave approximation the relation between the two-body and three-body cross sections becomes very transparent. The appearing Trojan-Horse integrals are studied in detail.

Nuclear Theory
An anti-trojans design approach based on activation probability analysis

xuwei ye,jianhua feng,haoran gong,chunhua he,weilei feng

DOI: https://doi.org/10.1109/edssc.2015.7285146

2015-01-01

Abstract:Hardware Trojan, realized by malicious modification of design characteristics, has emerged as a major security concern. The recently proposed Trojan detection methods arc mainly classified into two categories: side-channel signal analysis and logic testing. Due to the stealthy nature of Trojan circuits, it's difficult to activate Trojans to perform logic testing. In this paper, an activation probability-based approach is proposed. A probability obfuscation scan chain (POSC) is presented aiming at increasing the difficulty of Trojan insertion and increasing the activation probability of the Trojan circuits. It proves to be very effective in detecting the presence of a Trojan in a circuit. Experimental results on ISCAS benchmark circuits show that this approach can effectively increase Trojan activation probability and make the detection of the Trojan more easily.
Hardware Trojan detecting method based on circuit characteristic analysis

Yao Song,Chen Xiaoming,Wang Yu,Yang Huazhong

2015-01-01

Abstract:The invention provides a hardware Trojan detecting method based on circuit characteristic analysis. The hardware Trojan detecting method includes steps of inputting a detected circuit and acquiring a high-level modeling file of the detected circuit; identifying functional modules in the detected circuit according to the high-level modeling file of the circuit to be detected so as to judge reliability of the functional modules, and marking the detected circuit when the functional modules are reliable; extracting classification features from the marked detected circuit, matching each type of hardware Trojan characteristics in a preset hardware Trojan circuit characteristic database and outputting characteristic analysis results of classes according to the matching results; comprehensively analyzing the characteristic analysis results of classes so as to obtain reliability information of the detected circuit. By the hardware Trojan detecting method, hardware Trojan detecting speed is effectively increased as well as discrimination degree of the detecting area of different types of hardware Trojan, and detection effect of hardware Trojan in the time sequencing circuit is effectively improved.
Stealthy Trojan Detection Based on Feature Analysis of Circuit Structure

Jiatong Tan,Jianhua Feng,Yinxuan Lyu

DOI: https://doi.org/10.1109/edssc.2019.8754248

2019-01-01

Abstract:The design methods and the detection methods for Hardware Trojan develop rapidly. Existing trustiness verification methods are effective to obviously malicious HT but no effect on Stealthy Trojan. Stealthy Trojan is an advanced attack form and hard to be detected. In this paper, we analyze the characteristic of stealthy Trojan and propose a static detection method based on feature analysis. The results on ISCAS benchmarks show that the proposed method can detect the Stealthy Trojan node and is convenient to be implanted into other scalable verification framework.
TrojanZero: Switching Activity-Aware Design of Undetectable Hardware Trojans with Zero Power and Area Footprint

Imran Hafeez Abbassi,Faiq Khalid,Semeen Rehman,Awais Mehmood Kamboh,Axel Jantsch,Siddharth Garg,Muhammad Shafique

DOI: https://doi.org/10.48550/arXiv.1812.02770

2018-11-05

Abstract:Conventional Hardware Trojan (HT) detection techniques are based on the validation of integrated circuits to determine changes in their functionality, and on non-invasive side-channel analysis to identify the variations in their physical parameters. In particular, almost all the proposed side-channel power-based detection techniques presume that HTs are detectable because they only add gates to the original circuit with a noticeable increase in power consumption. This paper demonstrates how undetectable HTs can be realized with zero impact on the power and area footprint of the original circuit. Towards this, we propose a novel concept of TrojanZero and a systematic methodology for designing undetectable HTs in the circuits, which conceals their existence by gate-level modifications. The crux is to salvage the cost of the HT from the original circuit without being detected using standard testing techniques. Our methodology leverages the knowledge of transition probabilities of the circuit nodes to identify and safely remove expendable gates, and embeds malicious circuitry at the appropriate locations with zero power and area overheads when compared to the original circuit. We synthesize these designs and then embed in multiple ISCAS85 benchmarks using a 65nm technology library, and perform a comprehensive power and area characterization. Our experimental results demonstrate that the proposed TrojanZero designs are undetectable by the state-of-the-art power-based detection methods.

Cryptography and Security,Hardware Architecture
Experiences in Hardware Trojan design and implementation

Yier Jin,Nathan Kupp,Yiorgos Makris

DOI: https://doi.org/10.1109/hst.2009.5224971

2009-01-01

Abstract:We report our experiences in designing and implementing several hardware Trojans within the framework of the Embedded System Challenge competition that was held as part of the Cyber Security Awareness Week (CSAW) at the Polytechnic Institute of New York University in October 2008. Due to the globalization of the Integrated Circuit (IC) manufacturing industry, hardware Trojans constitute an increasingly probable threat to both commercial and military applications. With traditional testing methods falling short in the quest of finding hardware Trojans, several specialized detection methods have surfaced. To facilitate research in this area, a better understanding of what Hardware Trojans would look like and what impact they would incur to an IC is required. To this end, we present eight distinct attack techniques employing Register Transfer Level (RTL) hardware Trojans to compromise the security of an Alpha encryption module implemented on a Digilent BASYS Spartan-3 FPGA board. Our work, which earned second place in the aforementioned competition, demonstrates that current RTL designs are, indeed, quite vulnerable to hardware Trojan attacks.
On Trojan Side Channel Design and Identification.

Jie Zhang,Guantong Su,Yannan Liu,Lingxiao Wei,Feng Yuan,Guoqiang Bai,Qiang Xu

DOI: https://doi.org/10.1109/iccad.2014.7001363

2014-01-01

Abstract:Trojan side channels (TSCs) are serious threats to the security of cryptographic systems because they facilitate to leak secret keys to attackers via covert side channels that are unknown to designers. To tackle this problem, we present a new hardware Trojan detection technique for TSCs. To be specific, we first investigate general power-based TSC designs and discuss the tradeoff between their hardware cost and the complexity of the key cracking process. Next, we present our TSC identification technique based on the correlation between the key and the covert physical side channels used by attackers. Experimental results demonstrate the effectiveness of the proposed solution.
Side-Channel Hardware Trojan for Provably-Secure SCA-Protected Implementations

Samaneh Ghandali,Thorben Moos,Amir Moradi,Christof Paar

DOI: https://doi.org/10.48550/arXiv.1910.00737

2019-09-23

Abstract:Hardware Trojans have drawn the attention of academia, industry and government agencies. Effective detection mechanisms and countermeasures against such malicious designs can only be developed when there is a deep understanding of how hardware Trojans can be built in practice, in particular Trojans specifically designed to avoid detection. In this work, we present a mechanism to introduce an extremely stealthy hardware Trojan into cryptographic primitives equipped with provably-secure first-order side-channel countermeasures. Once the Trojan is triggered, the malicious design exhibits exploitable side-channel leakage, leading to successful key recovery attacks. Generally, such a Trojan requires neither addition nor removal of any logic which makes it extremely hard to detect. On ASICs, it can be inserted by subtle manipulations at the sub-transistor level and on FPGAs by changing the routing of particular signals, leading to \textbf{zero} logic overhead. The underlying concept is based on modifying a securely-masked hardware implementation in such a way that running the device at a particular clock frequency violates one of its essential properties, leading to exploitable leakage. We apply our technique to a Threshold Implementation of the PRESENT block cipher realized in two different CMOS technologies, and show that triggering the Trojan makes the ASIC prototypes vulnerable.

Cryptography and Security,Hardware Architecture
HeisenTrojans: They Are Not There Until They Are Triggered

Akshita Reddy Mavurapu,Haoqi Shan,Xiaolong Guo,Orlando Arias,Dean Sullivan

DOI: https://doi.org/10.1109/AsianHOST59942.2023.10409305

2023-12-21

Abstract:The hardware security community has made significant advances in detecting Hardware Trojan vulnerabilities using software fuzzing-inspired automated analysis. However, the Electronic Design Automation (EDA) code base itself remains under-examined by the same techniques. Our experiments in fuzzing EDA tools demonstrate that, indeed, they are prone to software bugs. As a consequence, this paper unveils HeisenTrojan attacks, a new hardware attack that does not generate harmful hardware, but rather, exploits software vulnerabilities in the EDA tools themselves. A key feature of HeisenTrojan attacks is that they are capable of deploying a malicious payload on the system hosting the EDA tools without triggering verification tools because HeisenTrojan attacks do not rely on superfluous or malicious hardware that would otherwise be noticeable. The aim of a HeisenTrojan attack is to execute arbitrary code on the system on which the vulnerable EDA tool is hosted, thereby establishing a permanent presence and providing a beachhead for intrusion into that system. Our analysis reveals 83% of the EDA tools analyzed have exploitable bugs. In what follows, we demonstrate an end- to-end attack and provide analysis on the existing capabilities of fuzzers to find HeisenTrojan attacks in order to emphasize their practicality and the need to secure EDA tools against them.

Cryptography and Security
Investigation of spurious resonances in thin film bulk acoustic wave resonators

S. Ballandras,A. Reinhardt,M. Solal,W. Steichen,V. Laude

DOI: https://doi.org/10.1109/ULTSYM.2004.1418151

2004-08-23

Abstract:A finite element analysis is performed to simulate thin film bulk acoustic wave (FBAR) structures, and a coupled finite element analysis/boundary integral method (FEA/BIM) is used to simulate accurately a radiation medium, like a Bragg mirror underneath a resonator, without having to mesh it entirely. Displacement fields are extracted from these calculations and analysed. In particular, dispersion curves are obtained by a Fourier analysis of these fields and are used to explain phenomena arising at electrode edges, like standing wave resonances under the electrodes or mode conversions.

Physics,Engineering
Analytical simulations of the resonant transmission of electrons in a closed nanocircuit for terahertz applications where a tunneling junction is shunted by a metallic nanowire

Mark Hagmann

2023-10-25

Abstract:Earlier, in the CINT program at Los Alamos National Laboratory, we focused ultrafast mode-locked lasers on the tip-sample junction of a scanning tunneling microscope to generate currents at hundreds of harmonics of the laser pulse repetition frequency. Each harmonic has a signal-to-noise ratio of 20 dB with a 10-dB linewidth of only 3 Hz. Now we model closed quantum nanocircuits with rectangular, triangular, or delta-function barrier, shunted by a beryllium filament for quasi-coherent electron transport over mean-free paths as great as 68 nm. The time-independent Schrödinger equation is solved with the boundary conditions that the wavefunction and its derivative are continuous at both connections. These four boundary conditions are used to form a four-by-four complex matrix equation with only zeros in the right-hand column vector which is required to have a non-trivial solution with each of the closed nanocircuits. Each model has four parameters: (1) the barrier length, (2) the height and shape of the barrier, (3) the length of the pre-barrier, and (4) the electron energy. Any three of these may be specified and then the fourth is varied to bring the determinant to zero to find the solutions on lines or surfaces in the space defined by the four parameters. First, we use a simplistic model having a rectangular barrier. The second model has a triangular barrier as a first approximation to field emission, and we are considering applying this approach for a self-contained nanoscale extension of our earlier effort to generate the harmonics at Los Alamos. The third model has a delta-function barrier, and the fourth model is an extension of the first one where the width of the rectangular barrier is varied inversely with its height.

Quantum Physics
Hardware Trojans Classification Based on Controllability and Observability in Gate-Level Netlist.

Xin Xie,Yangyang Sun,Hongda Chen,Yong Ding

DOI: https://doi.org/10.1587/elex.14.20170682

2017-01-01

IEICE Electronics Express

Abstract:This paper presents a hardware Trojan classification method that performs a static analysis in gate-level netlist. Based on the controllability and observability characteristics extracted in a circuit, the nets are clustered into two groups with the k-means method. Then inter-cluster distance is measured and taken as the major feature for Trojan identification. By combined with three other features in terms of circuit scale statistic number, a complementary representation of Trojan circuits is constructed. Finally, a support vector machine classifier is trained to distinguish the Trojan circuits from genuine circuits. Experimental results on Trust-HUB benchmarks demonstrate that our method can achieve up to 100% true positive rate.
Resonant tunneling in a schematic model

S. Bacca,H. Feldmeier

DOI: https://doi.org/10.1103/PhysRevC.73.054608

2006-02-24

Abstract:Tunneling of an harmonically bound two-body system through an external Gaussian barrier is studied in a schematic model which allows for a better understanding of intricate quantum phenomena. The role of finite size and internal structure is investigated in a consistent treatment. The excitation of internal degrees of freedom gives rise to a peaked structure in the penetration factor. The model results indicate that for soft systems the adiabatic limit is not necessarily reached although often assumed in fusion of nuclei and in electron screening effects at astrophysical energies.

Nuclear Theory
Exploiting Aharonov-Bohm oscillations to probe Klein tunneling in tunable pn-junctions in graphene

Jan Dauber,Koen J. A. Reijnders,Luca Banszerus,Alexander Epping,Kenji Watanabe,Takashi Taniguchi,Mikhail I. Katsnelson,Fabian Hassler,Christoph Stampfer

DOI: https://doi.org/10.48550/arXiv.2008.02556

2020-08-06

Mesoscale and Nanoscale Physics

Abstract:One of the unique features of graphene is that the Fermi wavelength of its charge carriers can be tuned electrostatically over a wide range. This allows in principle to tune the transparency of a pn-junction electrostatically, as this depends on the ratio between the physical extension of the junction and the electron wavelength, i.e. on the effective width of the junction itself. However, this simple idea - which would allow to switch smoothly between a Veselago lens and a Klein-collimator - has proved to be difficult to demonstrate experimentally because of the limited amount of independently-tunable parameters available in most setups. In this work, we present transport measurements in a quasi-ballistic Aharonov-Bohm graphene ring with gate tunable pn-junctions in one arm, and show that the interference patterns provide unambiguous information on the Klein tunneling efficiency and on the junctions effective width. We find a gate-controlled transparency of the pn-junctions ranging from 35-100%. Our results are in excellent agreement with a semiclassical description.
A Novel Detection Algorithm for Ring Oscillator Network Based Hardware Trojan Detection with Tactful FPGA Implementation.

Kaige Qu,Liji Wu,Xiangmin Zhang

DOI: https://doi.org/10.1109/CIS.2015.80

2015-01-01

Abstract:Hardware trojan detection is paid more and more attention in recent years due to the great potential threat imposed by hardware trojan to the whole integrated circuit industry. In this paper, ring oscillator network based hardware trojan detection method is tactfully implemented in FPGA and a novel corresponding detection algorithm is proposed. Incremental compilation technique is applied to design ring oscillator network and to insert trojans in FPGA. The method is verified effective for both sequential and combinational trojans. The trojans can be found with up to 20 to 200 times of detecting measurement based on their active status. Particularly, besides dynamic power consumption, extra static power consumed by trojan circuits are also used to differentiate trojan-free and trojan-inserted circuits.
Probing the graphene/substrate interaction by electron tunneling decay

Virginia Carnevali,Alessandro Sala,Pietro Biasin,Mirco Panighel,Giovanni Comelli,Maria Peressi,Cristina Africh

DOI: https://doi.org/10.1016/j.carbon.2023.118055

2023-04-28

Abstract:The electronic properties of graphene can be modified by the local interaction with a selected metal substrate. To probe this effect, Scanning Tunneling Microscopy is widely employed, particularly by means of local measurement via lock-in amplifier of the differential conductance and of the field emission resonance. In this article we propose an alternative, reliable method of probing the graphene/substrate interaction that is readily available to any STM apparatus. By testing the tunneling current as function of the tip/sample distance on nanostructured graphene on Ni(100), we demonstrate that I(z) spectroscopy can be quantitatively compared with Density Functional Theory calculations and can be used to assess the nature of the interaction between graphene and substrate. This method can expand the capabilities of standard STM systems to study graphene/substrate complexes, complementing standard topographic probing with spectroscopic information.

Mesoscale and Nanoscale Physics

Investigation of subthreshold resonances with the Trojan horse method

Trojan Awakener: Detecting Dormant Malicious Hardware Using Laser Logic State Imaging (Extended Version)

A Symbolic Approach to Detecting Hardware Trojans Triggered by Don't Care Transitions

The State-of-the-art in EDA tools: the Hardware Trojan Confrontation Framework

Title : Detection of Mechanical Resonance of a Single-Electron Transistor by Direct Current Year : 2010 Version : Final

Theory of the Trojan-Horse Method

An anti-trojans design approach based on activation probability analysis

Hardware Trojan detecting method based on circuit characteristic analysis

Stealthy Trojan Detection Based on Feature Analysis of Circuit Structure

TrojanZero: Switching Activity-Aware Design of Undetectable Hardware Trojans with Zero Power and Area Footprint

Experiences in Hardware Trojan design and implementation

On Trojan Side Channel Design and Identification.

Side-Channel Hardware Trojan for Provably-Secure SCA-Protected Implementations

HeisenTrojans: They Are Not There Until They Are Triggered

Investigation of spurious resonances in thin film bulk acoustic wave resonators

Analytical simulations of the resonant transmission of electrons in a closed nanocircuit for terahertz applications where a tunneling junction is shunted by a metallic nanowire

Hardware Trojans Classification Based on Controllability and Observability in Gate-Level Netlist.

Resonant tunneling in a schematic model

Exploiting Aharonov-Bohm oscillations to probe Klein tunneling in tunable pn-junctions in graphene

A Novel Detection Algorithm for Ring Oscillator Network Based Hardware Trojan Detection with Tactful FPGA Implementation.

Probing the graphene/substrate interaction by electron tunneling decay