Mayukhmali Das, Sounak Dutta, Sayan Chatterjee
In this paper, we will demonstrate Hardware Trojan Attacks on four different digital designs implemented on FPGA. The hardware trojan is activated based on special logical and reduction-based operations on vectors which makes the trojan-activity as silent and effective as possible. In this paper, we have introduced 5 novel trojan attack methodologies.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
继续探索
Hardware Trojans have drawn the attention of academia, industry and government agencies. Effective detection mechanisms and countermeasures against such malicious designs can only be developed when there is a deep understanding of how hardware Trojans can be built in practice, in particular Trojans specifically designed to avoid detection. In this work, we present a mechanism to introduce an extremely stealthy hardware Trojan into cryptographic primitives equipped with provably-secure first-order side-channel countermeasures. Once the Trojan is triggered, the malicious design exhibits exploita…
True random number generators (TRNGs) are essential components of cryptographic designs, which are used to generate private keys for encryption and authentication, and are used in masking countermeasures. In this work, we present a mechanism to design a stealthy parametric hardware Trojan for a ring oscillator based TRNG architecture proposed by Yang et al. at ISSCC 2014. Once the Trojan is triggered the malicious TRNG generates predictable non-random outputs. Such a Trojan does not require any additional logic (even a single gate) and is purely based on subtle manipulations on the sub-transis…
As industry moves toward chiplet-based designs, the insertion of hardware Trojans poses a significant threat to the security of these systems. These systems rely heavily on cache coherence for coherent data communication, making coherence an attractive target. Critically, unlike prior work, which focuses only on malicious packet modifications, a Trojan attack that exploits coherence can modify data in memory that was never touched and is not owned by the chiplet which contains the Trojan. Further, the Trojan need not even be physically between the victim and the memory controller to attack the…
Hardware Trojan detection and protection is becoming more crucial as more untrusted third parties manufacture many parts of critical systems nowadays. The most common way to detect hardware Trojans is comparing the untrusted design with a golden (trusted) one. However, third-party intellectual properties (IPs) are black boxes with no golden IPs to trust. So, previous attempts to detect hardware Trojans will not work with third-party IPs. In this work, we present novel methods for Trojan protection and detection on field programmable gate arrays (FPGAs) without the need for golden chips. Presen…
The commercial off-the-shelf (COTS) component based ecosystem provides an attractive system design paradigm due to the drastic reduction in development time and cost compared to custom solutions. However, it brings in a growing concern of trustworthiness arising from the possibility of embedded malicious logic, or hardware Trojans in COTS components. Existing trust-verification approaches are typically not applicable to COTS hardware due to the absence of golden models and the lack of observability of internal signals. In this work, we propose a novel approach for runtime Trojan detection and …
A Survey Report on Hardware Trojan Detection by Multiple-Parameter Side-Channel Analysis
本综述报告系统梳理了硬件木马检测中的侧信道分析方法，重点阐述多参数侧信道分析技术相较单参数分析和传统逻辑测试的优势，并探讨其与逻辑测试结合以提升不同规模和类型木马检测覆盖率的前景。
Cyber-physical systems (CPS) provide profitable surfaces for hardware attacks such as hardware Trojans. Hardware Trojans can implement stealthy attacks such as leaking critical information, taking control of devices or harm humans. In this article we review information flow tracking (IFT) methods for protecting CPS against hardware Trojans, and discuss their current limitations. IFT methods are a promising approach for the detection of hardware Trojans in complex systems because the detection mechanism does not necessarily rely on potential Trojan behavior. However, in order to maximize the be…
TroLL: Exploiting Structural Similarities between Logic Locking and Hardware Trojans
本文揭示逻辑锁定与硬件木马之间的结构相似性，提出可规避现有ATPG检测的新型木马TroLL，并通过定制ATPG与SAT方法评估检测效果，指出需要可扩展的检测方案。
We propose TrojanSAINT, a graph neural network (GNN)-based hardware Trojan (HT) detection scheme working at the gate level. Unlike prior GNN-based art, TrojanSAINT enables both pre-/post-silicon HT detection. TrojanSAINT leverages a sampling-based GNN framework to detect and also localize HTs. For practical validation, TrojanSAINT achieves on average (oa) 78% true positive rate (TPR) and 85% true negative rate (TNR), respectively, on various TrustHub HT benchmarks. For best-case validation, TrojanSAINT even achieves 98% TPR and 96% TNR oa. TrojanSAINT outperforms related prior works and baseli…
Conventional Hardware Trojan (HT) detection techniques are based on the validation of integrated circuits to determine changes in their functionality, and on non-invasive side-channel analysis to identify the variations in their physical parameters. In particular, almost all the proposed side-channel power-based detection techniques presume that HTs are detectable because they only add gates to the original circuit with a noticeable increase in power consumption. This paper demonstrates how undetectable HTs can be realized with zero impact on the power and area footprint of the original circui…
There are increasing concerns about possible malicious modifications of integrated circuits (ICs) used in critical applications. Such attacks are often referred to as hardware Trojans. While many techniques focus on hardware Trojan detection during IC testing, it is still possible for attacks to go undetected. Using a combination of new design techniques and new memory technologies, we present a new approach that detects a wide variety of hardware Trojans during IC testing and also during system operation in the field. Our approach can also prevent a wide variety of attacks during synthesis, p…
Trojan Playground: A Reinforcement Learning Framework for Hardware Trojan Insertion and Detection
本文提出首个自动化的强化学习硬件木马插入与检测框架，通过RL代理探索电路实现隐蔽木马插入并设计多准则检测器，在ISCAS-85基准上验证有效性，突破现有基准的设计偏见与单一维度局限。
Assessing Runtime Electromagnetic Detection of CPU Hardware Trojans Targeting Kernel Memory
本研究利用电磁辐射对RISC-V Linux系统上的硬件木马进行运行时检测，通过开源木马篡改内核内存，发现异常软件行为可间接揭示木马存在。
In this paper, we introduce a Learning Assisted Side Channel delay Analysis (LASCA) methodology for Hardware Trojan detection. Our proposed solution, unlike the prior art, does not require a Golden IC. Instead, it trains a Neural Network to act as a process tracking watchdog for correlating the static timing data (produced at design time) to the delay information obtained from clock frequency sweeping (at test time) for the purpose of Trojan detection. Using the LASCA flow, we detect close to 90% of Hardware Trojans in the simulated scenarios.
High-level synthesis (HLS) is the next emerging trend for designing complex customized architectures for applications such as Machine Learning, Video Processing. It provides a higher level of abstraction and freedom to hardware engineers to perform hardware software co-design. However, it opens up a new gateway to attackers to insert hardware trojans. Such trojans are semantically more meaningful and stealthy, compared to gate-level trojans and therefore are hard-to-detect using state-of-the-art gate-level trojan detection techniques. Although recent works have proposed detection mechanisms to…
An AI Architecture with the Capability to Classify and Explain Hardware Trojans
本文提出一种可解释的AI架构，在现有ML硬件木马检测特征基础上，利用trust-hub基准实现对网表中数字硬件木马的分类与决策解释。
Trojan-Resilient NTT: Protecting Against Control Flow and Timing Faults on Reconfigurable Platforms
本文提出一种安全的 NTT 架构，能够检测异常延迟、控制流中断和 SASCA，并提供自适应故障修正方法，通过在 Artix-7 FPGA 上的不同 Kyber 变体进行模拟和实现，证明其高效检测和纠正故障的能力，同时仅引入适度的面积和时间开销。
The implementation of cryptographic primitives in integrated circuits (ICs) continues to increase over the years due to the recent advancement of semiconductor manufacturing and reduction of cost per transistors. The hardware implementation makes cryptographic operations faster and more energy-efficient. However, various hardware attacks have been proposed aiming to extract the secret key in order to undermine the security of these primitives. In this paper, we focus on the widely used advanced encryption standard (AES) block cipher and demonstrate its vulnerability against tampering attack. O…
Early Detection of Hardware Trojans Using Neural Controlled Differential Equations and Analysis of Power Traces
针对硬件木马检测难题，提出用神经控制微分方程和功耗轨迹分析的新方法，利用NCDE模型学习正常功耗行为，结合LDA分类器区分不同情况，实验表明该方法准确率高，能处理休眠木马，在标准基准上验证了其性能。
TroPUF: Evaluating Hardware Trojan Insertion in Delay-Based Physical Unclonable Functions
研究基于延迟的物理不可克隆函数中硬件木马插入问题，提出统一模拟框架并行评估功能指标、硬件开销和建模抗性，揭示当前PUF安全假设差距，强调需将PUF与硬件木马作为耦合安全问题评估。
Due to the current horizontal business model that promotes increasing reliance on untrusted third-party Intellectual Properties (IPs), CAD tools, and design facilities, hardware Trojan attacks have become a serious threat to the semiconductor industry. Development of effective countermeasures against hardware Trojan attacks requires: (1) fast and reliable exploration of the viable Trojan attack space for a given design and (2) a suite of high-quality Trojan-inserted benchmarks that meet specific standards. The latter has become essential for the development and evaluation of design/verificatio…
The threat of hardware Trojans (HTs) and their detection is a widely studied field. While the effort for inserting a Trojan into an application-specific integrated circuit (ASIC) can be considered relatively high, especially when trusting the chip manufacturer, programmable hardware is vulnerable to Trojan insertion even after the product has been shipped or during usage. At the same time, detecting dormant HTs with small or zero-overhead triggers and payloads on these platforms is still a challenging task, as the Trojan might not get activated during the chip verification using logical testin…
Semiconductor design houses are increasingly becoming dependent on third party vendors to procure intellectual property (IP) and meet time-to-market constraints. However, these third party IPs cannot be trusted as hardware Trojans can be maliciously inserted into them by untrusted vendors. While different approaches have been proposed to detect Trojans in third party IPs, their limitations have not been extensively studied. In this paper, we analyze the limitations of the state-of-the-art Trojan detection techniques and demonstrate with experimental results how to defeat these detection mechan…
The globalization of the Integrated Circuit (IC) supply chain has moved most of the design, fabrication, and testing process from a single trusted entity to various untrusted third-party entities around the world. The risk of using untrusted third-Party Intellectual Property (3PIP) is the possibility for adversaries to insert malicious modifications known as Hardware Trojans (HTs). These HTs can compromise the integrity, deteriorate the performance, and deny the functionality of the intended design. Various HT detection methods have been proposed in the literature; however, many fall short due…
This paper reports a novel approach that uses transistor aging in an integrated circuit (IC) to detect hardware Trojans. When a transistor is aged, it results in delays along several paths of the IC. This increase in delay results in timing violations that reveal as timing errors at the output of the IC during its operation. We present experiments using aging-aware standard cell libraries to illustrate the usefulness of the technique in detecting hardware Trojans. Combining IC aging with over-clocking produces a pattern of bit errors at the IC output by the induced timing violations. We use ma…
Hardware security has risen in prominence in recent years with concerns stemming from a globalizing semiconductor supply chain and increased third-party IP (intellectual property) usage. Trojan detection is of paramount importance for ensuring systems with confidentiality, integrity, and availability. Existing methods for hardware Trojan detection in FPGA (field programmable gate array) devices include test-time methods, pre-implementation methods, and run-time methods. The first two methods provide effective ways of detecting some Trojans; however, Trojans may be specifically designed to avoi…
PATCH-FFT: Unmasking Dormant Hardware Trojans with Patch-Based Frequency-Domain Transformers
研究如何检测集成电路中潜伏的硬件木马，提出基于补丁的变压器架构，利用频域分析电源迹线，使用rFFT转换测量，实验显示该方法平均检测准确率达90.94%，优于现有方法，能检测休眠木马。
The threat of hardware Trojans has been widely recognized by academia, industry, and government agencies. A Trojan can compromise security of a system in spite of cryptographic protection. The damage caused by a Trojan may not be limited to a business or reputation, but could have a severe impact on public safety, national economy, or national security. An extremely stealthy way of implementing hardware Trojans has been presented by Becker et al. at CHES'2012. Their work have shown that it is possible to inject a Trojan in a random number generator compliant with FIPS 140-2 and NIST SP800-90 s…
Cross-Scale Persistence Analysis of EM Side-Channels for Reference-Free Detection of Always-On Hardware Trojans
本文提出基于电磁侧信道跨尺度持久性分析的无参考检测框架，用于识别始终开启的硬件木马。通过分析多时间频分辨率下的电磁发射，构建稳定性图，利用GMM和BIC进行统计结构建模，并引入跨尺度饱和度、变异性及中位数混合复杂度等指标，揭示木马的持久性特征。
Exploiting Logic Locking for a Neural Trojan Attack on Machine Learning Accelerators
本文提出利用逻辑锁定中错误密钥产生的确定性错误，在被保护的神经加速器中自动构造神经木马后门，并在基准加速器上实现触发输入准确率下降74%而其他输入仅下降1.7%的攻击效果。
Due to cost benefits, supply chains of integrated circuits (ICs) are largely outsourced nowadays. However, passing ICs through various third-party providers gives rise to many threats, like piracy of IC intellectual property or insertion of hardware Trojans, i.e., malicious circuit modifications. In this work, we proactively and systematically harden the physical layouts of ICs against post-design insertion of Trojans. Toward that end, we propose a multiplexer-based logic-locking scheme that is (i) devised for layout-level Trojan prevention, (ii) resilient against state-of-the-art, oracle-less…
Globalization in the semiconductor industry enables fabless design houses to reduce their costs, save time, and make use of newer technologies. However, the offshoring of Integrated Circuit (IC) fabrication has negative sides, including threats such as Hardware Trojans (HTs) - a type of malicious logic that is not trivial to detect. One aspect of IC design that is not affected by globalization is the need for thorough verification. Verification engineers devise complex assets to make sure designs are bug-free, including assertions. This knowledge is typically not reused once verification is ov…
Reference-Free Spectral Analysis of EM Side-Channels for Always-on Hardware Trojan Detection
本文提出了一种无需参考的电磁侧信道分析方法，结合时频分析与高斯混合模型，用于检测始终开启的硬件木马，通过STFT分析展示木马的持久足迹特征。
SCARF: Securing Chips with a Robust Framework against Fabrication-time Hardware Trojans
本文提出SCARF框架，通过将验证断言转化为安全检查器并在物理综合阶段集成在线监视器，从前端到后端全面增强IC抵御硬件木马的安全性，在面积和功耗增加低于20%的情况下将安全指标提升达33.5%。
Towards Practical Fabrication Stage Attacks Using Interrupt-Resilient Hardware Trojans
本文提出中断弹性硬件木马（IRT），通过解决CPU非确定性上下文切换导致的触发竞态问题，在28nm RISC-V微架构上以仅20皮秒的平均延迟开销实现高可靠性的制造阶段攻击，并开源设计以推动微处理器木马研究。
TrojanGYM: A Detector-in-the-Loop LLM for Adaptive RTL Hardware Trojan Insertion
提出TrojanGYM框架，利用大语言模型智能体自动生成多样化的硬件木马，暴露基于GNN的检测器盲点，并设计鲁棒检测器Robust-GNN4TJ，在生成的基准上将检测率从0%提升至60%。
Risk-Aware and Explainable Framework for Ensuring Guaranteed Coverage in Evolving Hardware Trojan Detection
本文针对演化型硬件木马检测中误分类风险高、模型可信度难以评估的问题，提出基于共形化生成对抗网络和Mondrian共形预测器的算法无关框架，在提供集合预测与不确定性量化的同时支持校准可解释的拒绝决策，并在合成与真实芯片基准上验证了有效性。
TrojanForge: Generating Adversarial Hardware Trojan Examples Using Reinforcement Learning
针对传统硬件木马基准缺陷与人工设计偏差问题，研究提出基于强化学习的工具TrojanForge，通过插入-检测循环与检测器交互生成对抗样本，实现高攻击成功率，为硬件木马防御提供新认知。
Deep learning architectures (DLA) have shown impressive performance in computer vision, natural language processing and so on. Many DLA make use of cloud computing to achieve classification due to the high computation and memory requirements. Privacy and latency concerns resulting from cloud computing has inspired the deployment of DLA on embedded hardware accelerators. To achieve short time-to-market and have access to global experts, state-of-the-art techniques of DLA deployment on hardware accelerators are outsourced to untrusted third parties. This outsourcing raises security concerns as h…
This paper utilizes Reinforcement Learning (RL) as a means to automate the Hardware Trojan (HT) insertion process to eliminate the inherent human biases that limit the development of robust HT detection methods. An RL agent explores the design space and finds circuit locations that are best for keeping inserted HTs hidden. To achieve this, a digital circuit is converted to an environment in which an RL agent inserts HTs such that the cumulative reward is maximized. Our toolset can insert combinational HTs into the ISCAS-85 benchmark suite with variations in HT size and triggering conditions. E…
Hardware Trojans from Invisible Inversions: On the Trojanizability of Standard Cell Libraries
本文通过分析S&P 2023数据集，提出新指标评估标准单元库对硬件木马的潜在敏感性，并利用视觉不可区分的单元构建隐蔽木马，在Ibex RISC-V内核中实现权限提升后门。
The threat of inserting hardware Trojans during the design, production, or in-field poses a danger for integrated circuits in real-world applications. A particular critical case of hardware Trojans is the malicious manipulation of third-party FPGA configurations. In addition to attack vectors during the design process, FPGAs can be infiltrated in a non-invasive manner after shipment through alterations of the bitstream. First, we present an improved methodology for bitstream file format reversing. Second, we introduce a novel idea for Trojan insertion.
Many fabless semiconductor companies outsource their designs to third-party fabrication houses. As trustworthiness of chain after outsourcing including fabrication houses is not established, any adversary in between, with malicious intent may tamper the design by inserting Hardware Trojans (HTs). Detection of such HTs is of utmost importance to assure the trust and integrity of the chips. However, the efficiency of detection techniques based on side-channel analysis is largely affected by process variations. In this paper, a methodology for detecting HTs by analyzing the delays of topologicall…
ADVERSARIAL: And-Inverter Graph-Assisted Hardware Trojan Detection At Scale
针对现代大规模SoC中硬件木马检测难题，提出基于与非门图的符号化学习方法，通过知识图谱嵌入框架表示连接，解决可扩展性瓶颈，能区分正常与潜在木马连接，实验验证了该方法在大规模SoC基准测试中的有效性和可扩展性。
An Automated Framework for Generating Stealthy Cell-Embedded Hardware Trojans
研究硬件木马威胁，提出用受损标准单元实现自动生成嵌入式硬件木马的框架，通过分析设计、识别候选单元并应用有效载荷模板来生成实例，实验表明该框架有效，凸显当前检测假设差距及单元感知验证需求。
LIB-TRAP: Standard Cell Library Hardware Trojan Risk Assessment and Prevention
提出标准单元库被篡改的新型威胁模型，通过将恶意库应用于基准设计，评估木马插入的隐蔽性和有效性。
Recently, Haider et al. introduced the first rigorous hardware Trojan detection algorithm called HaTCh. The foundation of HaTCh is a formal framework of hardware Trojan design, which formally characterizes all the hardware Trojans based on its properties. However, Bhardwaj et al. recently published one paper "Defeating HaTCh: Building Malicious IP Cores", which incorrectly claims that their newly designed hardware Trojan can evade the detection by HaTCh. In this paper, we explain why the claim of "defeating HaTCh" is incorrect, and we clarify several common misunderstandings about HaTCh.
Exploiting Software-level Abstractions To Support Practical Hardware Trojan Attacks
提出SURF类CPU木马，无需任意代码执行即可通过高级语言整数运算的微架构副作用激活，在RISC-V处理器和V8引擎中验证了代码注入攻击，并开源设计。
Hardware Trojans (HTs) have become a serious problem, and extermination of them is strongly required for enhancing the security and safety of integrated circuits. An effective solution is to identify HTs at the gate level via machine learning techniques. However, machine learning has specific vulnerabilities, such as adversarial examples. In reality, it has been reported that adversarial modified HTs greatly degrade the performance of a machine learning-based HT detection method. Therefore, we propose a robust HT detection method using adversarial training (R-HTDetector). We formally describe …
Propelling Innovation to Defeat Data-Leakage Hardware Trojans: From Theory to Practice
本文提出并实践了RECORD方案，通过组合逻辑临时随机化编码与Quilt Packaging技术，阻止硬件木马建立数据泄露侧信道，从而抵御不可信制造设施中的逆向工程攻击。
Uncertainty-Aware Hardware Trojan Detection Using Multimodal Deep Learning
本文针对硬件木马检测中受感染基准数据有限的问题，提出结合生成对抗网络数据扩充与多模态深度学习的方法，并引入不确定性量化以支持风险感知决策。
Design for Assurance: Employing Functional Verification Tools for Thwarting Hardware Trojan Threat in 3PIPs
本研究针对第三方知识产权核中硬件木马难检测的问题，提出利用功能验证工具、以查找表为粒度分析并形式化验证来定位木马，再通过重配置恶意查找表实现防护，可有效检测缓解Trust-Hub及最新无关项木马。
Robust hardware Trojan detection leveraging dual-domain features and stacked ensemble learning
研究硬件木马检测问题，核心方法是结合时域和频域特征，评估六种人工智能模型并通过堆叠集成分类器集成，主要贡献是提出的框架能准确鲁棒检测硬件木马，无需可信参考IC，宏平均ROC-AUC达0.987。
Multi-criteria Hardware Trojan Detection: A Reinforcement Learning Approach
针对现有硬件木马检测多依赖单一准则的局限，提出一种带可调奖励函数的多准则强化学习检测工具，可适配多场景，还给出公平比较方法，在ISCAS-85基准上检测成功率达84.2%。
Detecting Hardware Trojans in Microprocessors via Hardware Error Correction Code-based Modules
针对可被软件利用的硬件木马（HTs）注入恶意指令破坏执行流的问题，提出基于汉明单纠错（HSEC）架构的硬件安全检查器（HSC），在RISC-V微处理器上实现100%检测率且开销极小。
Digital Manufacturing (DM) refers to the on-going adoption of smarter, more agile manufacturing processes and cyber-physical systems. This includes modern techniques and technologies such as Additive Manufacturing (AM)/3D printing, as well as the Industrial Internet of Things (IIoT) and the broader trend toward Industry 4.0. However, this adoption is not without risks: with a growing complexity and connectivity, so too grows the cyber-physical attack surface. Here, malicious actors might seek to steal sensitive information or sabotage products or production lines, causing financial and reputat…
With the rising popularity of machine learning and the ever increasing demand for computational power, there is a growing need for hardware optimized implementations of neural networks and other machine learning models. As the technology evolves, it is also plausible that machine learning or artificial intelligence will soon become consumer electronic products and military equipment, in the form of well-trained models. Unfortunately, the modern fabless business model of manufacturing hardware, while economic, leads to deficiencies in security through the supply chain. In this paper, we illumin…
System-on-chip (SoC) developers increasingly rely on pre-verified hardware intellectual property (IP) blocks acquired from untrusted third-party vendors. These IPs might contain hidden malicious functionalities or hardware Trojans to compromise the security of the fabricated SoCs. Recently, supervised machine learning (ML) techniques have shown promising capability in identifying nets of potential Trojans in third party IPs (3PIPs). However, they bring several major challenges. First, they do not guide us to an optimal choice of features that reliably covers diverse classes of Trojans. Second,…
TroLLoc: Logic Locking and Layout Hardening for IC Security Closure against Hardware Trojans
提出 TroLLoc，将逻辑锁定与版图加固集成于商用 IC 设计流程，以低开销抵御木马植入及绕过锁定的二阶攻击。
Fabrication-less design houses outsource their designs to 3rd party foundries to lower fabrication cost. However, this creates opportunities for a rogue in the foundry to introduce hardware Trojans, which stay inactive most of the time and cause unintended consequences to the system when triggered. Hardware Trojans in traditional CMOS-based circuits have been studied and Design-for-Trust (DFT) techniques have been proposed to detect them. Different from traditional circuits in many ways, reversible circuits implement one-to-one, bijective input/output mappings. We will investigate the security…
扫码添加微信好友，提出您的宝贵建议 👇
💡 备注请填写：网站反馈
发表机构由 AI 从论文文本抽取，如发现错误，欢迎反馈修正建议。