Hardware Trojan detection has emerged as a critical challenge to ensure security and trustworthiness of integrated circuits. A vast majority of research efforts in this area has utilized side-channel analysis for Trojan detection. Functional test generation for logic testing is a promising alternative but it may not be helpful if a Trojan cannot be fully activated or the Trojan effect cannot be propagated to the observable outputs. Side-channel analysis, on the other hand, can achieve significantly higher detection coverage for Trojans of all types/sizes, since it does not require activation/propagation of an unknown Trojan. However, they have often limited effectiveness due to poor detection sensitivity under large process variations and small Trojan footprint in side-channel signature. In this paper, we address this critical problem through a novel side-channel-aware test generation approach, based on a concept of multiple excitation of rare switching (MERS), that can significantly increase Trojan detection sensitivity. This paper makes several important contributions: 1) it presents in detail a scalable statistical test generation method, which can generate high-quality test set for creating high relative activity in arbitrary Trojan instances; 2) it analyzes the effectiveness of generated test set in terms of Trojan coverage; and 3) it describes two judicious reordering methods that can further tune the test set and greatly improve the side channel sensitivity. Simulation results demonstrate that the tests generated by MERS can significantly increase the Trojans sensitivity, thereby making Trojan detection effective using side-channel analysis.

Scalable Test Generation for Trojan Detection Using Side Channel Analysis

Hardware Trojan detection has emerged as a critical challenge to ensure security and trustworthiness of integrated circuits. A vast majority of research efforts in this area has utilized side-channel analysis for Trojan detection. Functional test generation for logic testing is a promising alternative but it may not be helpful if a Trojan cannot be fully activated or the Trojan effect cannot be propagated to the observable outputs. Side-channel analysis, on the other hand, can achieve significantly higher detection coverage for Trojans of all types/sizes, since it does not require activation/propagation of an unknown Trojan. However, they have often limited effectiveness due to poor detection sensitivity under large process variations and small Trojan footprint in side-channel signature. In this paper, we address this critical problem through a novel side-channel-aware test generation approach, based on a concept of Multiple Excitation of Rare Switching (MERS), that can significantly increase Trojan detection sensitivity. The paper makes several important contributions: i) it presents in detail the statistical test generation method, which can generate high-quality testset for creating high relative activity in arbitrary Trojan instances; ii) it analyzes the effectiveness of generated testset in terms of Trojan coverage; and iii) it describes two judicious reordering methods can further tune the testset and greatly improve the side channel sensitivity. Simulation results demonstrate that the tests generated by MERS can significantly increase the Trojans sensitivity, thereby making Trojan detection effective using side-channel analysis.

https://dl.acm.org/doi/pdf/10.1145/2976749.2978396

MERS: Statistical Test Generation for Side-Channel Analysis based Trojan Detection

The threat of hardware Trojans' existence in inte-gratedcircuits has become a major concern in System-on-Chip (SoC) design industry as well as in military/defense organizations. There is an increased emphasis on finding effective ways to detect and activate hardware Trojans in current research efforts. However, state-of-the-art approaches suffer from the lack of completeness and scalability. Moreover, most of the existing methods cannot generate efficient tests to activate the potential hidden Trojan. In this paper, we propose an effective test generation approach which is capable of activating malicious functionality hidden in large sequential designs. Automatic test pattern generation (ATPG) works well on full-scan designs, whereas model checking is suitable for logic blocks without scan chain. Due to overhead considerations, partial-scan chain insertion is the standard practice today. Unfortunately, neither ATPG nor model checking is suitable for partial-scan designs. Our proposed hardware Trojan detection technique utilizes the combination of ATPG and model checking approaches. We use model checking on a subset of non-scan elements and ATPG on scan elements to avoid common pitfalls of running the original design using any one of these techniques. Experimental results demonstrate the effectiveness of tests generated by our proposed approach to detect Trojans on Trust-hub benchmarks.

Hardware Trojan Detection Using ATPG and Model Checking

Growing reliance on reusable hardware Intellectual Property (IP) blocks, severely affects the security and trustworthiness of System-on-Chips (SoCs) since untrusted third-party vendors may deliberately insert malicious components to incorporate undesired functionality. Malicious implants may also work as hidden backdoor and leak protected information. In this paper, we propose an automated approach to identify untrustworthy IPs and localize malicious functional modifications (if any). The technique is based on extracting polynomials from gate-level implementation of the untrustworthy IP and comparing them with specification polynomials. The proposed approach is applicable when the specification is available. Our approach is scalable due to manipulation of polynomials instead of BDD-based analysis used in traditional equivalence checking techniques. Experimental results using Trust-HUB benchmarks demonstrate that our approach improves both localization and test generation efficiency by several orders of magnitude compared to the state-of-the-art Trojan detection techniques.

Trojan localization using symbolic algebra

Detection of hardware Trojans is vital to ensure the security and trustworthiness of System-on-Chip (SoC) designs. Side-channel analysis is effective for Trojan detection by analyzing various side-channel signatures such as power, current and delay. In this paper, we propose an efficient test generation technique to facilitate side-channel analysis utilizing dynamic current. While early work on current-aware test generation has proposed several promising ideas, there are two major challenges in applying it on large designs: (i) the test generation time grows exponentially with the design complexity, and (ii) it is infeasible to detect Trojans since the side-channel sensitivity is marginal compared to the noise and process variations. Our proposed work addresses both challenges by effectively exploiting the affinity between the inputs and rare (suspicious) nodes. We formalize the test generation problem as a searching problem and solve the optimization using genetic algorithm. The basic idea is to quickly find the profitable test patterns that can maximize switching in the suspicious regions while minimize switching in the rest of the circuit. Our experimental results demonstrate that we can drastically improve both the side-channel sensitivity (30x on average) and time complexity (4.6x on average) compared to the state-of-the-art test generation techniques.

Efficient Test Generation for Trojan Detection using Side Channel Analysis

Test generation for Hardware Trojan Horses (HTH) detection is extremely challenging, as Trojans are designed to be triggered by very rare logic conditions at internal nodes of the circuit. In this paper, we propose a Genetic Algorithm (GA) based Automatic Test Pattern Generation (ATPG) technique, enhanced by automated solution to an associated Boolean Satisfiability problem. The main insight is that given a specific internal trigger condition, it is not possible to attack an arbitrary node (payload) of the circuit, as the effect of the induced logic malfunction by the HTH might not get propagated to the output. Based on this observation, a fault simulation based framework has been proposed, which enumerates the feasible payload nodes for a specific triggering condition. Subsequently, a compact set of test vectors is selected based on their ability to detect the logic malfunction at the feasible payload nodes, thus increasing their effectiveness. Test vectors generated by the proposed scheme were found to achieve higher detection coverage over large population of HTH in ISCAS benchmark circuits, compared to a previously proposed logic testing based Trojan detection technique.

/pdf/improved-test-pattern-generation-for-hardware-trojan-roulkhej7g.pdf

Improved Test Pattern Generation for Hardware Trojan Detection Using Genetic Algorithm and Boolean Satisfiability

The IEEE 1687 Standard specifies an access network and a description language for embedded instruments. In this paper, we present an optimization technique to minimize the segment insertion bit (SIB) programming overhead for IEEE 1687-compliant access architectures. We first present an optimal solution based on dynamic programming for concurrent access schedules. This technique is then utilized to minimize the SIB programming overhead for more general hybrid access schedules. The proposed optimization technique is computationally efficient and it leads to significant reductions (as large as 97%) in the SIB programming overhead for hybrid access schedules.

Optimization of the IEEE 1687 access network for hybrid access schedules

Diagnosis is extremely important to ramp up the yield during the integrated circuit manufacturing process. It reduces the time to market and product cost. High-volume diagnosis has become crucial for yield learning. The backbone of any diagnosis algorithm is the test set in use. Application of test sets for high-volume testing is typically done in test data compression environment to reduce the test time and also the amount of data stored on the tester. For high-volume diagnosis, it is essential to use test sets having high diagnostic power in compression environment. In this work, a novel method has been proposed which combines test data compression and diagnostic power improvement algorithms. Selective Huffman coding is used as the basic test data compression scheme. To improve diagnostic power of a test set we make use of filling algorithms designed to increase the diagnostic ability of the test set.

An Integrated Approach for Improving Compression and Diagnostic Properties of Test Sets

Diagnosis is extremely important to ramp up the yield during the integrated circuit manufacturing process. It reduces the time to market and product cost. The back bone of any diagnosis algorithm is the test set in use. In this paper, a novel method has been proposed to increase the diagnosability of a given test set. The proposed method, which takes as input a test set generated for high fault coverage, is capable of increasing the diagnostic power of the test set without affecting its fault coverage. It is able to achieve this with either no or small increase in number of patterns. The crux of the method lies in introducing test patterns having ‘X’ bits into the test set without changing its coverage, and using a ‘X’ bit filling algorithm to maximize its diagnostic power.

Test set customization for improved fault diagnosis without sacrificing coverage

We present a novel approach to pre-silicon verification of processor designs. The purpose of pre-silicon verification is to find logic bugs in a design at an early stage and thus avoid time- and cost-intensive post-silicon debugging. Our approach relies on symbolic quick error detection (Symbolic QED, or SQED). SQED is targeted at finding logic bugs in a symbolic representation of a design by combining bounded model checking (BMC) with QED tests. QED tests are powerful in generating short sequences of instructions (traces) that trigger bugs. We extend an existing SQED approach with symbolic starting states. This way, we enable the BMC tool to select starting states arbitrarily when generating a trace. To avoid false positives, (e.g., traces starting in unreachable states that may not be-have in accordance with the processor instruction-set architecture), we define constraints to restrict the set of possible starting states. We demonstrate that these constraints, togeth-er with reasonable assumptions about the system behavior, allow us to avoid false positives. Using our approach, we discovered previously unknown bugs in open-source RISC-V processor cores that existing methods cannot detect. Moreover, our novel approach out-performs existing ones in the detection of bugs having long traces and in the detection of hardware Trojans, i.e., unauthorized modifications of a design.

Srinivasa Shashank Nuthakki

Papers

Improved Test Pattern Generation for Hardware Trojan Detection Using Genetic Algorithm and Boolean Satisfiability

Optimization of the IEEE 1687 access network for hybrid access schedules

An Integrated Approach for Improving Compression and Diagnostic Properties of Test Sets

Test set customization for improved fault diagnosis without sacrificing coverage

Effective Pre-Silicon Verification of Processor Cores by Breaking the Bounds of Symbolic Quick Error Detection.