Showing papers on "Hardware Trojan published in 2021"

Automated Test Generation for Hardware Trojan Detection using Reinforcement Learning

Abstract: Due to globalized semiconductor supply chain, there is an increasing risk of exposing System-on-Chip (SoC) designs to malicious implants, popularly known as hardware Trojans. Unfortunately, traditional simulation-based validation using millions of test vectors is unsuitable for detecting stealthy Trojans with extremely rare trigger conditions due to exponential input space complexity of modern SoCs. There is a critical need to develop efficient Trojan detection techniques to ensure trustworthy SoCs. While there are promising test generation approaches, they have serious limitations in terms of scalability and detection accuracy. In this paper, we propose a novel logic testing approach for Trojan detection using an effective combination of testability analysis and reinforcement learning. Specifically, this paper makes three important contributions. 1) Unlike existing approaches, we utilize both controllability and observability analysis along with rareness of signals to significantly improve the trigger coverage. 2) Utilization of reinforcement learning considerably reduces the test generation time without sacrificing the test quality. 3) Experimental results demonstrate that our approach can drastically improve both trigger coverage (14.5% on average) and test generation time (6.5 times on average) compared to state-of-the-art techniques.

Hardware Trust and Assurance through Reverse Engineering: A Tutorial and Outlook from Image Analysis and Machine Learning Perspectives

Abstract: In the context of hardware trust and assurance, reverse engineering has been often considered as an illegal action. Generally speaking, reverse engineering aims to retrieve information from a produ...

GNN4TJ: Graph Neural Networks for Hardware Trojan Detection at Register Transfer Level

Abstract: The time to market pressure and resource constraints has pushed System-on-Chip (SoC) designers toward outsourcing the design and using third-party Intellectual Property (IP). It has created an opportunity for rogue entities in the Integrated Circuit (IC) supply chain to insert malicious circuits in the hardware design, known as Hardware Trojans (HT). HT detection is a major hardware security challenge, and its early discovery is crucial because postponing the removal of HT to late in design or after the fabrication process would be very expensive. Current works suffer from several shortcomings such as reliance on a golden HT-free reference, unable to identify all types of HTs or unknown ones, burdening the designer with the manual review of code, or scalability issues. To overcome these limitations, we propose GNN4TJ, a novel golden reference-free HT detection method in the register transfer level (RTL) based on Graph Neural Network (GNN). GNN4TJ represents the hardware design as its intrinsic data structure, a graph, and generates the data flow graphs for RTL codes. We utilize GNN to extract the features from DFG, learn the circuit's behavior, and identify the presence of HT, in a fully automated pipeline. We evaluate our model on a dataset that we create by expanding the Trusthub [1] HT benchmarks. The results demonstrate that GNN4TJ detects unknown HT with 97% recall (true positive rate) very fast in 21.1ms.

Brain-Inspired Golden Chip Free Hardware Trojan Detection

Abstract: Since 2007, the use of side-channel measurements for detecting Hardware Trojan (HT) has been extensively studied. However, the majority of works either rely on a golden chip, or they rely on methods that are not robust against subtle acceptable changes that would occur over the life-cycle of an integrated circuit (IC). In this paper, we propose using a brain-inspired architecture called Hierarchical Temporal Memory (HTM) for HT detection. Similar to the human brain, our proposed solution is resilient against natural changes that might happen in the side-channel measurements while being able to accurately detect abnormal behavior of the chip when the HT gets triggered. We use a self-referencing method for HT detection, which eliminates the need for the golden chip. The effectiveness of our approach is evaluated using TrustHub benchmarks, which shows 92.20% detection accuracy on average.

Security of Neural Networks from Hardware Perspective: A Survey and Beyond

Abstract: Recent advances in neural networks (NNs) and their applications in deep learning techniques have made the security aspects of NNs an important and timely topic for fundamental research. In this paper, we survey the security challenges and opportunities in the computing hardware used in implementing deep neural networks (DNN). First, we explore the hardware attack surfaces for DNN. Then, we report the current state-of-the-art hardware-based attacks on DNN with focus on hardware Trojan insertion, fault injection, and side-channel analysis. Next, we discuss the recent development on detecting these hardware-oriented attacks and the corresponding countermeasures. We also study the application of secure enclaves for the trusted execution of NN-based algorithms. Finally, we consider the emerging topic of intellectual property protection for deep learning systems. Based on our study, we find ample opportunities for hardware based research to secure the next generation of DNN-based artificial intelligence and machine learning platforms.

HTnet: Transfer Learning for Golden Chip-Free Hardware Trojan Detection

Abstract: Design and fabrication outsourcing has made integrated circuits (IC) vulnerable to malicious modifications by third parties known as hardware Trojans (HT). Over the last decade, the use of side-channel measurements for detecting the malicious manipulation of the ICs has been extensively studied. However, the suggested approaches often suffer from three major limitations: 1) reliance on a trusted identical chip (i.e. golden chip), 2) untraceable footprints of subtle hardware Trojans which remain inactive during the testing phase, and 3) the need to identify the best discriminative features that can be used for separating side-channel signals coming from HT-free and HT-infected circuits. To overcome these shortcomings, we propose a novel neural network design (i.e. HTNet) and a feature extractor training methodology that can be used for HT detection in run time. We create a library of known hardware Trojans and collect electromagnetic and power side-channel signals for each case and train HTnet to learn the best discriminative features based on this library. Then, in the test time we fine tune HTnet to learn the behavior of the particular chip under test. We use HTnet followed by an anomaly detection mechanism in run-time to monitor the chip behavior and report malicious activities in the side-channel signals. We evaluate our methodology using TrustHub [15] benchmarks and show that HTnet can extract a robust set of features that can be used for HT-detection purpose.

Practical Attacks on Deep Neural Networks by Memory Trojaning

Abstract: Deep neural network (DNN) accelerators are widely deployed in computer vision, speech recognition, and machine translation applications, in which attacks on DNNs have become a growing concern. This article focuses on exploring the implications of hardware Trojan attacks on DNNs. Trojans are one of the most challenging threat models in hardware security where adversaries insert malicious modifications to the original integrated circuits (ICs), leading to malfunction once being triggered. Such attacks can be conducted by adversaries because modern ICs commonly include third-party intellectual property (IP) blocks. Previous studies design hardware Trojans to attack DNNs with the assumption that adversaries have full knowledge or manipulation of the DNN systems’ victim model and toolchain in addition to the hardware platforms, yet such a threat model is strict, limiting their practical adoption. In this article, we propose a memory Trojan methodology that implants the malicious logics merely into the memory controllers of DNN systems without the necessity of toolchain manipulation or accessing to the victim model and thus is feasible for practical uses. Specifically, we locate the input image data among the massive volume of memory traffics based on memory access patterns and propose a Trojan trigger mechanism based on detecting the geometric feature in input images. Extensive experiments show that the proposed trigger mechanism is effective even in the presence of environmental noises and preprocessing operations. Furthermore, we design and implement the payload and verify that the proposed Trojan technique can effectively conduct both untargeted and targeted attacks on DNNs.

Hardware Trojan Detection Using Backside Optical Imaging

Abstract: The high cost of integrated circuit chip production has driven more and more chip design companies to use overseas production services. Since the integrated circuit production cannot be closely monitored, the security of integrated circuit chips has become a major concern. Hardware Trojan (HT) insertion is one type of the hardware attack. HTs are extremely stealthy due to their small sizes and low triggering rates. HTs inserted during manufacturing can have minimum impact on the timing and power. In fact, this impact can be smaller than the timing and power variations caused by the process variations. Therefore, these HTs cannot be easily detected using traditional electrical methods. In this article, we propose a novel optical method, where we image the integrated circuit chip from the backside. Our method, can easily detect any replacements, modifications, or rearrangements of fill cells or functional cells for HT insertion. We use a noise-based detection method to achieve high HT detection rates in different testbenches. To further improve the robustness of our method, we strategically place high reflectance fill cells in the designs. Our approach provides high-resolution, nondestructive, and rapid means to detect HTs inserted during fabrication. We evaluate our approach using various hardware blocks where the HTs can occupy less than 0.1% of the total area or consist of fewer than three gates. In addition, we analyze our method with various magnitudes of noise, process variations, detection window sizes, and resolutions.

A Survey on Recent Detection Methods of the Hardware Trojans

Abstract: Modern integrated circuit design contains various constraints from the frontend to the backend. In microelectronic systems hardware security is a major threat. Hardware Trojan (HT) plays a vital role in hardware security issues. The HT leads to a malicious modification of the integrated circuit (IC). The HT detection aims to assure the trustworthiness of the circuits and improve the reliability of the system. In this article, we presented a review of the various hardware detection techniques like pre-deployment, post-deployment, formal verification, counterfeiting prevention and IC production, physically-unclonable function HT detection techniques. Moreover, HT parameters are analyzed for specific benchmarks.

Survey of Recent Developments for Hardware Trojan Detection

Abstract: The outsourcing of the design and manufacturing of Integrated Circuits (ICs) poses a severe threat to our critical infrastructures as an adversary can exploit them by bypassing the security features by activating a hardware Trojan. These malicious modifications in the design introduced at an untrusted fabrication site can virtually leak any secret information from a secure system to an adversary. This paper discusses all three different hardware Trojan models, such as combinational, sequential, and analog Trojans. We provide a survey of the recent advancements in Trojan detection techniques classified based on their applicability to different Trojans types. We describe a practical approach recently developed using the characterization of Electro-Optical Frequency Mapping (EOFM) images of the chip to detect a hardware Trojan by identifying malicious state elements. This survey also presents open problems with Trojan detection and suggests future research directions in hardware Trojan detection.

SAT-Based Integrated Hardware Trojan Detection and Localization Approach Through Path-Delay Analysis

Abstract: With the rapid growth in IC outsourcing in the semiconductors industry, concerns have increased about the weakening ICs security against hardware Trojan attacks. In this brief, an integrated hardware Trojan detection and localization methodology is presented by employing the proposed SAT-based test pattern generation scheme and the MUX-based debugging technique. The experimental results show that our methodology can effectively detect timing anomalies in the path-delays caused by hardware Trojans with node coverage around 97% as well as localizing all Trojan’s gates with a localization resolution around 99.6%. Moreover, all timing error sites are successfully identified with zero False Negative and 0.56% False Positive rates.

Dead flit attack on NoC by hardware trojan and its impact analysis

Abstract: With the advancement in VLSI technology, Tiled Chip Multicore Processors (TCMPs) with packet switched Network-on-Chip (NoC) have emerged as the most popular design choice for compute and data intensive embedded and parallel systems. Tight time-to-market constraints and budget limitations have forced the designers to explore the possibilities of using several third party Intellectual Property (IP) cores. Use of such unsecured inexpensive third party IPs may pose severe security challenges that are not detected at manufacturing and testing phases. Recent research shows that manipulation of the NoC packet content by Hardware Trojan (HT) has the potential to disrupt the on-chip communication resulting in application level stalling. We model a novel HT that alters the common prefix field of NoC packets leading to the creation of dead flits in router buffers. We introduce two variants of this proposed HT: one that modifies head flit to body flit and another one that modifies the body flit to head flit. We analyze the HT impact at core level, cache level, and NoC level. The experimental analysis on a 16-core TCMP demonstrates that the proposed HT significantly reduces IPC, increases the average cache miss penalty, and increases the average buffer occupancy of selected packets in NoC.

Packet header attack by hardware trojan in NoC based TCMP and its impact analysis

Abstract: With the advancement of VLSI technology, Tiled Chip Multicore Processors (TCMP) with packet switched Network-on-Chip (NoC) have been emerged as the backbone of the modern data intensive parallel systems. Due to tight time-to-market constraints, manufacturers are exploring the possibility of integrating several third-party Intellectual Property (IP) cores in their TCMP designs. Presence of malicious Hardware Trojan (HT) in the NoC routers can adversely affect communication between tiles leading to degradation of overall system performance. In this paper, we model an HT mounted on the input buffers of NoC routers that can alter the destination address field of selected NoC packets. We study the impact of such HTs and analyse its first and second order impacts at the core level, cache level, and NoC level both quantitatively and qualitatively. Our experimental study shows that the proposed HT can bring application to a complete halt by stalling instruction issue and can significantly impact the miss penalty of L1 caches. The impact of re-transmission techniques in the context of HT impacted packets getting discarded is also studied. We also expose the unrealistic assumptions and unacceptable latency overheads of existing mitigation techniques for packet header attacks and emphasise the need for alternative cost effective HT management techniques for the same.

Combining Thermal Maps With Inception Neural Networks for Hardware Trojan Detection

Abstract: Hardware Trojan detection on modern integrated circuits (ICs) is a challenging task since the inspector may have no idea about the location and size of the embedded Trojan circuit. To achieve an accurate Trojan detection, instead of relying on hardware reverse engineering, a nondestructive technique based on thermal maps and inception neural networks (INNs) is proposed in this letter. The thermal maps generated by a Trojan-free (TF) IC chip and multiple emulated Trojan-infected (TI) IC chips are collected and optimized as the critical side-channel leakages at first. Then, INNs are utilized to analyze these optimized thermal maps to exactly extract the information of the embedded Trojans under the assistance of customized filters. As shown in the results, after training the INNs with 150 000 thermal maps, the corresponding Trojan detection accuracy can be achieved over 98.2%.

AdaTrust : Combinational Hardware Trojan Detection Through Adaptive Test Pattern Construction

Abstract: As society becomes increasingly reliant on products and systems that make use of integrated circuits, the defense against potential hardware Trojan attacks by an untrusted foundry becomes an important part of any certification flow for critical components. The slew of recent proposals notwithstanding, a satisfactory solution is still wanting as the solutions offered heretofore either require impractical design/test pattern cost or deliver insufficient detection capabilities, primarily challenged by the noise induced by process variation. The methodology put forth by this proposal aims to remedy this, leveraging an adaptive approach that applies superposition to perform a fine-grained circuit analysis and expose any extant Trojan circuitry. Iterative test pattern modifications, circuit response analysis, and adaptive decision-making are deployed, all embedded within the design-for-test and test pattern cost paradigms of a common industrial circuit. We demonstrate the efficacy of this technique on standard Trust-Hub benchmark circuits with combinational Trojans inserted in sequential designs, showing significant improvement over prior techniques. We also explore the potential cost–benefit tradeoffs that exist within such a methodology, with the intent to provide an efficient solution for an array of potential product markets. This methodology provides a reliable and effective means for Trojan detection, addressing an important piece of the overall circuit certification puzzle.

Hardware-Trojan Classification based on the Structure of Trigger Circuits Utilizing Random Forests

Abstract: Recently, with the spread of Internet of Things (IoT) devices, embedded hardware devices have been used in a variety of everyday electrical items. Due to the increased demand for embedded hardware devices, some of the IC design and manufacturing steps have been outsourced to third-party vendors. Since malicious third-party vendors may insert malicious circuits, called hardware Trojans, into their products, developing an effective hardware Trojan detection method is strongly required. In this paper, we propose 25 hardware-Trojan features based on the structure of trigger circuits for machine-learning-based hardware Trojan detection. Combining the proposed features into 11 existing hardware-Trojan features, we totally utilize 36 hardware-Trojan features for classification. Then we classify the nets in an unknown netlist into a set of normal nets and Trojan nets based on the random-forest classifier. The experimental results demonstrate that the average true positive rate (TPR) becomes 63.6% and the average true negative rate (TNR) becomes 100.0%. They improve the average TPR by 14.7 points while keeping the average TNR compared to existing state-of-the-art methods. In particular, the proposed method successfully finds out Trojan nets in several benchmark circuits, which are not found by the existing method.

AVATAR: NN-Assisted Variation Aware Timing Analysis and Reporting for Hardware Trojan Detection

Abstract: This paper presents AVATAR, a learning-assisted Trojan testing flow to detect hardware Trojans placed into fabricated ICs at an untrusted foundry, without needing a Golden IC. AVATAR is a side-channel delay-based testing solution that is assisted by a learning model (process watchdog) for tracking the process drift and systematic process variation. AVATAR’s process watchdog model is trained using a limited number of test samples, collected at test time, to tightly correlate the Static Timing Analysis results (generated at design time) to the test results (generated from clock frequency sweeping test). The experimental results confirm that AVATAR detects over 98% of (small) Trojans inserted in the selected benchmarks. We have complemented our proposed solution with a diagnostic test that 1) further reduces the false-positive rate of AVATAR Trojan detection to zero or near zero, and 2) pinpoints the net-location of the Trojan Trigger or Payload.

TAAL: Tampering Attack on Any Key-based Logic Locked Circuits

Abstract: Due to the globalization of semiconductor manufacturing and test processes, the system-on-a-chip (SoC) designers no longer design the complete SoC and manufacture chips on their own. This outsourcing of the design and manufacturing of Integrated Circuits (ICs) has resulted in several threats, such as overproduction of ICs, sale of out-of-specification/rejected ICs, and piracy of Intellectual Properties (IPs). Logic locking has emerged as a promising defense strategy against these threats. However, various attacks about the extraction of secret keys have undermined the security of logic locking techniques. Over the years, researchers have proposed different techniques to prevent existing attacks. In this article, we propose a novel attack that can break any logic locking techniques that rely on the stored secret key. This proposed TAAL attack is based on implanting a hardware Trojan in the netlist, which leaks the secret key to an adversary once activated. As an untrusted foundry can extract the netlist of a design from the layout/mask information, it is feasible to implement such a hardware Trojan. All three proposed types of TAAL attacks can be used for extracting secret keys. We have introduced the models for both the combinational and sequential hardware Trojans that evade manufacturing tests. An adversary only needs to choose one hardware Trojan out of a large set of all possible Trojans to launch the TAAL attack.

Hardware Trojan Classification at Gate-level Netlists based on Area and Power Machine Learning Analysis

Abstract: The 21st century has been characterized by incredible technological advancements. A key factor of this revolution is the ever-growing circuits complexity that are the core components of all electronic devices. This revolution has resulted in the development of today's computers but has also led to the creation of a new generation of device viruses, called hardware trojans (HTs). HTs can infect circuits leading to their degradation, complete destruction, or leakage of encrypted information. HTs can be inserted into any phase of the circuit production chain, they can function silently and remain undetected until triggered by a predefined mechanism to deliver their payload. In this paper, we propose a HT classification method, named hArdware Trojan Learning AnalysiS (ATLAS), that identifies HT-infected circuits using a Gradient Boosting (GB) model on data from the gate-level netlist (GLN) phase. Our method was trained on 11 GLN features extracted from 18 trojan-free (TF) and 885 trojaninfected (TI) circuits deposited in Trust-HUB using industrialgrade design tool. The performance evaluation results demonstrate that ATLAS outperforms existing algorithms in terms of Precision, Sensitivity, and F1 measures, enabling highly accurate classification between TF and TI circuits.

Vertical IP Protection of the Next-Generation Devices: Quo Vadis?

Abstract: With the advent of 5G and IoT applications, there is a greater thrust in terms of hardware security due to imminent risks caused by high amount of intercommunication between various subsystems. Security gaps in integrated circuits, thus represent high risks for both-the manufacturers and the users of electronic systems. Particularly in the domain of Intellectual Property (IP) protection, there is an urgent need to devise security measures at all levels of abstraction so that we can be one step ahead of any kind of adversarial attacks. This work presents IP protection measures from multiple perspectives-from system-level down to device-level security measures, from discussing various attack methods such as reverse engineering and hardware Trojan insertions to proposing new-age protection measures such as multi-valued logic locking and secure information flow tracking. This special session will give a holistic overview at the current state-of-the-art measures and how well we are prepared for the next generation circuits and systems.

Fortifying RTL Locking Against Oracle-Less (Untrusted Foundry) and Oracle-Guided Attacks

Abstract: Logic locking protects integrated circuits (IC) against intellectual property (IP) theft, IC overbuilding, and hardware Trojan insertion. Prior locking schemes operate after logic synthesis and cannot protect the semantic information embedded into the logic. Register-transfer level (RTL) locking can protect the sensitive IP semantics and are EDA tool-chain agnostic, allowing seamless integration into arbitrary design flows. State-of-the-art RTL locking protects against the untrusted foundry assuming no access to working chip (oracle). However, it does not protect against oracle-based attacks. In this work, we propose to fortify RTL locking to protect against all untrusted entities in the supply chain, including foundry for oracle-less attacks, and test facility and end users for oracle-guided attacks.

Enhancing Hardware Trojan Detection Sensitivity Using Partition-Based Shuffling Scheme

Abstract: This brief presents a new test pattern generation scheme alongside a design for trust (DfTr) methodology for detecting hardware Trojan through side channel-based analysis approaches. The proposed scheme takes advantage of the proposed Hamming distance-based reordering and partition-based shuffling methods. The key idea behind the proposed work is that instead of distributing the circuit activity profile among all the nets with low transition probability at once, it can only be restricted to the smaller subsets of rare nets one at a time, while the rest of subsets remain at the lowest activity. As a result, a remarkable reduction in the background circuit activity by more than 41% and favorable enhancement of detection sensitivity about 31% are achieved compared to the state-of-the-art method.

What Can a Remote Access Hardware Trojan do to a Network-on-Chip?

Abstract: Interconnection networks such as Network-on-Chips (NoCs) for multi/many-core processors are critical infrastructure of the system as they enable data communication among the processing cores, caches, memory, and other peripherals. Given the criticality of the interconnects, the system can be severely subverted if the interconnection is compromised. The threat of Hardware Trojans (HTs) penetrating complex hardware systems such as multi/many-core processors are increasing due to the increasing presence of third party players in a System-on-chip (SoC) design. Even by deploying naive HTs, an adversary can exploit the NoC backbone of the processor and get access to communication patterns in the system. In this paper, we discuss that one or more HTs embedded in the NoC of a multi/many-core processor is capable of leaking sensitive information regarding traffic patterns to an external malicious attacker; who, in turn, can analyze the HT payload data with advanced algorithms such as machine learning to infer the applications running on the processor or reverse engineer architectural Intellectual Property (IP) of the system. Here, we entertain the idea of using routing obfuscation to achieve a desired trade-off between defense against HTs and performance penalties. We also discuss the possibility of making this trade-off a tunable design parameter that can be adjusted at run-time based on external threat perception.

Non-invasive I2C Hardware Trojan Attack Vector

Abstract: In smartphones, and more generally in IoT devices, manufacturers focus their efforts on securing communications with the outside world that are more exposed to attack while considering communications between secure components. By doing this, it results in internal communication buses with little or no security against attackers. I2C is the most used internal communication bus in IoT devices to communicate with sensors and memories. It is also used in recent smartphones to connect the Trusted Execution Environments (ARM TrustZone, Apple SEP, or Google Titan M) to a dedicated EEPROM memory that contains secret information such as encryption keys, anti-replay counter, or the boot ROM. In this paper, we propose a non-invasive attack through a hardware trojan on the I2C bus, which will allow us to perform two attack scenarios: a heart bleeding type attack which will allow retrieving additional information at each memory read, and a buffer overflow attack which will allow writing additional data in the memory at each write which can result in modifying secret information such as password or counters. These attacks can be performed on any device using the I2C bus. In the context of smartphones, these attacks will allow the extraction of sensitive information stored in the secure EEPROM memory.

Hardware Trojan Detection Using Machine Learning Technique

Abstract: As the internationalization of Integrated Circuit (IC) production increased, the inclusion of deliberately stealthy modification called hardware Trojans has also escalated. A hardware Trojan detection method that works at the gate-level using the netlist of the circuit under test is presented in this paper. The unsupervised machine learning algorithm, K-Means classification is used for categorization. Every net of the circuit is analyzed to determine if the net is genuine or is Trojan infected by the extraction of seven relevant features from every net. The technique has been validated on ISCAS’85 benchmark circuits and parameters like true positive (TP), false negative (FN) and recall (TPR) have been illustrated.

SC-COTD: Hardware Trojan Detection Based on Sequential/Combinational Testability Features using Ensemble Classifier

Abstract: Security against Hardware Trojans (HT) is an important concern in integrated circuits (IC) design and fabrication. Most of the current HT detection methods are based on the golden model of circuit design. Further, some approaches require test pattern for HTs activation. In this paper, we propose SC-COTD (Sequential/Combinational Controllability and Observability features for hardware Trojan Detection), an effective hardware Trojan detection to get rid of both golden chip and test pattern limitations. SC-COTD uses both sequential and combinational testability measures to detect and locate HT signals by a machine learning approach. This method deploys an ensemble classifier based on k-means clustering. The clustering models have diverse variety in testability features along with size of clustering which inspect and reveal different aspects of netlist conventional for a collaborative scheme. The clustering results are filtered and then fed into a decision-making procedure based on majority voting to eliminate the limited flaws of each model. The evaluation results on TrustHUB benchmarks demonstrate that, SC-COTD can detect and locate HTs with 100% without any false negative, i.e., Recall = 1. Although our method has a limited number of false positive, it has the best performance in comparison to well-known previous approaches.

A Lightweight Security Checking Module to Protect Microprocessors against Hardware Trojan Horses

Abstract: It has been demonstrated that Software exploitable Hardware Trojan Horses (HTHs) can be inserted in commercial CPUs and memories. Such attacks allow malicious users to run their own software or to gain unauthorized privileges over the system. As a consequence, HTHs must nowadays be considered a serious threat not only from academy but also from industry. In this paper we present a security checking module meant to be connected between the microprocessor and the instruction memory in order to monitor the fetching activity with the aim of detecting the activation of HTHs. In particular, we aim at detecting those HTHs that alter the expected execution flow by launching a malicious program. We integrated the proposed security checking module within a case study system based on a RISC-V microprocessor implemented on an FPGA and running a set of software benchmarks. This experiment demonstrated that our proposal is able to detect 100% of possible HTHs activations with no false alarms. We measured a LUT overhead of 0.5% and a FF overhead of 0.3%, with a 2.36% power consumption increase and no working frequency reduction.