A comprehensive survey of physical and logic testing techniques for Hardware Trojan detection and prevention

Abstract

Hardware Trojans have emerged as a great threat to the trustability of modern electronic systems. A deployed electronic system with one or more undetected Hardware Trojan-infected components can cause grave harm, ranging from personal information loss to destruction of national infrastructure. The inherently surreptitious nature and bewildering variety of Hardware Trojans makes their detection an extremely challenging exercise. In this paper, we explore the state of the art of post-silicon testing techniques for Hardware Trojan detection, with our coverage including both physical measurement-based testing, as well as logic testing. We present systematic classification of Hardware Trojans and a taxonomy of detection techniques based on physical and logical testing, and describe these techniques in details, including their stand-out features and strengths and weaknesses. We conclude the paper with an evaluation of the current status of progress, and major directions of future research.

A overview of HT detection approaches discussed in the paper

Paper	Detection technique	Golden reference model	Methodology	Adversary model	Years
Agrawal et al. [4]	Power-based SCA	Reverse Engineering	PCA of dynamic power side-channel signatures	Transistor Trojan	2007
Wang et al. [112]	Power-based SCA	Simulation	Multi-supply transient-current integration methodology	Transistor Trojan	2008
Banga et al. [13,14,15]	Power-based SCA	Simulation	Region-aware test pattern generation for increasing transient power	RTL Trojan	2008, 2009
Rad et al. [89, 90]	Power-based SCA	Simulation	Region-based transient power signal analysis for Outlier detection	Transistor Trojan	2008
Li et al. [63]	Delay-based SCA	Reverse Engineering	Measurement of selected register-to-register path delays	RTL Trojan	2008
Jin et al. [127]	Delay-based SCA	Reverse Engineering	Fingerprinting using path delay information of the entire chip	RTL Trojan	2008
Jha et al. [62]	Logic Testing	N.A.	Unique probabilistic signature of IC is generated and compared with a HT-free circuit	Transistor Trojan	2008
Rai et al. [92]	Delay-based SCA	Simulation	Statistical analysis of delay signature to enhance HT detection	RTL Trojan	2009
Chakraborty et al. [30]	Logic Testing	N.A.	Heuristics to improve HT detection coverage motivated by the N-detect test	RTL Trojan	2009
Aarestad et al. [1]	Power-based SCA	Simulation	Static current consumption analysis	Transistor Trojan	2010
Narasimhan et al. [77]	Power and Delay-based SCA	Simulation	Use of the correlation between $F_{max}$ and $I_{DDT}$ of an IC to eliminate the impact of PV	Transistor Trojan	2010
Banga et al. in [17]	Logic Testing	N.A.	HT detection scheme enhanced by SAT solver	RTL Trojan	2010
Koushanfar et al. [64]	Multi Parameter	Simulation	Use of a combination of several side-channel parameters	RTL Trojan	2011
Narasimhan et al. [78]	Power-based SCA	Self-Referencing	Compares an IC instance’s transient current signature at different time instances	RTL Trojan	2011
Zhang [132]	Logic Testing	N.A.	Formal verification and code coverage analysis of redundant and unused parts of the design are identified followed by the ATPG	RTL Trojan	2011
Li et al. [70]	Delay-based SCA	Self-Referencing	Predicted delay of a path is compared against on-chip delay fingerprint	RTL Trojan	2012

Paper	Detection technique	Golden reference model	Methodology	Adversary model	Years
Lamech et al. [66]	Delay-based SCA	Simulation	Use of delay chain to validate delay measurement	Transistor Trojan	2012
Zhang et al. [129]	Power-based SCA	Self-Referencing	Detection of outliers by comparing measured signature with other measured signatures	Transistor Trojan	2012
Cha et al. [27]	Delay-based SCA	Simulation	Selection of paths having the smallest delays as integer linear programming problem	Transistor Trojan	2013
Forte and Bao et al. [18, 45]	Temperature-based SCA	Simulation	Comparison of thermal model of IC at three phases: design, test, and run-time	RTL Trojan	2013, 2015
Hu and Nomroz et al. [56, 85]	Temperature-based SCA	Simulation	Multimodal characterization using thermal maps and power maps to detect and locate HT	RTL Trojan	2013, 2014
Hou et al. [55]	Power-based SCA	Simulation	Intrinsic relationship between transient current and static current to reduce PV	RTL Trojan	2014
Yoshimizu et al. [128]	Delay-based SCA	Self-Referencing	Use of symmetry in different transistor-level paths	RTL Trojan	2014
Soll et al. [106]	EM-based SCA	Simulation	EM emission of HT-infected FPGAs is compared with the golden model	RTL Trojan	2014
Liu et al. [71]	Power-based SCA	Self-Referencing	Use of on-chip process control monitors to capture PV	RTL Trojan	2014
Wilcox et al. [117]	Power-based SCA	Simulation	Chip-averaging method targeted for removing intra-die variations	Transistor Trojan	2015
Ismari et al. [59]	Delay-based SCA	Simulation	On-chip embedded test structure to reduce effects of intra-die PV	Transistor Trojan	2015
Ngo et al. [79]	Delay-based SCA	Simulation	Use of clock glitches to measure path delay fingerprints	Transistor Trojan	2015
Exurville et al. [42]	Delay-based SCA	Simulation	Clock glitches combined with statistical techniques to reduce PV	Transistor Trojan	2015
Ngo et al. [79, 81]	EM-based SCA	Simulation	Golden AES encryption hardware execution EM traces and HT-infected AES hardware execution traces with the same plaintext are compared	Transistor Trojan	2015, 2016
Balasch et al. [12]	EM-based SCA	Simulation	Use of Welch’s t test to determine golden fingerprint	RTL Trojan	2015
Saha et al. [99]	Logic Testing	N.A.	[30] extended using genetic algorithms and SAT solvers	RTL Trojan	2015
Jap et al. [61]	EM-based SCA	Machine Learning	Support Vector Machine (SVM)-based EM side-channel profiling	Transistor Trojan	2016
Xue et al. [125]	Power-based SCA	Machine Learning	HT detection problem is expressed as a two-class machine learning classification problem	Transistor Trojan	2016

Paper	Detection technique	Golden reference model	Methodology	Adversary model	Years
Zheng et al. [133]	Power-based SCA	Self-Referencing	Analyze dynamic current values in self-similar structures of IC and compared	Transistor Trojan	2016
Huang et al. [57, 58]	ATPG with SCA	N.A.	Hamming-distance-based reordering and simulation-based reordering of test vectors to improve sensitivity to SCA	Transistor Trojan	2016, 2018
Esirci et al. [41]	Delay-based SCA	Simulation	Statistical analysis of delays in correlated paths	RTL Trojan	2017
He et al. [52]	EM-based SCA	Simulation	Simulation data from RTL design is used to generate the EM fingerprint	RTL Trojan	2017
Sree et al. [93, 95]	ATPG with SCA	Self-Referencing	Circuit design is divided into segments and the set of input patterns are applied to extract the power signature	RTL Trojan	2017
Amelian et al. [8]	Delay-based SCA	Simulation	Comparison of delay of K shortest paths with golden IC	RTL Trojan	2018
Cui et al. [38]	Delay-based SCA	Simulation	Use of the order of path delay in path pairs	RTL Trojan	2018
Fournaris et al. [46]	Multi Parameter	Simulation	Use of combination of both logic testing and side-channel testing at different stage of operation	RTL Trojan	2018
Xue et al. [123, 124]	Power-based SCA	Machine Learning	Co-training-based HT detection technique similar to [125]	RTL Trojan	2018, 2019
Xue and Ren [122]	Power-based SCA	Self-Referencing	Modeling of static power consumption by clock tree and gates for fingerprinting	RTL Trojan	2018
Cruz et al. [37]	Logic Testing	N.A.	IC is partitioned based on an inserted scan chain and model checking technique is combined with ATPG	RTL Trojan	2018
Chen et al. [31]	EM-based SCA	Simulation	Detection by analyzing the EM radiation of clock trees in an IC	RTL Trojan	2019
Nguyen et al. [82]	Backscattering SCA	Simulation	Sinusoidal EM signal is transmitted and the backscattered signal is received is compared to detect HT	RTL Trojan	2019
Lyu et al. [74]	ATPG with SCA	N.A.	GA-based test generation algorithm to increase HT detection sensitivity	RTL Trojan	2019
Lyu et al. [75]	ATPG with SCA	N.A.	SAT-based ATPG technique to assist HT detection by delay-based SCA	RTL Trojan	2020
Nigh et al. [83]	ATPG with SCA	N.A.	Trojan detection sensitivity is increased from the maximum S-RPD intra-die PV	RTL Trojan	2020