Visible to the public A Novel Golden-Chip-Free Clustering Technique Using Backscattering Side Channel for Hardware Trojan Detection

TitleA Novel Golden-Chip-Free Clustering Technique Using Backscattering Side Channel for Hardware Trojan Detection
Publication TypeConference Paper
Year of Publication2020
AuthorsNguyen, Luong N., Yilmaz, Baki Berkay, Prvulovic, Milos, Zajic, Alenka
Conference Name2020 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)
Date Publisheddec
Keywordsbackscatter, Backscattering side-channel, clustering, composability, cyber physical security, cyber physical systems, Hardware, hardware security, hardware trojan, integrated circuits, pubcrawl, resilience, Resiliency, reverse engineering, Sociology, Statistics, supply chain security, Trojan detection, trojan horse detection, Trojan horses
AbstractOver the past few years, malicious hardware modifications, a.k.a. hardware Trojans (HT), have emerged as a major security threat because integrated circuit (IC) companies have been fabricating chips at offshore foundries due to various factors including time-to-market, cost reduction demands, and the increased complexity of ICs. Among proposed hardware Trojan detection techniques, reverse engineering appears to be the most accurate and reliable one because it works for all circuits and Trojan types without a golden example of the chip. However, because reverse engineering is an extremely expensive, time-consuming, and destructive process, it is difficult to apply this technique for a large population of ICs in a real test environment. This paper proposes a novel golden-chip-free clustering method using backscattering side-channel to divide ICs into groups of Trojan-free and Trojan-infected boards. The technique requires no golden chip or a priori knowledge of the chip circuitry, and divides a large population of ICs into clusters based on how HTs (if existed) affect their backscattered signals. This significantly reduces the size of test vectors for reverse engineering based detection techniques, thus enables deployment of reverse engineering approaches to a large population of ICs in a real testing scenario. The results are collected on 100 different FPGA boards where boards are randomly chosen to be infected or not. The results show that we can cluster the boards with 100% accuracy and demonstrate that our technique can tolerate manufacturing variations among hardware instances to cluster all the boards accurately for 9 different dormant Trojan designs on 3 different benchmark circuits from Trusthub. We have also shown that we can detect dormant Trojan designs whose trigger size has shrunk to as small as 0.19% of the original circuit with 100% accuracy as well.
DOI10.1109/HOST45689.2020.9300127
Citation Keynguyen_novel_2020