International audience—Hardware Trojans (HT) inserted in integrated circuits have received special attention of researchers. In this paper, we present firstly a novel HT detection technique based on path delays measurements. A delay model, which considers intra-die process variations, is established for a net. Secondly, we show how to detect HT using ElectroMagnetic (EM) measurements. We study the HT detection probability according to its size taking into account the inter-die process variations with a set of FPGA. The results show, for instance, that there is a probability greater than 95% with a false negative rate of 5% to detect a HT larger than 1.7% of the original circuit. I. Introduction The trust and security of Integrated Circuits (IC) design and fabrication is critical for sensitive fields like finance, health, and governmental communications. Due to the complexity and the high cost of IC fabrication cycle, more and more firms outsource their production. This trend gives a possibility for an adversary to introduce malicious circuit, called Hardware Trojan horse (HT), in any IC. It can either perform a Denial Of Service (DOS), deteriorate circuit performance [8], or steal sensitive information. Therefore, the HTs are considered a real threat which has gained attention from researchers. HT can be inserted at any point during the design or fabrication process from Register Transfer Level (RTL) to layout and circuit fabrication. For example in [11], authors show some techniques to insert malicious circuitry at RTL level. These HTs, which are activated with a specific pattern inputs, can leak secret key via RS232 channels. The HT, unlike a software trojan, cannot be removed once it is fabricated. So, it is better to proactively prevent the insertion of a HT: few methods have been proposed. One seminal work is known as " private circuits II " [9]. This paper describes a proof-of-concept, too costly to be implemented. A more reasonable option has been recently proposed in [5]: it uses two codes to encode the state and mix it with encoded randomness, which allows to prevent an easy triggering and has a detection capability. Otherwise it is important to detect it before it becomes effective. Previous works classify detection methods into two wide categories: destructive and non-destructive. Invasive methods destroy the chip to reconstruct successfully the GDSII an

International audienceA Hardware Trojan is a malicious hardware modification of an integrated circuit. It could be inserted at different design steps but also during the process fabrication of the target. Due to the damages that can be caused, detection of these alterations has become a major concern. In this paper, we propose a new resilient method to detect Hardware Trojan based on path delay measurements. First, an accurate path delay model is defined. Then, path delay measurements are compared in a way that theoretically eliminate process and experimental variations effects. Finally, this proposed detection method is experimentally validated using different FPGA boards with substantial process variations. Both small sized sequential and combinatorial Hardware Trojans are implemented and successfully detected

This paper describes the results of the practical measurements done to determine the path delay associated with each bit of a hardware AES FPGA implementation using a clock glitch injection tool. We illustrate how the measured path delays can constitute a characteristic fingerprint of an Intellectuel Property (IP) and can be used to detect the insertion of hardware trojans. The influence of synthesis options and inter die variations on the measurements is also studied. Compared to trojan detection schemes based on path delay characterisations already proposed in the literature, our approach does not require any additional test circuit to be inserted in the IP. Moreover our results are based on practical measurements.

In this paper we study the information leakage that may exist, due to electrical coupling, between logically independent blocks of a secure circuit as a new attack path to retrieve secret information. First, an AES-128 has been implemented on a FPGA board. Then, this AES implementation has been secured with a delay-based countermeasure against fault injection related to timing constraints violations. The countermeasure's detection threshold was supposed to be logically independent from the data handled by the cryptographic algorithm. Thus, it theoretically does not leak any information related to sensitive values. However experiments point out an existing correlation between the fault detection threshold of the countermeasure and the AES's calculations. As a result, we were able to retrieve the secret key of the AES using this correlation. Finally, different strategies were tested in order to minimize the number of triggered alarm to retrieve the secret key.