Fanci

Abstract

Hardware design today bears similarities to software design. Often vendors buy and integrate code acquired from third-party organizations into their designs, especially in embedded/system-on-chip designs. Currently, there is no way to determine if third-party designs have built-in backdoors that can compromise security after deployment.The key observation we use to approach this problem is that hardware backdoors incorporate logic that is nearly-unused, i.e. stealthy. The wires used in stealthy backdoor circuits almost never influence the outputs of those circuits. Typically, they do so only when triggered using external inputs from an attacker. In this paper, we present FANCI, a tool that flags suspicious wires, in a design, which have the potential to be malicious. FANCI uses scalable, approximate, boolean functional analysis to detect these wires.Our examination of the TrustHub hardware backdoor benchmark suite shows that FANCI is able to flag all suspicious paths in the benchmarks that are associated with backdoors. Unlike prior work in the area, FANCI is not hindered by incomplete test suite coverage and thus is able to operate in practice without false negatives. Furthermore, FANCI reports low false positive rates: less than 1% of wires are reported as suspicious in most cases. All TrustHub designs were analyzed in a day or less. We also analyze a backdoorfree out-of-order microprocessor core to demonstrate applicability beyond benchmarks.

Hardware Trojans classification based on controllability and observability in gate-level netlist

“…The TPR values in [4,5,6] are much dependent on the functional simulation as well as input test patterns. As the scale of IC increases, activating all kinds of hardware Trojans is impossible.…”

“…On the other hand, pre-silicon design methods often detect HTs on gated level netlists, which can be categorized into two types: the dynamic and static detection. Dynamic detection techniques [3,4,5,6] generally judge a circuit according to the activation of HT parts. However, HTs are often latent and rarely activated under ordinary functional verification constrains thus hard to discover.…”

Architectural Support for Containment-based Security

“…Hardware backdoors, often referred to as hardware Trojans, can be inserted at any phase of the chip manufacturing process-specification, registertransfer level (RTL) design, IP integration, physical design, and fabrication. Various defenses have been proposed against hardware Trojans including post-fabrication detection [1,12,21,44,51,105,107], run-time monitoring [98], and designtime deterrence [22,41,75,84,99,110]. However, these techniques are typically not comprehensive.…”

Holistic hardware Trojan design of trigger and payload at gate level with rare switching signals eliminated

“…To keep dormant in functional verification, hardware Trojan is usually triggered by some rare conditions, which is the so-called trigger condition. In the existing Trojan benchmarks, the trigger part and payload part are designed separately and the rare-triggered condition is implemented by a combination of several low-activity or low testability signals, which may be detected by logic analysis techniques [17,18,19,20]. The traditional digital Trojan design methodology can be divided into two categories, the first exploits the rare transition signals in the original design [6,7,9,15], and the second attempts to partition the Trojan circuit into smaller parts and stages [12,14].…”

“…A uniform distribution of states is acquired by linear feedback shift register in [8], but low transition wire is still created when generating rare condition by combinational circuits. All these Trojans implement their rare conditions rely on one or more low activity or low testability signals, which may be detected by logic analysis detections, such as unused logic analysis [21,22], activation based analysis [23,24,25], Sandia Controllability/Observability based analysis [17,18] and probability analysis [19,20].…”