Scalable Hardware Trojan Activation by Interleaving Concrete Simulation and Symbolic Execution

Test generation using reinforcement learning for delay-based side-channel analysis

“…We also adopt the "sensitivity" from [20] as a metric, which refers to the scaled delay difference between the DUT and golden design. The sensitivity is defined as: sensitivity= difference/delay{; 1 it*)) (2) where f* refers to the register producing the maximum delay difference, and t* refers to the test producing the maximum delay difference.…”

“…Existing Trojan detection techniques can be broadly classified into two categories: logic testing and side-channel analysis. Logic testing methods such as Automatic Test Pattern Generation (ATPG) [2] or statistical test generation [ 4,15] try to activate Trojans using generated tests, but they have two major limitations: (1) They suffer from high computational complexity for large designs. (2) Since it is infeasible to generate all possible input patterns, the generated tests are not effective in activating stealthy Trojans.…”

“…Logic testing methods such as Automatic Test Pattern Generation (ATPG) [2] or statistical test generation [ 4,15] try to activate Trojans using generated tests, but they have two major limitations: (1) They suffer from high computational complexity for large designs. (2) Since it is infeasible to generate all possible input patterns, the generated tests are not effective in activating stealthy Trojans. The triggering conditions for Trojans are usually crafted as a combination of rare conditions, such that Trojan-implanted designs will retain exactly the same functionality as golden designs until a rare condition is satisfied to yield malicious behavior.…”

An Efficient Framework with Node Filtering and Load Expansion for Machine-Learning-Based Hardware Trojan Detection

“…Logic testing is a reliable method that is independent of process variations, which is robust against process variations and noise margins [16,17]. It activates HTs by applying test vectors and compares the responses with the correct results.…”

GreyConE: Greybox Fuzzing + Concolic Execution Guided Test Generation for High Level Designs

“…Therefore, verifying the security aspects of HLS IPs is crucial for CSPs to ensure accurate functionality. [8] Gate level ATPG binning + SAT formulation ISCAS85, ISCAS89, ITC99 ✗ Huang et al [28] Gate level Guided ATPG ISCAS85, ISCAS89 ✗ Liu et al [45] Gate level Genetic algorithm + SMT formulation TrustHub [55] ✗ Ahmed et al [5] Register transfer level Concolic testing TrustHub [55] ✓ Ahmed et al [4] Register Transfer Level Greedy concolic testing TrustHub [55] ✓ Lyu et al [44] Register Transfer Level Parallelism + concolic testing TrustHub [55] ✓ Veerana et al [58] HLS/SystemC Property checking S3C [59] ✓ Le et al [36] HLS/SystemC Guided greybox fuzzing S3C [59] ✗ Bin et al [38] HLS/SystemC Selective concolic testing S3C [59] ✗ Vafaei et al [57] C-level(from RTL) Symbolic Execution TrustHub [55] ✓ GreyConE [19] HLS/SystemC,C/C++ Greybox Fuzzing(GF) + Concolic Execution(CE) S3C [59],S2C [51] ✗ GreyConE+(Ours) HLS/SystemC,C/C++ Selective Instrumentation with GF + CE S3C [59], S2C [51],SC [40],Rosetta [66] ✓ functionalities like Trojans in IP designs introduces potential threats, including the risk of IP malfunctions, leakage of sensitive information, and potential damage to underlying hardware [48,58]. Vulnerabilities within third party HLS IPs might arise during the design phase, presenting similarities to security challenges encountered in untrusted electronics supply chains and the insertion of Trojans in pre-silicon hardware.…”