Side-Channel Trojan Insertion - a Practical Foundry-Side Attack via ECO

Abstract

Design companies often outsource their integrated circuit (IC) fabrication to third parties where ICs are susceptible to malicious acts such as the insertion of a side-channel hardware trojan horse (SCT). In this paper, we present a framework for designing and inserting an SCT based on an engineering change order (ECO) flow, which makes it the first to disclose how effortlessly a trojan can be inserted into an IC. The trojan is designed with the goal of leaking multiple bits per power signature reading. Our findings and results show that a rogue element within a foundry has, today, all means necessary for performing a foundry-side attack via ECO.Index Terms-hardware security, manufacturing-time attack, hardware trojan horse, side-channel attack, VLSI, ASIC.

Hardware Trojan Insertion in Finalized Layouts: From Methodology to a Silicon Demonstration

“…2. Our trojan insertion methodology for an SCT capable of leaking 2 bits per power signature reading (modified from [10]).…”

“…Despite encouraging results reported from the SCT studies, only in [10] the authors discuss how SCTs could be inserted from the perspective of the attacker. Even more concerning, this discussion is also absent from silicon-validated trojans [15], [16], [21].…”

“…Even more concerning, this discussion is also absent from silicon-validated trojans [15], [16], [21]. In this work, we present an extension of the SCT design methodology described in [10]. We assume that a rogue element inside the foundry is the adversary and that he/she makes use of readily available engineering change order (ECO) capabilities of physical design tools.…”

“…A typical IC design flow. Highlighted in red is the stage where a rogue element may mount an attack (modified from [10]).…”

Reusing Verification Assertions as Security Checkers for Hardware Trojan Detection

“…Hardware Trojans are known as one of the greatest threats against the trustworthiness of ICs, and they have raised serious concerns about the reliability and security of digital designs [2]. If an IC is utilized in a product/system while Trojan(s) remain there, it may lead to functionality change, reliability degradation/denial of service, and information or data leakage [3].…”