Temperature Tracking: Toward Robust Run-Time Detection of Hardware Trojans

Abstract

The hardware Trojan threat has motivated development of Trojan detection schemes at all stages of the integrated circuit (IC) lifecycle. While the majority of existing schemes focus on ICs at test-time, there are many unique advantages offered by post-deployment/run-time Trojan detection. However, run-time approaches have been underutilized with prior work highlighting the challenges of implementing them with limited hardware resources. In this paper, we propose three innovative low-overhead approaches for run-time Trojan detection which exploit the thermal sensors already available in many modern systems to detect deviations in power/thermal profiles caused by Trojan activation. The first one is a local sensor-based approach that uses information from thermal sensors together with hypothesis testing to make a decision. The second one is a global approach that exploits correlation between sensors and maintains track of the ICs thermal profile using a Kalman filter (KF). The third approach incorporates leakage power into the system dynamic model and apply Extended Kalman Filter (EKF) to track IC's thermal profile. Simulation results using state-ofthe-art tools on 10 publicly available Trojan benchmarks verify that all three proposed approaches can detect active Trojans quickly and with few false positives. Among three approaches, EKF is flawless in terms of the 10 benchmarks tested but would require the most overhead.

Hardware Trojan detection and localization based on local detectors

“…3) Embedding sensors in the circuit or chip capable of detecting Trojans by measuring temperature variations. This method was employed in [4]. 4) Another method revolves around the comparison of instantaneous voltage and current [12]; however, that study did not report the numerical result of success rate or overhead.…”

“…Trojans may activate in specific working or environmental circumstances, leaving destructive effects such as piracy and illegal data transfer [1][2][3]. Trojan detection takes place in 3 phases during the lifecycle of a chip: during design time, test time, and run time [4]. Design-time methods usually support the run-time methods.…”

“…Design-time methods usually support the run-time methods. There are significantly fewer run-time methods than the others, even though they bring about the following great advantages [4]: first, if the Trojan is not active during testing, the test-time method fails in detection. Second, a chip whose Trojan has not been activated will function similar to an intact Trojan-free chip.…”

A PCA and Mahalanobis distance‐based detection method for logical hardware Trojan

“…[11][12][13] Operating principle of it is that HTs implanted in the chip will affect some side-channel signal of the chip. as current, delay time, and temperature to detect HT under working condition.…”

“…as current, delay time, and temperature to detect HT under working condition. [11][12][13] Operating principle of it is that HTs implanted in the chip will affect some side-channel signal of the chip. According to this, we can detect HTs by observing side-channel signal of the chip and comparing it with the original chip.…”