Ten years of hardware Trojans: a survey from the attacker's perspective

Abstract

In the last decade, hardware Trojan has emerged as a serious concern in integrated circuit (IC) industry. As such, hardware Trojan detection techniques have been studied extensively. However, in order to develop reliable and effective defenses, it is important to figure out how hardware Trojans are implemented in practical scenarios. In this paper, we attempt to make a review of the hardware Trojan design and implementations in the last decade and also provide an outlook. Unlike all previous surveys that discuss Trojans from the defender's perspective, for the first time, we study the Trojans from the attacker's perspective, focusing on the attacker's methods, capabilities and challenges when he designs and implements a hardware Trojan. Particularly, the following questions are explored. What are the current methods and capabilities of attackers after ten years of research and development? By considering more and more sophisticated hardware Trojan detection techniques, what challenges do the attackers face, and vice versa? First, we present adversarial models in terms of the adversary's methods, adversary's capabilities and adversary's challenges in seven practical hardware Trojan implementation scenarios: in-house design team attacks, third-party intellectual property (3PIP) vendor attacks, computer-aided design (CAD) tools attacks, fabrication stage attacks, testing stage attacks, distribution stage attacks, and field programmable gate array (FPGA) Trojan attacks. Second, we analyze the hardware Trojan implementation methods under each adversarial model in terms of seven aspects/metrics: hardware Trojan attack scenarios, the attacker's motivation, feasibility (the practicality of the attacks), detectability (anti-detection capability of that kind of Trojan), protection and prevention suggestions for the designer, overhead analysis, and case studies of Trojan implementations. Finally, future directions on hardware Trojan attacks and defenses are discussed. This paper also presents several new insights and assumptions for the first time, including considering the Trojans not only from the copyright owner's perspective, but also from the users' perspective, and discussing the hardware Trojan attacks in the testing phase and in the distribution phase. This paper can hopefully provide a reference for future works on building effective hardware Trojan defenses.

Deep Learning-Based Hardware Trojan Detection With Block-Based Netlist Information Extraction

“…Therefore, in this paper, we propose a Net2Vec methodology, in which a word embedding algorithm is utilized to encode PCP feature traces. The PCP vocabulary (w) can be assembled according to Equation (2). An example of the rewritten PCP feature traces using PCP words is shown in Fig.…”

“…It is easier to insert functional Trojans at a design stage because there are more opportunities for third-party entities to accomplish Trojan insertion. Moreover, the logic of functional Trojans can be cleverly designed in size and activated stealthily to achieve its malicious purpose, which is challenging for detection approaches using traditional IC tests and verification solutions [1], [2].…”

Design of Hardware Trojans and its Impact on CPS Systems: A Comprehensive Survey

“…An adversary can insert a hardware Trojan at any IC supply chain phase [34]. In-house rogue designers are capable of inserting Trojan at the design phase.…”

“…Attacker in a 3PIP vendor can insert stealthy HTs into the IP at RTL and/or netlist level or other design specification levels. Using the unauthenticated HT-inserted 3PIP in the original design compromises design integrity [34]. A design faces maximum trust issue when it is sent to a third-party facility for fabrication.…”

“…There exist few works that survey the HT attacks and defenses [2]- [4], [34]. In contrast to the existing works, this work provides a novel categorization of the HTs based on the application/target platform and also provides insights on the HT designs, which has not been engulfed in the previous works.…”