Hardware Trojans Flashcards
what is a hardware trojan?
A malicious addition or modification to the existing circuit elements
what are 3 effects of HT?
- Change functionality
- Drain resources
- Leak secret info
Specification phase
- Designers map out what requirements of chip (power, timing, etc)
- HTs can change functional specifications
Design phase
- Designers consider functional, logical, timing, and physical constraints
- HT can be in any component in the design
fabrication phase
- When the chip is physically made
- Subtle mask changes can have a serious effect
testing phase
- Great opportunity to test for HT
- Need to make sure that the test vectors are kept secret so that adversary cannot make test vectors that will hide HT
assembly phase
- Chip is combined with other circuitry on PCB
- Every interface where components interact is a place for HT
name the 2 components of HT
trigger and payload
can HT be removed?
not without replacing the hardware of a computer
no-trigger activation
HT is always on
trigger activation
needs either internal or external event in order to active
how long do triggered HTs remain active?
indefinitely, a specific amount of time, or until a specific condition
internal triggers
time-based or event-based events (counter or temperature threshold)
External triggers
based on input from outside the chip
combination trojan
“I need to see these two inputs to activate”
sequential trojan
“I need x, y, and z to happen in order to activate”
Pre-silicon HT detection
non-destructive, cannot detect HT after design phase
Post-Silicon HT detection
functional testing (not accurate) or SC
Failure-based HT detection techniques
Use techniques usually reserved for determining why a chip failed to look for HT. time-consuming and expensive, not meant to be used on every chip
Automatic Test Pattern Generation (ATPG)
HT detection. Fuzzing but for chips ==> automatically create test vectors. Good for HT that modify components, but not good for adding logic (because we don’t know to test for it). not good if we dont know activation criteria
IDDQ
HT detection SC. Every gate leaks power even when in idle state. Measure power in quiescent (idle) state => if extra gate, there will be more power leakage
IDDT
Power side channel via dynamic power
Path delay
- Additional gates and capacitance will cause circuit to take longer to do a computation
- Even if those gates are not directly involved (i.e. not activated yet), if they are connected to other components, they will cause a slight delay
Challenges with path delay
- Can be small increase that is hard to spot
- Hard to get complete code coverage
- Chips are not completely constant in speed
What is path delay better at detecting that power SC?
- Distributed HT
- Hard-to-activate HT
why must delay measurements be part of circuitry?
Need to be able to measure all internal paths (not just the ones exposed by pins)
Shadow / clock register path delay detection
- Have a shadow register (different from regular register) that latches the results of each circuit output
- Have a shadow clock that runs ‘shadow’ to system clock
- At end of shadow clock cycle, shadow registers get set
- Repeatedly shift shadow clock earlier and earlier to measure the timing of a path
- Can tell when to stop because the two registers won’t be equal
Clock Sweeping
Can measure delay also by speeding up the clock until the path fails to compute correctly
4 benefits of using back-scattering for HT detection
- Does not require trojan to be active
- Can detect small and fast switching HT activities
- Signal strength is not dependent on device/HT
- Can pick frequency => help with SNR
backscattering detection
- Use amplitude ratios from the spectrogram
- Ratios are used to normalize the signal since amplitude can change based on strength of our transmitter
- Use spectrogram so that we are not looking for one tiny blip in an entire run of a program
- Collect trace from non-HT chip to compare other traces to
how does activation size affect backscattering detection?
Easier to detect HT with larger activation size
how does payload size affect backscattering detection
it doesnt
how does HT location affect backscattering detection
easier to detect HT with triggers that are farther away from the rest of the circuit. payload location doesnt matter
power ranking of detection sc (esp for dormant trojans)
Backscatter»_space; EM»_space; Power
