Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Hardware Trojan
open-in-new
<h2 id="background">Background</h2> <p>In a diverse global economy, <a href="/facts/Outsourcing/qa3WgJ7u">outsourcing</a> of production tasks is a common way to lower a product's cost. Embedded hardware devices are not always produced by the firms that design and/or sell them, nor in the same country where they will be used. Outsourced manufacturing can raise doubt about the <a href="/facts/Chain_of_custody/Rbe2focv">evidence</a> for the integrity of the manufactured product (i.e., one's certainty that the end-product has no design modifications compared to its original design). Anyone with access to the manufacturing process could, in theory, introduce some change to the final product. For complex products, small changes with large effects can be difficult to detect. </p><p>The threat of a serious, malicious, design alteration can be especially relevant to government agencies. Resolving doubt about hardware integrity is one way to reduce <a href="/facts/Technology/9Uav5WVR">technology</a> vulnerabilities in the <a href="/facts/Military/kgNmLUnN">military</a>, <a href="/facts/Finance/fLh1GgN8">finance</a>, <a href="/facts/Energy/wd8PrQM7">energy</a> and political sectors of an <a href="/facts/Economy/okLWSsEY">economy</a>. Since fabrication of <a href="/facts/Integrated_circuits/fjn6vg7C">integrated circuits</a> in untrustworthy factories is common, advanced detection techniques have emerged to discover when an adversary has hidden additional components in, or otherwise <a href="/facts/Sabotage/R7IXqV4e">sabotaged</a>, the circuit's function. </p> <h2 id="characterization-of-hardware-trojans">Characterization of hardware Trojans</h2> <p>An HT can be characterized by several methods such as by its physical representation, activation phase and its action phase. Alternative methods characterize the HT by trigger, payload and stealth. </p> <h3>Physical characteristics</h3> <p>One of this physical Trojan characteristics is the type. The type of a Trojan can be either functional or parametric. A Trojan is functional if the adversary adds or deletes any <a href="/facts/Transistor/Bmr8zwL0">transistors</a> or <a href="/facts/Logic_gate/RHLulvKI">gates</a> to the original chip design. The other kind of Trojan, the parametric Trojan, modifies the original circuitry, e.g. thinning of wires, weakening of flip-flops or transistors, subjecting the chip to radiation, or using Focused Ion-Beams (FIB) to reduce the reliability of a chip. </p><p>The size of a Trojan is its physical extension or the number of components it is made of. Because a Trojan can consist of many components, the designer can distribute the parts of a malicious logic on the chip. The additional logic can occupy the chip wherever it is needed to modify, add, or remove a function. Malicious components can be scattered, called loose distribution, or consist of only few components, called tight distribution, so the area is small where the malicious logic occupies the layout of the chip. </p><p>In some cases, high-effort adversaries in may regenerate the layout so that the placement of the components of the IC is altered. In rare cases the chip dimension is altered. These changes are structural alterations. </p> <h3>Activation characteristics</h3> <p>The typical Trojan is condition-based: It is triggered by <a href="/facts/Sensors/RN8SXbjs">sensors</a>, internal logic states, a particular input pattern or an internal counter value. Condition-based Trojans are detectable with power traces to some degree when inactive. That is due to the leakage currents generated by the trigger or counter circuit activating the Trojan. </p><p>Hardware Trojans can be triggered in different ways. A Trojan can be internally activated, which means it monitors one or more signals inside the <a href="/facts/Integrated_circuit/fjn6vg7C">IC</a>. The malicious circuitry could wait for a count down logic an attacker added to the chip, so that the Trojan awakes after a specific time-span. The opposite is externally activated. There can be malicious logic inside a chip, that uses an <a href="/facts/Antenna_(radio)/pGlcXBvc">antenna</a> or other sensors the adversary can reach from outside the chip. For example, a Trojan could be inside the control system of a cruising <a href="/facts/Missile/C5VwQClz">missile</a>. The owner of the missile does not know, that the enemy will be able to switch off the rockets by <a href="/facts/Radio/XFr909M2">radio</a>. </p><p>A Trojan which is always-on can be a reduced wire. A chip that is modified in this way produces errors or fails every time the wire is used intensely. <a href="/facts/Always-on/y3J8GnEo">Always-on circuits</a> are hard to detect with power trace. </p><p>In this context <a href="/facts/Combinational_logic/L1kaaVK5">combinational</a> Trojans and <a href="/facts/Sequential_logic/Rcs4thlu">sequential</a> Trojans are distinguished. A combinational Trojan monitors internal signals until a specific condition happens. A sequential Trojan is also an internally activated condition-based circuit, but it monitors the internal signals and searches for sequences not for a specific state or condition like the combinational Trojans do. </p> <h4>Cryptographic key extraction</h4> <p>Extraction of secret keys by means of a hardware Trojan without detecting the Trojan requires that the Trojan uses a random signal or some <a href="/facts/Cryptography/e94PEVau">cryptographic</a> implementation itself. </p><p>To avoid storing a cryptographic key in the Trojan itself and reduction, a <a href="/facts/Physical_unclonable_function/eTecxwfJ">physical unclonable function</a> can be used.<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a> Physical unclonable functions are small in size and can have an identical layout while the cryptographic properties are different. </p> <h3>Action characteristics</h3> <p>A HT could modify the chip's function or could change the chip's parametric properties (e.g. provokes a process delay). Confidential information can also be transmitted to the adversary (transmission of key information). </p> <h3>Peripheral device hardware Trojans</h3> <p>A relatively new threat vector to networks and network endpoints is a HT appearing as a physical <a href="/facts/Peripheral/3lEBPE14">peripheral</a> device that is designed to interact with the network endpoint using the approved peripheral device's communication protocol. For example, a <a href="/facts/USB/XcIKWLyg">USB</a> keyboard that hides all malicious processing cycles from the target network endpoint to which it is attached by communicating with the target network endpoint using unintended USB channels. Once sensitive data is ex-filtrated from the target network endpoint to the HT, the HT can process the data and decide what to do with the data: store the data to memory for later physical retrieval of the HT or possibly ex-filtrate the data to the internet using wireless or using the compromised network endpoint as a pivot.<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a><a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> </p> <h2 id="potential-of-threat">Potential of threat</h2> <p>A common Trojan is passive most of the time-span an altered device is in use. If a Trojan is activated the device functionality can be changed, the device can be destroyed or disabled, the device can leak confidential information or the HT may tear down the security and safety of the device. Trojans are stealthy, to avoid detection of the Trojan the precondition for activation is a very rare event. Traditional testing techniques are not sufficient. A manufacturing fault happens at a random position while malicious changes are well placed to avoid detection. </p> <h2 id="detection">Detection</h2> <h3>Physical inspection</h3> <p>First, the molding coat is cut to reveal the circuitry. Then, the engineer repeatedly scans the surface while grinding the layers of the chip. There are several operations to scan the circuitry. Typical visual inspection methods are: scanning optical microscopy (SOM), <a href="/facts/Scanning_electron_microscopy/yzK0hsSx">scanning electron microscopy</a> (SEM),<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a> pico-second imaging circuit analysis (PICA), voltage contrast imaging (VCI), <a href="/facts/Light_induced_voltage_alteration/EI89fkfH">light induced voltage alteration</a> (LIVA) or <a href="/facts/Charge_induced_voltage_alteration/vKWaF4Nh">charge induced voltage alteration</a> (CIVA). To compare the floor plan of the chip has to be compared with the image of the actual chip. This is still quite challenging to do. To detect Trojan hardware which include (crypto) keys which are different, an image diff can be taken to reveal the different structure on the chip. The only known hardware Trojan using unique crypto keys but having the same structure is.<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a> This property enhances the undetectability of the Trojan. </p> <h3>Functional testing</h3> <p>This detection method stimulates the input ports of a chip and monitors the output to detect manufacturing faults. If the logic values of the output do not match the genuine pattern, then a defect or a Trojan could be found. </p> <h3>Built-in tests</h3> <p><a href="/facts/Built-in_self-test/gLgshIsB">Built-in self-test</a> (BIST) and <a href="/facts/Design_For_Test/wGKySXgc">Design For Test</a> (DFT) techniques add circuitry (logic) to the chip intended to help verify that the chip, as built, implements its functional specification. The extra logic monitors input stimulus and internal signals or memory states, generally by computing <a href="/facts/Checksum/AqxQ0I8g">checksums</a> or by exposing internal registers via a customized <a href="/facts/Scan_chain/MNsFp5Py">scanning technique</a>. Where DFT usually coordinates with some external testing mechanism, BIST-enabled chips incorporate custom test-pattern generators. BIST functionality often exists to perform at-speed (high speed) verification where it is not possible to use scan chains or other low-speed DFT capabilities. Both methods were originally developed to detect manufacturing errors, but also have the double-edged potential to detect some effects of malicious logic on the chip, or to be exploited by malicious logic to covertly inspect remote state within the chip. </p><p>Consider how DFT recognizes unintended logic. When driven by DFT inputs, a genuine chip generates a familiar signature, but a defective or altered chip displays an unexpected signature. The signature may consist of any number of data outputs from the chip: an entire scan chain or intermediate data result. In a Trojan-detection context, DFT logic may be regarded as an encryption algorithm: using the DFT input as key to sign a message derived from the behavior of the design under test. In an intrusion-avoidance context, BIST or DFT functions are typically disabled (by hardware-reconfiguration) outside of a manufacturing environment because their access to the chip's internal state can expose its function to covert surveillance or subversive attack. </p> <h3>Side channel analyses</h3> <p>Every device that is electrically active emits different signals like magnetic and electric fields. Those signals – that are caused by the electric activity, can be analyzed to gain information about the state and the data which the device processes. Advanced methods to measure these side-effects have been developed and they are very sensitive (<a href="/facts/Side-channel_attack/2B1dfBty">side-channel attack</a>). Hence, it is possible to detect tightly coupled Trojans via measurement of these analog signals. The measured values can be used as a signature for the analyzed device. It is also common that a set of measured values is evaluated to avoid measurement errors or other inaccuracies.<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> </p> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/FDIV/6mYzpbF1">FDIV</a></li> <li><a href="/facts/Hardware_backdoor/wFlqTCtv">Hardware backdoor</a></li> <li><a href="/facts/Hardware_obfuscation/weq1HWT2">Hardware obfuscation</a></li> <li><a href="/facts/Hardware_security/lqFh2qIL">Hardware security</a></li> <li><a href="/facts/Kill_switch/oymcV71g">Kill switch</a></li> <li><a href="/facts/Physical_unclonable_function/eTecxwfJ">Physical unclonable function</a> (PUF)</li> <li><a href="/facts/Security_switch/e4dlYRKN">Security switch</a></li> <li><a href="/facts/Intel_Management_Engine/4fwrBrGe">Intel Management Engine</a></li></ul> <h2 id="further-reading">Further reading</h2> <ul><li>Mainak Banga and Michael S. Hsiao: A Region Based Approach for the Identification of Hardware Trojans, Bradley Department of Electrical and Computer Engineering, Virginia Tech., Host'08, 2008</li> <li>A. L. D’Souza and M. Hsiao: Error diagnosis of sequential circuits using region-based model, Proceedings of the IEEE VLSI Design Conference, January, 2001, pp. 103–108.</li> <li>C. Fagot, O. Gascuel, P. Girard and C. Landrault: On Calculating Efficient LFSR Seeds for Built-In Self Test, Proc. Of European Test Workshop, 1999, pp 7–14</li> <li>G. Hetherington, T. Fryars, N. Tamarapalli, M. Kassab, A. Hassan and J. Rajski: Logic BIST for large industrial designs, real issues and case studies, ITC, 1999, pp. 358–367</li> <li>W. T. Cheng, M. Sharma, T. Rinderknecht and C. Hill: Signature Based Diagnosis for Logic BIST, ITC 2006, Oct. 2006, pp. 1–9</li> <li>Rajat Subhra Chakraborty, Somnath Paul and Swarup Bhunia: On-Demand Transparency for Improving Hardware Trojan Detectability, Department of Electrical Engineering and Computer Science, Case Western Reserve University, Cleveland, OH, USA</li> <li>Yier Jin and Yiorgos Makris: Hardware Trojan Detection Using Path Delay Fingerprint, Department of Electrical Engineering Yale University, New Haven</li> <li>Reza Rad, Mohammad Tehranipoor and Jim Plusquellic: Sensitivity Analysis to Hardware Trojans using Power Supply Transient Signals, 1st IEEE International Workshop on Hardware-Oriented Security and Trust (HOST'08), 2008</li> <li><a href="/facts/Dakshi_Agrawal/KJF2EGgV">Dakshi Agrawal</a>, Selcuk Baktir, Deniz Karakoyunlu, Pankaj Rohatgi and Berk Sunar: Trojan Detection using IC Fingerprinting, IBM T.J. Watson Research Center, Yorktown Heights, Electrical \& Computer Engineering Worcester Polytechnic Institute, Worcester, Massachusetts, Nov 10, 2006</li> <li>P. Song, F. Stellari, D. Pfeiffer, J. Culp, A. Weger, A. Bonnoit, B. Wisnieff, T. Taubenblatt: MARVEL - Malicious Alteration Recognition and Verification by Emission of Light, IEEE Int. Symp. on Hardware-Oriented Security and Trust (HOST), pp. 117–121, 2011</li> <li>Xiaoxiao Wang, Mohammad Tehranipoor and Jim Plusquellic: Detecting Malicious Inclusions in Secure Hardware, Challenges and Solutions, 1st IEEE International Workshop on Hardware-Oriented Security and Trust (HOST'08), 2008</li> <li>Miron Abramovici and Paul Bradley: Integrated Circuit Security - New Threats and Solutions</li> <li>Zheng Gong and Marc X. Makkes: Hardware Trojan Side-channels Based on Physical Unclonable Functions - Information Security Theory and Practice. Security and Privacy of Mobile Devices in Wireless Communication 2011, Lecture Notes in Computer Science 6633, P294-303.</li> <li>Vasilios Mavroudis, Andrea Cerulli, Petr Svenda, Dan Cvrcek, Dusan Klinec, George Danezis. A Touch of Evil: High-Assurance Cryptographic Hardware from Untrusted Components. 24th ACM Conference on Computer and Communications Security, Dallas, TX, Oct 30th-Nov 3rd 2017.</li> <li>Xinmu Wang, HARDWARE TROJAN ATTACKS: THREAT ANALYSIS AND LOW-COST COUNTERMEASURES THROUGH GOLDEN-FREE DETECTION ANDSECURE DESIGN, CASE WESTERN RESERVE UNIVERSITY.</li></ul> <h2 id="external-links">External links</h2> <ul><li><a href="http://tehranipoor.ece.ufl.edu/09%20Hardware%20Trojans.pdf">'Hardware Trojan Lecture - University of Florida'</a> <a href="https://web.archive.org/web/20200717091635/http://tehranipoor.ece.ufl.edu/09%20Hardware%20Trojans.pdf">Archived</a> July 17, 2020, at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a></li> <li><a href="http://www.trust-hub.org/">'Trust-hub' website</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Detecting Hardware Trojans with GateLevel InformationFlow Tracking, Wei Hu et al, IEEE publication, 2015 <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Detecting Hardware Trojans with GateLevel InformationFlow Tracking, Wei Hu et al, IEEE publication, 2015 <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>Building Trojan Hardware at Home, BlackHat Asia 2014 <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>Zeng Gong and Marc X. Makkes "Hardware Trojan side-channels based on physical unclonable functions", WISTP 2011, LNCS 6633 pp.293-303 doi:10.1007/978-3-642-21040-2_21 <a href="/wiki/Doi_(identifier)" target="_blank">/wiki/Doi_(identifier)</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>J. Clark, S. Leblanc, S. Knight, Compromise through USB-based Hardware Trojan device, Future Generation Computer Systems (2010) (In Press). doi:10.1016/j.future.2010.04.008 <a href="/wiki/Doi_(identifier)" target="_blank">/wiki/Doi_(identifier)</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>John Clark, Sylvain Leblanc, Scott Knight, "Hardware Trojan Device Based on Unintended USB Channels," Network and System Security, International Conference on, pp. 1-8, 2009 Third International Conference on Network and System Security, 2009. doi:10.1109/NSS.2009.48 <a href="/wiki/Doi_(identifier)" target="_blank">/wiki/Doi_(identifier)</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>Swapp, Susan. "Scanning Electron Microscopy (SEM)". University of Wyoming. <a href="http://serc.carleton.edu/research_education/geochemsheets/techniques/SEM.html" target="_blank">http://serc.carleton.edu/research_education/geochemsheets/techniques/SEM.html</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>Zeng Gong and Marc X. Makkes "Hardware Trojan side-channels based on physical unclonable functions", WISTP 2011, LNCS 6633 pp.293-303 doi:10.1007/978-3-642-21040-2_21 <a href="/wiki/Doi_(identifier)" target="_blank">/wiki/Doi_(identifier)</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>Tehranipoor, Mohammad; Koushanfar, Farinaz (2010). "A Survey of Hardware Trojan Taxonomy and Detection". IEEE Design & Test of Computers. 27: 10–25. doi:10.1109/MDT.2010.7. S2CID 206459491. <a href="/wiki/Doi_(identifier)" target="_blank">/wiki/Doi_(identifier)</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> </ol>