Creation and Detection of Hardware Trojans Using Non-Invasive Off-The-Shelf Technologies
6. Discussion
provide a close up reading of the trojan in sleeping mode over a period of 10 min. Finally, Figure14c provides close up reading of the active trojan board over a period of 10 min As previously observed in Section5.6it is possible to notice an obvious difference in temperature between the trojan-free and trojan sleeping boards.
(a)
(b)
(c)
Figure 14. The set of Figure (a) from right to left represents the readings for the trojan free, sleeping and active respectively. The set of Figure (b) demonstrate a close up representation of the trojan free, sleeping and active on the board, while the set of Figure (c) provide close up temperature readings of the trojan active on the board over a period of 10 min.
Note that there is a difference between the readings of the heat gun and the heat camera of approximately 10◦C; we expect this to be due to the calibration of both the camera and the heat gun. While the camera had calibration options only a laboratory multi-point calibration can provide a high accuracy, moreover, the detector can experiences different temperatures due to ambient temperature changes and to the heat dissipation of the material. However, this does not make the results less relevant. The temperature difference remains constant across the devices and provides higher temperatures for trojan in sleep mode and in active mode.
The three tests required to provide readings between the trojan-inserted and trojan-free boards w to determine the existence of the trojan. In an industial setting, it is unlikely to suffice, however, the results presented in this paper provide evidence that trojans can be detected using off-the-shelf hardware due to the increase in accuracy of the devices and the access to technologies previously reserved to specialized industries, and which are now becoming commodities.
6.1. Thermal Camera
The thermal camera provided extensive results of the three stages of the trojan. This technique provides a good visual representation, demonstrating the presence of the trojan on the board. However, as aforementioned, in order for the camera to provide accurate results a trojan-free board is needed.
While this technique is accurate, when used as a stand-alone test it requires the camera to be well calibrated in order to provide the best results. In the setting presented in this manuscript, both the trojan taxonomy and its purpose where known, hence, during this white-box testing, the full calibration of the camera could be overlooked.
6.2. Heat Gun
The heat gun was able to demonstrate the presence of a a hardware trojan in different settings, while the heat gun was accurate enough to detect the temperature variation, as for the heat camera, this test requires to have free trojan board for comparison. As aforementioned, this is not uncommon for this type of work [30]. While the results provided by the heat gun are notable, they differ greatly from the thermal camera. It was expected from the start for the thermal camera to outperform the heat gun, due to the low accuracy of the heat gun.
6.3. Side Channel Analysis
The side channel analysis techniques was employed in attempts to locate the trojan whilst in its dormant form. Measurements were taken from several pins and capcitors during this process, whilst most of them showed little difference in reading only the C101 capacitor demonstrated a significant difference.
7. Conclusions
This work provides sharper bounds for the case of detection of hardware trojans using off-the-shelf devices, allowing to reduce the costs associated with trojan detection. The increasing number of devices being produced by untrusted foundries puts critical infrastructure at the center of attention. In this manuscript, we highlighted the dilemma of finding a one fits all solution to the problem finding hardware trojans fitting different taxonomies. To this end, we presented the corner stone for the detection of hardware trojans using off-the-shelf devices. We successfully demonstrated the ability of off-the-shelf devices to detect trojans in different settings, namely: sleeping and active. We believe that our practical work has the enormous potential in the successful detection of hardware trojans.
In the future we will aim at developing techniques to use thermal imaging for the detection of large scale hardware trojan infection and explore other trojan taxonomies in more intricate designs and with advanced malicious purposes. While we believe this technique is fully applicable to FPGAs, the technique might not be well suited for the denser ASICs and slight modifications might be required both in the methodology and in the off-the-shelf tool used. Moreover, we believe that this method could be used widely with the democratisation of specialised off-the-shelf hardware, following Moore’s law with a higher detection accuracy and better thermal imaging capabilities. Future work will compare the technique proposed against smaller known trojans and the process variation and manufacturing variation will be taken into account. Furthermore, the number of test vectors for Vivado power estimator will be increased in order to increase its accuracy.
Author Contributions: Conceptualization, C.R. and X.B.; Methodology, C.R. and X.B.; Software, C.R.;
Validation, C.R.; Formal Analysis, C.R.; Investigation, C.R., X.B. and A.S.; Resources, X.B.; Data Curation, C.R.; Writing—Original Draft Preparation, C.R.; Writing—Review & Editing, C.R., X.B. and A.S.; Visualization, C.R.; Supervision, X.B. and A.S.; Project Administration, X.B.
Funding: This research received no external funding.
Acknowledgments: The authors would like to thank Keysight Technologies for their valuable input and the oscilloscope used in this study.
Conflicts of Interest: The authors declare no conflict of interest.
References
1. Tehranipoor, M.; Koushanfar, F. A survey of hardware trojan taxonomy and detection. IEEE Des. Test Comput.
2010, 27. [CrossRef]
2. Huffmire, T.; Brotherton, B.; Sherwood, T.; Kastner, R.; Levin, T.; Nguyen, T.D.; Irvine, C. Managing security in FPGA-based embedded systems. IEEE Des. Test Comput. 2008, 25. [CrossRef]
3. Huffmire, T.; Irvine, C.; Nguyen, T.D.; Levin, T.; Kastner, R.; Sherwood, T. Handbook of FPGA Design Security;
Springer Science & Business Media: Berlin/Heidelberg, Germany, 2010.
4. Akram, R.N.; Markantonakis, K.; Holloway, R.; Kariyawasam, S.; Ayub, S.; Seeam, A.; Atkinson, R.
Challenges of security and trust in avionics wireless networks. In Proceedings of the 2015 IEEE/AIAA 34th Digital Avionics Systems Conference (DASC), Prague, Czech Republic, 13–17 September 2015; p. 4B1-1.
5. Omoogun, M.; Ramsurrun, V.; Guness, S.; Seeam, P.; Bellekens, X.; Seeam, A. Critical patient eHealth monitoring system using wearable sensors. In Proceedings of the 2017 1st International Conference on Next Generation Computing Applications (NextComp), Mauritius, 19–21 July 2017; pp. 169–174. [CrossRef]
6. Bellekens, X.; Seeam, A.; Nieradzinska, K.; Tachtatzis, C.; Cleary, A.; Atkinson, R.; Andonovic, I.
Cyber-physical-security model for safety-critical iot infrastructures. In Proceedings of the Wireless World Research Forum Meeting, Santa Clara, CA, USA, 21–23 April 2015.
7. Robinson, W.H.; Reece, T.; Mahatme, N.N. Addressing the challenges of hardware assurance in reconfigurable systems. In Proceedings of the International Conference on Engineering of Reconfigurable Systems and Algorithms (ERSA). The Steering Committee of The World Congress in Computer Science, Computer Engineering and Applied Computing (WorldComp), Las Vegas, NV, USA, 22–25 July 2013; p. 1.
8. Department of Justice Press Release. VisionTech Administrator Sentenced to Prison for Role in Sales of Counterfeit Circuits Destined to US Military. Available online: https://www.ice.gov/news/
releases/visiontech-administrator-sentenced-prison-role-sales-counterfeit-circuits-destined-us(accessed on 17 September 2017).
9. Mitra, S.; Wong, H.S.P.; Wong, S. Stopping hardware Trojans in their tracks. IEEE Spectr. 2015. Available online: https://spectrum.ieee.org/semiconductors/design/stopping-hardware-trojans-in-their-tracks (accessed on 22 July 2018).
10. Narasimhan, S.; Du, D.; Chakraborty, R.S.; Paul, S.; Wolff, F.; Papachristou, C.; Roy, K.; Bhunia, S.
Multiple-parameter side-channel analysis: A non-invasive hardware Trojan detection approach.
In Proceedings of the 2010 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), Anaheim, CA, USA, 13–14 June 2010; pp. 13–18.
11. Cao, C.; Guan, L.; Liu, P.; Gao, N.; Lin, J.; Xiang, J. Hey, you, keep away from my device: Remotely implanting a virus expeller to defeat Mirai on IoT devices. arXiv 2017, arXiv:1706.05779.
12. Pyrgas, L.; Pirpilidis, F.; Panayiotarou, A.; Kitsos, P. Thermal Sensor Based Hardware Trojan Detection in FPGAs. In Proceedings of the 2017 Euromicro Conference on Digital System Design (DSD), Vienna, Austria, 30 August–1 September 2017; pp. 268–273.
13. Nowroz, A.N.; Hu, K.; Koushanfar, F.; Reda, S. Novel Techniques for High-Sensitivity Hardware Trojan Detection Using Thermal and Power Maps. IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst. 2014, 33, 1792–1805. [CrossRef]
14. Forte, D.; Bao, C.; Srivastava, A. Temperature tracking: An innovative run-time approach for hardware Trojan detection. In Proceedings of the 2013 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), San Jose, CA, USA, 18–21 November 2013; pp. 532–539. [CrossRef]
15. He, J.; Zhao, Y.; Guo, X.; Jin, Y. Hardware Trojan Detection Through Chip-Free Electromagnetic Side-Channel Statistical Analysis. IEEE Trans. Very Large Scale Integr. (VLSI) Syst. 2017, 25, 2939–2948. [CrossRef]
16. Shende, R.; Ambawade, D.D. A side channel based power analysis technique for hardware trojan detection using statistical learning approach. In Proceedings of the 2016 Thirteenth International Conference on Wireless and Optical Communications Networks (WOCN), Hyderabad, India, 21–23 July 2016; pp. 1–4.
[CrossRef]
17. Xiao, K.; Forte, D.; Jin, Y.; Karri, R.; Bhunia, S.; Tehranipoor, M. Hardware Trojans: Lessons learned after one decade of research. ACM Trans. Des. Autom. Electron. Syst. (TODAES) 2016, 22, 6. [CrossRef]
18. Kumar, R. Fabless Semiconductor Implementation; McGraw-Hill, Inc.: New York, NY, USA, 2008.
19. Adee, S. The hunt for the kill switch. IEEE Spectr. 2008, 45, 34–39. [CrossRef]
20. Yeh, A. Trends in the global IC design service market. DIGITIMES Res. 2012. Available online:https:
//www.digitimes.com/news/a20120313RS400.html?chid=2(accessed on 22 July 2018).
21. Abramovici, M.; Bradley, P. Integrated circuit security: New threats and solutions. In Proceedings of the 5th Annual Workshop on Cyber Security and Information Intelligence Research: Cyber Security and Information Intelligence Challenges and Strategies, Knoxville, TN, USA, 13–15 April 2009; p. 55.
22. Chakraborty, R.S.; Narasimhan, S.; Bhunia, S. Hardware Trojan: Threats and emerging solutions.
In Proceedings of the High Level Design Validation and Test Workshop (HLDVT), San Francisco, CA, USA, 4–6 November 2009; pp. 166–171.
23. Collins, D.R. Trust in Integrated Circuits; Technical Report; Defense Advanced Research Projects Agency Arlington Va Microsystems Technology Office: Arlington, VA, USA, 2008.
24. Wolff, F.; Papachristou, C.; Bhunia, S.; Chakraborty, R.S. Towards Trojan-free trusted ICs: Problem analysis and detection scheme. In Proceedings of the Conference on Design, Automation and Test in Europe, Munich, Germany, 10–14 March 2008; pp. 1362–1365.
25. Sanno, B. Detecting Hardware Trojans; Ruhr-University: Bochum, Germany, 2009.
26. Banga, M.; Hsiao, M.S. A region based approach for the identification of hardware Trojans. In Proceedings of the 2008 IEEE International Workshop on Hardware-Oriented Security and Trust (HOST), Anaheim, CA, USA, 9 June 2008; pp. 40–47.
27. Jin, Y.; Makris, Y. Hardware Trojan detection using path delay fingerprint. In Proceedings of the 2008 IEEE International Workshop on Hardware-Oriented Security and Trust (HOST), Anaheim, CA, USA, 9 June 2008;
pp. 51–57.
28. Wang, L.W.; Luo, H.W. A power analysis based approach to detect Trojan circuits. In Proceedings of the 2011 International Conference on Quality, Reliability, Risk, Maintenance, and Safety Engineering, Xi’an, China, 17–19 June 2011; pp. 380–384. [CrossRef]
29. Digilent Basys 3 Artix7 FPGA Board. Available online:https://reference.digilentinc.com/_media/basys3:
basys3_sch.pdf(accessed on 7 July 2018).
30. Bao, C.; Forte, D.; Srivastava, A. Temperature tracking: Toward robust run-time detection of hardware Trojans. IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst. 2015, 34, 1577–1585. [CrossRef]
2018 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open accessc article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).
electronics
Article