Efficient Hardware Trojan Detection with Differential Cascade Voltage Switch Logic

Offshore fabrication, assembling and packaging challenge chip security, as original chip designs may be tampered by malicious insertions, known as hardware Trojans (HTs). HT detection is imperative to guarantee the chip performance and safety. Existing HT detection methods have limited capability to detect small-scale HTs and are further challenged by the increased process variation. To increase HT detection sensitivity and reduce chip authorization time, we propose to exploit the inherent feature of differential cascade voltage switch logic (DCVSL) to detect HTs at runtime. In normal operation, a system implemented with DCVSL always produces complementary logic values in internal nets and final outputs. Noncomplementary values on inputs and internal nets in DCVSL systems potentially result in abnormal power behavior and even system failures. By examining special power characteristics of DCVSL systems upon HT insertion, we can detect HTs, even if the HT size is small. Simulation results show that the proposed method achieves up to 100% HT detection rate. The evaluation on ISCAS benchmark circuits shows that the proposed method obtains a HT detection rate in the range of 66% to 98%. 1. Introduction The growing number of ICs manufactured offshore increases the threats to chip security [1–3]. Research has exposed an increase in existence of hardware Trojans (HTs), which are malicious additions or modifications to the circuit design that alter the original function. Malicious inclusions of hardware have the potential to degrade system performance, surreptitiously delete data, leave a backdoor for secret key leaking, or eventually destroy the chip [4, 5]. It is imperative to detect HTs. HTs can be detected by destructive approaches such as the chemical mechanical polishing (CMP) method. The CMP approach detects HTs by analyzing pictures of the demetalized chips under an electron microscope [6]. In addition to being expensive, this type of technique is also time consuming (takes several months) and loses its efficiency when the transistor density increases. Nondestructive HT detection methods are broadly classified into two categories: logic testing and side-channel analysis (SCA) approaches [6]. Automatic test pattern generation (ATPG) approaches examine whether the measured outputs match the expected one for given inputs and work well for a functional unit with a small set of inputs, as the probability of rare events is relatively high. When the circuit complexity increases, the number of test vectors for ATPG will significantly increase to an unaffordable