A Pragmatic Methodology for Blind Hardware Trojan Insertion in Finalized Layouts
Alexander Hepp, Tiago Perez, Samuel Pagliarini, Georg Sigl

TL;DR
This paper presents a pragmatic framework for inserting and analyzing hardware trojans in finalized IC layouts, demonstrating the feasibility of covert attacks with minimal impact on circuit performance.
Contribution
It introduces an advanced methodology for blind HT insertion into finalized layouts using ECO flow and reverse-engineering, providing a comprehensive tool for vulnerability assessment.
Findings
Covert HT insertion is possible even in high-density designs.
Minimal power and performance impact during trojan insertion.
Placement alone is insufficient to assess HT vulnerability.
Abstract
A potential vulnerability for integrated circuits (ICs) is the insertion of hardware trojans (HTs) during manufacturing. Understanding the practicability of such an attack can lead to appropriate measures for mitigating it. In this paper, we demonstrate a pragmatic framework for analyzing HT susceptibility of finalized layouts. Our framework is representative of a fabrication-time attack, where the adversary is assumed to have access only to a layout representation of the circuit. The framework inserts trojans into tapeout-ready layouts utilizing an Engineering Change Order (ECO) flow. The attacked security nodes are blindly searched utilizing reverse-engineering techniques. For our experimental investigation, we utilized three crypto-cores (AES-128, SHA-256, and RSA) and a microcontroller (RISC-V) as targets. We explored 96 combinations of triggers, payloads and targets for our…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
