4.10 Techniques for Hardware Trojan Design
399
Trojans by increasing the length of trigger sequence. In fact, these sequential hardware Trojans can be extremely small in size and hard-to-detect during normal prototype testing. Such hardware Trojans can also bypass final operations of microchip
testing even in full-scan mode.
4.10.1.1 Model of Functional Sequential Hardware Trojans
A sequential hardware Trojan can be represented as a finite state machine (FSM),
where the hardware Trojan trigger sequence is mapped to one of the rarely satisfied
paths in its state transition diagram. The general FSM-based model of a sequential
hardware Trojan is illustrated in Fig. 4.59a. The next state logic of the hardware
Trojan FSM depends on the occurrence of certain rare events, i.e., combinations
of rare logic values, in the internal nodes of the original circuit. The Trojan circuit
undergoes state transition under certain pre-defined rare events in the original circuit;
otherwise, the hardware Trojan will remain in the current “sleeping” state or go back
to the initial state if the expected rare event does not happen. The hardware Trojan
output is activated only upon reaching the final Trojan state (S T ), when it affects
the payload node compromising the normal operation of the original circuit. The
examples of various types of sequential hardware Trojans are presented below [244].
(1) Free-running/Enabled hardware Trojan of synchronous counter:
Figure. 4.60a shows a hardware Trojan of a k-bit synchronous counter
Fig. 4.59 Sequential hardware Trojan model (a) and Trojan state diagram (b)