400
4 Hardware Trojans in Microcircuits
Fig. 4.60 Four examples of sequential hardware Trojan design: k-bit synchronous counter (a);
k-bit asynchronous counter (b); hybrid counter (c); rarely triggered FSM (d)
with or without an enable signal. A synchronous free-running counter works
like a time bomb where there is no event-dependent trigger condition.
The hardware Trojan will get triggered, independent of the operation of the original
circuit, and the only design parameter preset by an intruder is the time duration
for activation of the Trojan (referred to as “time-to-trigger”). This parameter has a
deterministic time-to-trigger 2k − 1 clock cycles, where k is the number of state
elements in the counter. The weakness of this type of hardware Trojan is the large
area/power overhead required in order to guarantee a certain trigger time. By using
rare nodes of the original circuit to generate an enable signal for the counter, it is
possible to lower the trigger probability and thus greatly increase the time-to-trigger
for the same area overhead.
(2) Asynchronous counter hardware Trojan: The asynchronous counter-based
hardware Trojan uses an internal signal as the clock for counting the occurrences of a rare event. As the example shown in Fig. 4.60b, p and q are two rare
internal nodes in the original circuit, both of which have the rare logic value
equal to 1. Therefore, implementation of “AND operation” for p and q creates
a signal that seldom switches from 0 to 1, and thus it can be used as a clock
signal for the counter. By proper choice of the rare events, one can ensure an
extremely large time-to-trigger.
(3) Hybrid counter hardware Trojan: To further lower trigger probability of the
hardware Trojan, a hybrid counter Trojan model is developed as demonstrated
in Fig. 4.60c. It contains multiple cascaded counters, where the counters can be
synchronous or asynchronous, with the clock of the second counter depending
4 Hardware Trojans in Microcircuits
Fig. 4.60 Four examples of sequential hardware Trojan design: k-bit synchronous counter (a);
k-bit asynchronous counter (b); hybrid counter (c); rarely triggered FSM (d)
with or without an enable signal. A synchronous free-running counter works
like a time bomb where there is no event-dependent trigger condition.
The hardware Trojan will get triggered, independent of the operation of the original
circuit, and the only design parameter preset by an intruder is the time duration
for activation of the Trojan (referred to as “time-to-trigger”). This parameter has a
deterministic time-to-trigger 2k − 1 clock cycles, where k is the number of state
elements in the counter. The weakness of this type of hardware Trojan is the large
area/power overhead required in order to guarantee a certain trigger time. By using
rare nodes of the original circuit to generate an enable signal for the counter, it is
possible to lower the trigger probability and thus greatly increase the time-to-trigger
for the same area overhead.
(2) Asynchronous counter hardware Trojan: The asynchronous counter-based
hardware Trojan uses an internal signal as the clock for counting the occurrences of a rare event. As the example shown in Fig. 4.60b, p and q are two rare
internal nodes in the original circuit, both of which have the rare logic value
equal to 1. Therefore, implementation of “AND operation” for p and q creates
a signal that seldom switches from 0 to 1, and thus it can be used as a clock
signal for the counter. By proper choice of the rare events, one can ensure an
extremely large time-to-trigger.
(3) Hybrid counter hardware Trojan: To further lower trigger probability of the
hardware Trojan, a hybrid counter Trojan model is developed as demonstrated
in Fig. 4.60c. It contains multiple cascaded counters, where the counters can be
synchronous or asynchronous, with the clock of the second counter depending