A LAYOUT-AWARE APPROACH FOR IMPROVING LOCALIZED SWITCHING TO DETECT HARDWARE TROJANS IN INTEGRATED CIRCUITS

Transcription

1 A LAYOUT-AWARE APPROACH FOR IMPROVING LOCALIZED SWITCHING TO DETECT HARDWARE TROJANS IN INTEGRATED CIRCUITS Hssn Slmni, Mohmmd Tehrnipoor ECE Deprtment University of Connecticut {slmni Jim Plusquellic ECE Deprtment University of New Mexico ABSTRACT Mlicious ctivities nd ltertions to integrted circuits hve rised serious concerns to government gencies nd the semiconductor industry. The dded functionlity, known s hrdwre Trojn, poses mjor detection nd isoltion chllenges. In this pper, we present method to loclize design switching to ny specific region independent from test ptterns. The new rchitecture llows ctivting ny trget region nd keeping others quiet which reduces totl circuit switching ctivity. This helps mgnify the Trojn s contribution to the totl circuit trnsient power by incresing Trojn-to-circuit switching ctivity (TCA) nd power consumption. The proposed method is imed t improving the efficiency of power-bsed side-chnnel signl nlysis techniques for detecting hrdwre Trojns. Our simultion results demonstrte the efficiency of the method in significntly incresing TCA. Index Terms Hrdwre Security, Trojn Detection, Trojnto-Circuit Activity, Scn-cell Reordering 1. INTRODUCTION Design nd fbriction of Integrted Circuits (ICs) re becoming incresingly vulnerble to mlicious ctivities nd ltertions with globliztion. These vulnerbilities hve rised serious concerns regrding possible threts to mny criticl pplictions. Responsible for design or fbriction, the third prty cn mliciously chnge the design before fbriction by inserting extr logic, clled hrdwre Trojn. Hrdwre Trojns im to fil the design in the field or trnsmit secret dt to the dversry [1][2]. Therefore, confidence in imported products is serious concern especilly in mission-criticl pplictions. Hving the knowledge of IC fbriction nd testing, n dversry cn design Trojn tht cnnot be ctivted nd detected with trditionl functionl nd structurl tests. However, side-chnnel signl nlysis techniques over trnsient power hve proven to be highly effective in extrcting informtion bout the internl opertion of designs [3][4]. In power-bsed side-chnnel signl nlysis, it is possible to extrct the Trojn signl by monitoring power * THIS WORK WAS SUPPORTED IN PART BY NATIONAL SCIENCE FOUNDATION GRANTS CNS AND CNS pds/ports even in the presence of vrious types of noise, including mesurement noise, mbient noise, nd other rndom signl vritions tht mnifest themselves during the circuit opertion. Although pproches such s circuit dely nlysis, full ctivtion of Trojns, rndomiztion-bsed probbilistic nlysis, nd extrcting design chrcteristics re presented for hrdwre Trojn detection [5][6][7][8][9][1][11], in this pper, we focus on the methods tht use trnsient power signls nd perform switching ctivity nlysis to trget hrdwre Trojns in integrted circuits [3][12][13][14][16]. The methods tht nlyze circuit trnsient power depend strongly on the effectiveness of ptterns to mgnify Trojn contribution to circuit power consumption. Authors in [12] present method to generte power fingerprint of genuine ICs considering vrious types of noise in the circuit. Rndom ptterns re pplied to IC-Under-Authentiction (IUA) to generte mesurble difference between the power profiles of the genuine IC nd IUA. However, its effectiveness is limited when trgeting smll Trojns. The proposed method in [13] is bsed on nlyzing locl trnsient current from power ports on the trget chip. To llevite the impct of process vritions during mesurement, clibrtion step is performed for ech IUA before ctul mesurement. Trojn-inserted designs re distinguished using outlier nlysis. However, the cpbility of the method is not evluted for smll Trojn circuits in lrge designs. A multiple supply trnsient current integrtion method to detect hrdwre Trojns in IUA is presented in [14]. The current is mesured loclly from vrious power pds or controlled collpse chip connections (C4s) on the die. Rndom ptterns re pplied to increse the switching in the circuit in test-per-clock fshion [17]. In [15], circuit is divided into regions consisting of number of flip-flops nd other components in specific rdius from the flip-flops. Rndomly generted ptterns re grouped bsed on generting high switching ctivity in region while keeping the rest of circuit t low ctivity. The method is not lyout-wre nd does not consider the distribution of switching ctivity cross the lyout of circuit in prctice. In [16], the uthors present sustined vector technique. A vector is pplied to the circuit, nd for severl clock cycles (up to 25) primry inputs re kept intct. Stte bits (flip-flops) supply trnsitions in the circuit, nd fter some clock cycles it is expected ctivities converge to specific portion

2 of the circuit. Applying the next vector would trget nother portion of the circuit. Authors in [11] proposed technique to eliminte the rre triggering conditions in circuits by dding dummy scn flip-flops to improve the controllbility of the low trnsition probbility nodes. Finlly, uthors in [18] present txonomy for Trojns nd discuss the issues relted to hrdwre Trojn detection nd isoltion. To void esy detection, n dversry cn design the Trojns to hve little impct on circuit power. Developing pttern genertion strtegy to loclize switching nd reduce the bckground noise (i.e. circuit noise) is n extremely chllenging tsk. In this work, we propose design technique tht helps loclize switching in the circuit without ny requirement to ny specific pttern set. Regionl ctivtion to limit trnsitions to trget region of the circuit while keeping other regions quiet would be n effective wy to increse the rtio of Trojn-to-circuit power consumption. The methods proposed in [12][13][14][16] cn be significntly enhnced when combined with our switching ctivity locliztion technique Contributions nd Pper Orgniztion In generl, scn chins provide incresed controllbility for the circuit-under-test [17]. It hs been demonstrted tht there is high correltion between switching ctivities in the internl nodes of circuit nd the trnsitions tking plce in scn cells [19]. The Trojn contribution to circuit power consumption cn be miniml considering the circuits high switching ctivity during functionl, test, or uthentiction modes. All the previously proposed powerbsed signl nlysis methods to detect Trojns lck n efficient loclizing trnsition genertion strtegy. In this pper, new scncell reordering method is proposed to loclize switching ctivity in n IUA. The proposed method is lyout-wre nd cn effectively restrict switching ctivity within trget region. Simultion results show tht by prtilly ctivting circuit (i.e. the trget region experiences switching while other regions re kept quiet), it is possible to considerbly increse the rtio of Trojn-to-circuit ctivity (TCA). Our method is ble to increse TCA by significntly reducing circuit switching ctivity (lso clled bckground noise). Note tht in this work we do not ssume to hve ny knowledge of the size, type nd loction of Trojns in circuit. Also, note tht the dversry will not be ble to evde the uthentiction process by using test enble signl in the Trojn circuit since the test enble signl must switch between test mode nd functionl mode. Therefore, our method is ble to del with such ttempts nd effectively trget Trojns even if the Trojn is only ctive during functionl mode. The pper is orgnized s follows. The lyout-wre scn-cell reordering method is presented in Section 2. Simultion results re presented in Section 3. Finlly, Section 4 presents the concluding remrks. 2. SCAN CELL REORDERING In generl, trnsitions in circuit re minly cused by trnsitions on primry inputs nd scn flip-flops. In lrge designs, the T e s t E n b l e ( T E ) S c n i n 1 S c n o u t 1 S c n c h i n 1 S c n c h i n 4 S c n i n 4 S c n o u t 4 S c n i n 2 S c n o u t 2 S c n c h i n 2 S c n c h i n 3 S c n i n 3 S c n o u t 3 Fig. 1. Lyout-wre scn-cell reordering concept. primry inputs bility to cuse switching is restricted to the first levels of the circuit. However, the scn rchitecture llows ccess to internl cells of the circuits. Furthermore, the totl power consumption of the circuit under test (CUT) is highly correlted with the totl number of trnsitions in the scn cells during scn-bsed testing [19][2]. During scn insertion, scn cells re grouped into number of scn chins. They cn be grouped bsed on different criteri. Scn-cell reordering techniques hve lredy been proposed to reduce power during scn test [21][22], enhnce dely fult coverge [23][24], or minimize scn pths [25][26]. In this work, we lso develop scn cell reordering method but for improving Trojn detection using power-bsed signl nlysis. In generl, scn cells re scttered cross the lyout, nd mny gtes cn be ctivted t the sme time cross the lyout during IC uthentiction. Reordering of scn cells bsed on their geometric positions cn significntly restrict switching ctivity into specific region. Figure 1 shows the bsic concept of lyout-wre scn-cell reordering. Assume tht the design with four scn chins is divided into four regions. The method forms the scn chins such tht scn cells plced in ech selected region re connected to ech other. It is to ensure tht the scn chins hve the sme length, but tht is not requirement. The technique enbles mgnifying the Trojn s impct by incresing the Trojn-to-circuit power consumption rtio, by mximizing switching in the trget region (e.g. the region contining scn chin 4) while minimizing switching in ll the other regions (1, 2, nd 3). As n exmple, Figure 2 shows the orgniztion of scn chins in smll ISCAS 89 benchmrk s838, where 32 scn cells re grouped into four scn chins using the Synopsys Design Compiler [27]. The figure shows tht scn chins re scttered cross the lyout, nd the entire design is subjected to dispersed trnsitions using ech of scn chins. Our proposed procedure groups scn cells bsed on their finl physicl loction in the lyout. Due to the lck of plcement informtion t the front-end phse during scn chin insertion, it is not possible to group scn cells nd rrnge scn chins bsed on geometric informtion. Therefore, we perform lyout-wre scn-cell reordering fter plcement nd before routing. The reordering procedure obtins plcement informtion of scn cells nd re-stitches scn chins. Although the bsic ide is pplicble to ny design environment, here, the procedure is

3 S c n $ o u t 1 S c n $ i n 4 S c n $ i n S c n $ o u t S c n $ i n 2 S c n $ o u t 4 S c n $ i n 3 S c n $ o u t 3 S c n c e l l s i n s c n c h i n 1 S c n c e l l s i n s c n c h i n 2 S c n c e l l s i n s c n c h i n 4 S c n c e l l s i n s c n c h i n 3 Fig. 2. Trditionl scn chin the orgniztion in the s383 benchmrk. S c n Z o u t 1 S c n Z i n 4 S c n Z i n S c n Z o u t S c n Z i n 2 S c n Z o u t 4 S c n Z i n 3 S c n Z o u t 3 S c n c e l l s i n s c n c h i n 1 S c n c e l l s i n s c n c h i n 2 S c n c e l l s i n s c n c h i n 4 S c n c e l l s i n s c n c h i n 3 Fig. 3. Scn chin orgniztion in the s383 benchmrk using our lyout-wre scn-cell reordering. implemented using Synopsys Astro [27]. First, the plcement informtion of scn cells is extrcted. Then, the vilble connections between scn cells re removed. In the following, scn cells re connected to ech other bsed on the physicl informtion nd the number of regions (N). Finlly, the netlist is updted with restitched cells to be considered for routing. The entire procedure hs been utomted in our simultion flow. The number of regions, N, determines the size of the regions. With lrge N, ech region consists of smll number of components. A smll region my mgnify the impct of Trojn ctivity on the design s power profile becuse there is less ctivity in the entire design. On the other hnd, smll regions my decrese trnsition probbility of the Trojn since some of the Trojn inputs my be from regions kept inctive. In contrst, lrge regions cn increse the probbility of generting trnsition in Trojn, but the Trojn impct cn be lessened due to n increse of ctivity in the entire design. Trojn components cn be distributed over the entire lyout, nd their inputs my originte from severl different regions. Authentiction of ll combintions of regionl ctivtion for designs R e g i o n 1 s : %, %, %, 1 5 % s : %, %, %, 1 1 % R e g i o n 4 s : %, %, 6 9 %, % s : %, 7 1 %, %, 7 3 % R e g i o n 2 s : 7. 1 %, 7. 2 %, 7. 2 %, 7 % s : 8. 3 %, 7. 5 %, 8. 2 %, 6. 8 % R e g i o n 3 s : 9. 7 %, 9. 3 %, 9. 6 %, 9. 5 % s :. 3 %, 9. 9 %,. 4 %, 9 % Fig. 4. The percentge of switching ctivity in ech region of s38417 nd s35932 fter running four simultions. The results re shown s (Run1, Run2, Run3, Run4) for ech benchmrk. with lrge N would be time-consuming. ( Suppose the design is (N ( divided into N regions, then there re 1) + + N N) ) combintions to be considered during uthentiction. However, in prctice, it is not necessry to exmine every combintion of regions. The number of gte inputs (or fn-in) is limited by the technology librry. Even the dversry my not necessrily be ble to design gte with high fn-in to reduce its ctivity since such gte gretly impcts the dely chrcteristics of the design nd cn esily be detected using ( dely-bsed techniques [5][6]. This fct (N ) ( leds to only inspect N ) ) I mx combintions where I mx is the lrgest fn-in in the utilized technology librry. Figure 3 shows the new orgniztion of scn chins in s838 benchmrk fter performing our lyout-wre scn-cell reordering. In this design, the scn cells re grouped into four regions, N=4, s if the circuit lyout is divided by 4 bsed on the loction of the cells. The effectiveness of scn-cell reordering in limiting switching ctivity in ny trget region is evluted in lrger IS- CAS 89 benchmrks, s38417 with 1564 flip-flops nd 4933 gtes, nd s35932 with 1728 flip-flops nd 3926 gtes. Using our lyoutwre scn-cell reordering method, scn cells in both benchmrks re grouped into N=4 regions with ech benchmrk consisting of 48 scn chins. The simultion is run four times, nd ech run consists of three pttern sets. Ech time different rndom ptterns re pplied. Ech pttern set consists of 41 test vectors in s38417 nd 46 test vectors in s Ptterns pply rndom nd 1 to scn chins covering the trget region t the left bottom corner of the benchmrks lyouts while is pplied to ll other scn chins. To increse rndomness, the circuit is lwys set to scn mode by keeping the test-enble (TE) input ctive; however, other cses such s using TE nd the functionl cpture clock cn be pplied s well in cse the dversry uses TE to dectivte the Trojn in test mode. The percentge of ctivity in ech region of the benchmrks is reported in Figure 4 s (Run1, Run2, Run3, Run4). The results clerly indicte tht in ll four runs switching ctivities re mostly limited to the trget region lbeled Region 4 in Figure 4 while the other regions re kept firly inctive in both benchmrks. Note tht our detiled nlysis demonstrted tht the mjority of trnsitions in the non-trget regions tke plce in cells djcent to the trget region. Regions re controlled by scn-chins; therefore, the number of scn chins my determine N. Given the limittion on the number of pins used for testing, when the number of regions is lrge, compression-like rchitecture including phse shifter cn be used. Our technique hs no impct on the pttern genertion flow nd fult coverge, nd it does not pose re nd pin overheds.

4 A C T e g er m r 5 A C T k e P d A T C d A v d li e z N o þ i n p u t C o m p r t o r 1 2 þ i n p u t C o m p r t o r 6 þ i n p u t C o m p r t o r 4 þ i n p u t C o m p r t o r li e z N o rm þ i n p u t C o m p r t o r 1 2 þ i n p u t C o m p r t o r 6 þ i n p u t C o m p r t o r 4 þ i n p u t C o m p r t o r G l o b l 4 R e g i o n s 9 R e g i o n s 1 6 R e g i o n s 2 4 R e g i o n s G l o b l 4 R e g i o n s 9 R e g i o n s 1 6 R e g i o n s 2 4 R e g i o n s A c t i v t i o n A c t i v t i o n ( ) ( b ) Fig. 5. Impct of loclized ctivtion on Averge nd Pek TCA. 3. SIMULATION RESULTS Four lyouts of the s38417 benchmrk with different number of regions re generted (i.e. N =4, 9, 16, nd 24.) Four combintionl comprtor Trojn circuits with 4 (consisting of 3 gtes), 6 (consisting of 7 gtes), 12 (consisting of 15 gtes), nd 18 (consisting of 23 gtes) inputs re designed. Note tht our method works s effectively for sequentil Trojns, s well. The originl design is synthesized using the Synopsys Design Compiler, nd the lyout is generted using the Synopsys Astro [27]. The scn-cell reordering procedure is pplied with different N s. After obtining the DEF file of ech new design, the circuit is updted by inserting Trojn cells into unused spces in the circuit lyout nd mking the required connections. Considering four Trojns nd four regions, in totl, 16 different designs re creted. Verilog code corresponding to ech design is extrcted nd used for simultion t the logic level [27]. The Synopsys Verilog compiler (VCS) is used to nlyze switching ctivity of Trojns nd designs. Furthermore, the HSPICE model of Trojn-inserted designs is extrcted by StrRCXT [27]. NnoSim is used to perform simultion t the circuit level [27]. Four power ports re plced t the four corners of every design during power distribution network synthesis phse, nd the circuit power consumption is the superposition of current drwn from the power ports. In this section, we use the term locl ctivtion for pplying rndom ptterns to trget region using reordered scn cells nd the term globl ctivtion when pplying rndom ptterns to the design in trditionl mnner (i.e. without reordered scn cells nd ll scn chins re ctivted). Simultion for ech design is done by pplying K =1 rndom vectors. A lrger number of vectors my be needed for lrger designs. The Trojn s impct is evluted by Trojn-to-circuit ctivity (TCA) which is defined s the rtio of the number of trnsitions inside Trojn to the number of trnsitions in the entire circuit. Figure 5 shows the impct of locliztion with different Ns on Trojn ctivity. Averge TCA is defined s the rtio of the totl number of trnsitions inside the Trojn to tht of the circuit over the entire simultion time. In Figure 5(), Normlized Averge TCA is the rtio between the verge TCA of locl ctivtion with specific N nd the Averge TCA of globl ctivtion. Figure 5() shows tht the Normlized Averge TCA increses by loclizing switching ctivity to smller regions (i.e. lrger N) by up to 3X. Locl ctivtion significntly reduces circuit ctivity (i.e. bckground noise) nd mgnifies the Trojn s contribution. The results indicte tht the Averge TCA of globl ctivtion is less thn locl ctivtion for ll vlues of N, even though the greter number of trnsitions is observed inside Trojn circuits. For exmple, Normlized Averge TCA of 18-input comprtor Trojn increses by bout 2X with N =24 compred with the globl ctivtion in Figure 5(). Pek TCA indictes the mximum vlue of TCA clculted per clock cycle. Normlized pek TCA is the rtio between the Pek TCA of locl ctivtion with specific N nd the Pek TCA of globl ctivtion, in Figure 5(b). The Normlized Pek TCA points out cses where the Trojn s impct exceeds the impct of process vritions, nd the Trojn cn be detected much more esily. The results show tht even for smll Trojns, the Normlized Pek TCA increses significntly, which cn help effectively detect them in the presence of process vritions. For instnce, the pek TCA of 18-input comprtor in the locl ctivtion with N =24 is bout 13X more thn tht of the globl ctivtion in Figure 5(b). It is observed tht Normlized Averge TCA decreses from N =9 to N =16 for the Trojns 12- nd 18- input comprtors. This is cused by Trojns implementtion; they re distributed mong severl regions, nd we observe tht there re fewer Trojn gtes in the trget regions. Therefore, the Trojns ctivities reltively decreses while circuit ctivity increses with N =16 compred with N =9. For the 18-input comprtor Trojn, Figure 6 shows TCA per vector for N =1 (globl), 9, nd 24. The results for N=9 nd 24 hve been normlized with respect to N =1 The figure emphsizes li e z 8 N rm o R e g i o n s 9 R e g i o n s G l o b l 4 V e c t o r i n d e x 6 8 Fig. 6. TCA per vector for the 18-input comprtor with N =1 (globl), 9, nd 24.

5 6 u 4 u u ( A ) u D u D 4 u D 6 u D 8 u V e c t o r 6 7 V e c t o r 6 8 V e c t o r 7 V e c t o r 7 1 V e c t o r n 6 8 n 6 9 n 7 n 7 n 7 n 7 3 n 7 4 n 7 5 n t ( s ) V e c t o r 7 2 V e c t o r 7 3 V e c t o r 7 4 Fig. 7. Current consumption of the 18-input comprtor Trojn when N =24. tht the impct of the Trojn on design s power consumption depends on both Trojn ctivity nd circuit ctivity. The lrger number of trnsitions in the Trojn does not necessrily mke Trojn detection esier s circuit ctivity my msk the Trojn s contribution to the totl circuit power. The results show tht most often, in the entire simultion, the TCA of globl ctivtion, where N =1, is nerly zero. In contrst, for N =9 nd 24, the Trojn contribution is significntly mgnified up to 168X. The sme nlysis is done for N =4 nd 16, nd similr results re obtined. Therefore, by using power nlysis bsed techniques [12][13][14], it is possible to more effectively detect Trojns with locl ctivtion. Figure 7 shows the contribution (difference between Trojninserted nd Trojn-free circuits) of the 18-input comprtor Trojn when N =24 on circuit current consumption during ppliction of vectors 67 to 74, nd Tble 1 presents detiled nlysis of circuit ctivity in this intervl. Tble 1 lso shows the behvior of globl ctivtion during this time. For exmple, vector 67 genertes one trnsition in the Trojn (shown s TA) while the number of trnsitions in the circuit (shown s CA) is 115; therefore, the TCA of locl ctivtion would be.87. The sme nlysis is done for globl ctivtion, nd results show 12 trnsitions in the Trojn while 251 trnsitions re generted in the circuit, hence, the TCA of globl ctivtion would be.58. Compring both TCAs indictes tht globl ctivtion msks the Trojn s contribution to totl switching becuse of high switching ctivity, s bckground noise of the circuit. The TCA of locl ctivtion is 1.6X higher thn the TCA of globl ctivtion even though it genertes 12 times less trnsitions in the Trojn. Similr results re obtined for other vectors (68-74) s well. The finl row in the tble shows TCA(locl) TCA(globl) where in ll cses, TCA(locl) is considerbly lrger thn TCA(globl); up to 27X for vector 73. The impct of the Trojn on circuit power consumption cn be seen in Figure 7. For exmple, vector 73 hs significnt impct on the current trce t time 735nsec compred with the other vectors, nd Tble 1 ccordingly shows tht the TCA (nd ccordingly TCA(locl) TCA(globl) ) of vector 73 is greter thn other vectors. HSPICE simultion results show tht the verge current consumption of the Trojn (Tj. Avg. Curr. Cons.) of vector 73 is 7.8µA, which is greter thn other vectors. To compre the impct of the Trojn in locl nd globl ctivtions on circuit power consumption, in rows 7 nd 13, Trojn power (current) consumption is normlized by circuit s verge current consumption (Cir. Avg. Curr. Cons.) per vector. The normlized vlues lso show the lrger impct of locl ctivtion on the Trojn s power consumption. Adversry my design Trojn circuit to be inctive during uthentiction time when TE signl is ctive. Trojn my use TE signl s trigger input nd strts working when TE signl is inctive, i.e. the circuit is in functionl mode. To ddress this issue, TE signl must be switched on nd off frequently. When TE signl is on (high), the circuit is in shift (or scn) mode nd we shift one or more bits into the scn chin. To see impct of the new rndom pttern in the scn chin, we switch bck TE signl to low. This will llow the pttern to be pplied from scn flip-flops to the circuit under test nd responses will go bck to the scn chin. 18-input comprtor is equipped with TE signl such tht it is fully functionl when TE signl is off. To evlute lternting TE signl, four cses re simulted nd Normlized Averge nd Pek TCAs re mesured for N =9 nd 24. In the first cse, TE1(1)(1), TE signl is switched by ech clock cycle. In the second cse, TE1(1)(1), TE signl is on for ten clock cycles nd then switched off for one clock cycle. In the third cse, TE1(3)(1), on stte of TE signl lsts for 3 clock cycles nd then switched off for one clock cycle. The finl cse is TE1(1)() where TE signl is kept high for the entire simultion. Lengthening the high durtion of TE signl would mgnify TCA since circuit is subjected to less switching ctivity. The results, in Tble 2, show tht the 18-input comprtor Trojn impct would be exposed by switching TE signl between on nd off. The results show tht the Normlized Averge nd Pek TCAs considerbly increses (up to 12X) by using lrger N nd keeping TE signl high for more number of clock cycles. It should be noted tht the Normlized Averge nd Pek TCAs re less compred with results shown in Figure 5. This is becuse of functionl dependency mong the vectors, when switching TE signl on nd off. 4. CONCLUSIONS This pper presented new lyout-wre scn-cell reordering method iming t limiting switching ctivity to specific region to improve Trojn detection. The results showed tht switching in most of the non-trget regions cn be reduced significntly. The impct of the region s size ws evluted, nd the results indicted tht smller regions cn more effectively mgnify Trojn ctivity in comprison with globl ctivtion. Menwhile, the method cn be used for loclizing hrdwre Trojns. In future work, we will ddress process vritions. In ddition, the effectiveness of the proposed technique in deling with sequentil Trojns will be evluted. We will design nd fbricte circuit while the technique will be pplied in physicl design, nd cpbility of the technique will be evluted in prctice.

6 Tble 1. The 18-input comprtor Trojn-inserted circuit ctivity nlysis. Vector index TA CA Locl TCA Tj. Avg. Curr. Cons. (µa) Cir. Avg. Curr. Cons. (µa) Current Rtio (Tj./Cir.) e TA CA Globl TCA Tj. Avg. Curr. Cons. (µa) Cir. Avg. Curr. Cons. (µa) Current Rtio (Tj./Cir.) TCA(Locl)/TCA(Globl) Tble 2. Test enble signl ltertion nlysis for 18-input Trojn. Normlized Averge TCA Normlized Pek TCA 9 Regions 24 Regions 9 Regions 24 Regions TE1(1)(1) 1.29X 1.57X 1.46X 2.68X TE1(1)(1) 2.4X 2.6X 2.31X 2.75X TE1(3)(1) 3.59X 4.26X 5.9X 5.68X TE1(1)() 6.19X 11.9X 5.55X 16.66X 5. REFERENCES [1] Report Finl.pdf [2] S. Adee The Hunt for the Kill Switch, [3] M. Tehrnipoor nd F. Koushnfr, A Survey of Hrdwre Trojn Txonomy nd Detection, IEEE Design nd Test of Computers, pp. 1-25, Jnury- Februry 21. [4] P. C. Kocher, J. Jffe nd B. Jun, Differentil Power Anlysis, in Proc. of the CRYPTO, vol of Lecture Notes in Computer Science, pp [5] Y. Jin nd Y. Mkris, Hrdwre Trojn Detection using Pth Dely Fingerprint, in Proc. of the IEEE Interntionl Workshop on Hrdwre-Oriented Security nd Trust(HOST28), pp , 28. [6] D. Ri nd J. Lch, Performnce of Dely-bsed Trojn Detection Techniques under Prmeter Vritions, in Proc. of the IEEE Interntionl Workshop on Hrdwre-Oriented Security nd Trust(HOST29), pp , 29. [7] S. Jh nd S. K. Jh, Rndomiztion Bsed Probbilistic Approch to Detect Trojn Circuits, in Proc. of the IEEE High Assurnce Systems Engineering Symposium(HASE8), pp , 28. [8] M. Potkonjk, A. Nhpetin, M. Nelson nd T. Mssey, Hrdwre Trojn Horse Detection using Gte-Level Chrcteriztion, in Proc. of the IEEE Interntionl Design Automtion Conference (DAC9), 29. [9] Y. Alkbni nd F. Koushnfr, Consistency-Bsed Chrcteriztion for IC Trojn Detection, in Proc. of the Interntionl Conference on Computer- Aided Design (ICCAD9), 29. [1] R. S. Chkrborty, F. Wolff, S. Pul, C. Ppchristou nd S. Bhuni, MERO: A Sttisticl Approch for Hrdwre Trojn Detection, in Proc. of the Workshop on Cryptogrphic Hrdwre nd Embedded Systems (CHES9), 29. [11] H. Slmni, M. Tehrnipoor nd J. Plusquellic, New Design Strtegy for Improving Hrdwre Trojn Detection nd Reducing Trojn Activtion Time, in Proc. of the IEEE Interntionl Workshop on Hrdwre-Oriented Security nd Trust (HOST29), pp , 29. [12] D. Agrwl, S. Bktir, D. Krkoyunlu, P. Rohtgi nd B. Sunr, Trojn Detection using IC Fingerprinting, in Proc. of the Symposium on Security nd Privcy, pp , 27. [13] R. Rd, X. Wng, J. Plusquellic nd M. Tehrnipoor, Txonomy of Trojns nd Methods of Detection for IC Trust, in Proc. of the Interntionl Conference on Computer-Aided Design (ICCAD8), pp , 28. [14] X. Wng, H. Slmni, M. Tehrnipoor nd J. Plusquellic, Hrdwre Trojn Detection nd Isoltion using Current Integrtion nd Loclized Current Anlysis, in Proc. of the Interntionl Symposium on Fult nd Defect Tolernce in VLSI Systems (DFT8), pp , 28. [15] M. Bng nd M. S. Hsio, A region bsed pproch for the identifiction of hrdwre trojns, in Proc. of the IEEE Interntionl Workshop on Hrdwre- Oriented Security nd Trust (HOST28), pp. 4-47, 28. [16] M. Bng nd M. S. Hsio A Novel Sustined Vector Technique for the Detection of Hrdwre Trojns, in Proc. of the Interntionl Conference on VLSI Design, pp , 29. [17] M. Bushnell nd V. Agrwl, Essentils of Electronics Testing, Kluwer Publishers, 2 [18] X. Wng, M. Tehrnipoor nd J. Plusquellic, Detecting Mlicious Inclusions in Secure Hrdwre: Chllenges nd Solutions, in Proc. of the IEEE Interntionl Workshop on Hrdwre-Oriented Security nd Trust(HOST28), pp , 28. [19] R. Snkrlingm, R. R. Orugnti nd N. A. Toub, Sttic Compction Techniques to Control Scn Vector Power Dissiption, in Proc. of the IEEE VLSI Test Symposium (VTS), pp. 35-4, 2. [2] S. Devds nd S. Mlik, A Survey of Optimiztion Techniques Trgeting Low Power VLSI Circuits, in Proc. of the Design Automtion Conference(DAC95), pp , [21] N. Bdereddine, P. Girrd, S. Prvossoudovitch, A. Virzel, nd C. Lndrult, Scn Cell Reordering for Pek Power Reduction during Scn Test Cycles, IFIP Interntionl Federtion for Informtion Processing, ISBN , pp , 27. [22] Y.Z. Wu, M. C.-T. Cho, Scn-Chin Reordering for Minimizing Scn-Shift Power Bsed on Non-Specified Test Cubes, in Proc. of the IEEE VLSI Test Symposium (VTS8), pp , 28. [23] W. Li, S. Wng, S. T. Chkrdhr nd S. M. Reddy, Distnce Restricted Scn Chin Reordering to Enhnce Dely Fult Coverge, in Proc. of the Interntionl Conference on VLSI Design, pp , 25. [24] N. Devtprsnn, S. M. Reddy, A. Gund, P. Krishnmurthy, I. Pomernz, Improved Dely Fult Coverge using Subsets of Flip-flops to Lunch Trnsitions, in Proc. of the IEEE Asin Test Symposium (ATS5), pp , 25. [25] M. Hirech, J. Beusng, X. Gu, A New Approch to Scn Chin Reordering using Physicl Design Informtion, in Proc. of the IEEE Interntionl Test Conference 1998 (ITC98), pp. 348, 1998 [26] L. Hsu, H. Chen, On Optimizing Scn Testing Power nd Routing Cost in Scn Chin Design, in Proc. of the Interntionl Symposium on Qulity Electronic Design (ISQED6), pp , 26. [27] Synopsys Inc., User Mnul,