IEEE Consumer Electronics Magazine - November/December 2020 - 79

the context of 3PIP, there is no golden design or IC
that could be used as a reference. However, the
RTL (if not encrypted) or gate-level design can be
analyzed to examine all the internal signals and
registers, which is not feasible during the verification of a fabricated IC.
Identification of suspicious signals in RTL
code is possible by utilizing formal verification,
coverage analysis, redundant circuit removal,
sequential automatic test pattern generation,
and equivalence theorems.21 Formal verification
is a functional verification technique that uses
static analysis to prove design functionality exhaustively. It can also be used to prove a set of security properties, which guarantees that there is no
violation of those conditions in the design. However, reliance on formal methods could become
an impediment when verifying large designs. Conversion of HDL code to suitable proof checking
format can be used to formally check if the design
meets the security properties specified by an IP
consumer.22 However, since it requires the IP
vendor to invest time in the conversion of the
design and construction of proofs, unless the
consumer is a government or military organization, imposing such a requirement of formal
proofs could be difficult.
Extraction of control and data flow graph
(CDFG) from the RTL code enables automatic
analysis and application of machine learning in
detecting Trojans. For instance, using an artificial immune system, the presence of unsafe or
undesirable behaviors in the RTL code represented as encoded CDFG can be detected.23
Nonetheless, this method does not provide any
information regarding the exact location of the
malicious behavior within the RTL code. By analyzing the degree of control or "control-value"
that each signal in the gate-level 3PIP has on
the states of its subsequent connected signals,
suspicious nets that are part of Trojan(s) can be
isolated.24 While these solutions are valid for
specific Trojan classes (i.e., ones that rarely trigger and have low "control-value"), structurally
redesigning the Trojans to eliminate the distinguishing feature has been proven effective in
bypassing such techniques.25 A supervised
machine learning framework can be used to
incorporate a combined analysis of various functional, structural, and neighborhood features of

November/December 2020

Trojan circuits. The framework can be used to
learn significant variations of malicious insertions that belong to different Trojan classes,
thereby making it hard to bypass through the
alteration of a few distinguishing features.26 An
automatic tool-based Trojan insertion process
can be used to generate a diverse database of
Trojan-inserted designs.27 However, such learning-based solutions should be tested against
adversarial learning where the attacker tries to
bypass the trained model using the knowledge
of the training data.
Dynamic Trojan detection approach requires
the simulation of the suspect IP using techniques
similar to functional testing for ICs. However,
achieving complete activation of all possible
Trojans is extremely difficult without having any
knowledge about the possible location of the
Trojan within the suspect design. Concolic testing has shown promising results as a dynamic
verification approach that can scale with the
design size.28 Again, both dynamic and static
analysis usually requires white-box accessibility
to the design, which impedes their applicability
for verifying COTS ICs.

Design-for-Trust (DFT) Methods
DFT methods require design-time modification for combating Trojans. Design modification
could be done to facilitate trust verification of IC
after fabrication. It could also be done to make
Trojan insertion difficult by untrusted foundries.
Runtime detection of Trojans could be incorporated in both IC and IP through design-time
changes with additional countermeasures for
impeding the activation impact of Trojans.
To Facilitate Trust Verification
Complete activation of all possible Trojans during logic testing of an IC requires intelligent test
patterns that are hard to generate. Hence, the
inclusion of design artifacts that improve the Trojan coverage of test patterns is desirable. Netlistlevel alterations (e.g., insertion of scan flip-flops
with additional logic) can be advantageous to
improve the activation probability of hard-toactivate nets while ensuring a higher probability
of observing any malicious outcome.29 These
techniques are also beneficial for SCA-based
detection that does not require complete Trojan

79
IEEE Consumer Electronics Magazine - November/December 2020

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - November/December 2020
