Hardware Trojan Detection by Delay and Electromagnetic Measurements

Transcription

1 Hardware Troja Detectio by Delay ad Electromagetic Measuremets X-T Ngo, I Exurville, S Bhasi, J-L Dager, S Guilley, Z Najm, Jea-Baptiste Rigaud, Bruo Robisso To cite this versio: X-T Ngo, I Exurville, S Bhasi, J-L Dager, S Guilley, et al.. Hardware Troja Detectio by Delay ad Electromagetic Measuremets. Desig, Automatio ad Test i Europe 215, Mar 215, Greoble, Frace. 215, <1.7873/DATE >. <hal > HAL Id: hal Submitted o 8 Dec 215 HAL is a multi-discipliary ope access archive for the deposit ad dissemiatio of scietific research documets, whether they are published or ot. The documets may come from teachig ad research istitutios i Frace or abroad, or from public or private research ceters. L archive ouverte pluridiscipliaire HAL, est destiée au dépôt et à la diffusio de documets scietifiques de iveau recherche, publiés ou o, émaat des établissemets d eseigemet et de recherche fraçais ou étragers, des laboratoires publics ou privés.

2 Hardware Troja Detectio by Delay ad Electromagetic Measuremets X-T. Ngo 2, I. Exurville 1,3, S. Bhasi 2, J-L. Dager 2,4, S. Guilley 2,4, Z. Najm 2, J-B. Rigaud 3 ad B. Robisso 1 1 CEA-Tech PACA, LSAS Gardae, Frace. firstame.lastame@cea.fr 2 TELECOM ParisTech Paris, Frace. firstame.lastame@est.fr 4 Secure-IC S.A.S. Paris & Rees, Frace. firstame.lastame@secure-ic.com 3 EMSE, LSAS Gardae, Frace. lastame@emse.fr Abstract Hardware Trojas (HT) iserted i itegrated circuits have received special attetio of researchers. I this paper, we preset firstly a ovel HT detectio techique based o path delays measuremets. A delay model, which cosiders itra-die process variatios, is established for a et. Secodly, we show how to detect HT usig ElectroMagetic (EM) measuremets. We study the HT detectio probability accordig to its size takig ito accout the iter-die process variatios with a set of FPGA. The results show, for istace, that there is a probability greater tha 95% with a false egative rate of 5% to detect a HT larger tha 1.7% of the origial circuit. I. Itroductio The trust ad security of Itegrated Circuits (IC) desig ad fabricatio is critical for sesitive fields like fiace, health, ad govermetal commuicatios. Due to the complexity ad the high cost of IC fabricatio cycle, more ad more firms outsource their productio. This tred gives a possibility for a adversary to itroduce malicious circuit, called Hardware Troja horse (HT), i ay IC. It ca either perform a Deial Of Service (DOS), deteriorate circuit performace [8], or steal sesitive iformatio. Therefore, the HTs are cosidered a real threat which has gaied attetio from researchers. HT ca be iserted at ay poit durig the desig or fabricatio process from Register Trasfer Level (RTL) to layout ad circuit fabricatio. For example i [11], authors show some techiques to isert malicious circuitry at RTL level. These HTs, which are activated with a specific patter iputs, ca leak secret key via RS232 chaels. The HT, ulike a software troja, caot be removed oce it is fabricated. So, it is better to proactively prevet the isertio of a HT: few methods have bee proposed. Oe semial work is kow as private circuits II [9]. This paper describes a proof-ofcocept, too costly to be implemeted. A more reasoable optio has bee recetly proposed i [5]: it uses two codes to ecode the state ad mix it with ecoded radomess, which allows to prevet a easy triggerig ad has a detectio capability. Otherwise it is importat to detect it before it becomes effective. Previous works classify detectio methods ito two wide categories: destructive ad o-destructive. Ivasive methods destroy the chip to recostruct successfully the GDSII ad the etlist of the chip usig chemical products ad optical observatio apparati as Scaig Optical Microscopy (SOM), Scaig Electro Microscopy (SEM), etc. The mai advatage of such ivasive techique is its accuracy for all malicious isertios. However, the destructive ature ad legthy time eeded to recostruct the etlist of the chip are two sigificat drawbacks. No-destructive methods compare the physical characteristics or logical state of a IC with a geuie circuit also kow as the golde circuit at testig time or ru-time. A optical detectio of chages i the last metal layer of metallizatio has bee proposed i [4]. I [1], authors propose to add re-cofigurable DEsig-For-ENablig-SEcurity (DEFENSE) logic to the fuctioal desig. I test time, the first approach is usig logic testig. It ivolves applyig test patters at the iput ad try to detect aomalous behaviors of ICs [3], [1]. But almost all test-time detectio techiques are difficult to realize. They caot esure that HT will be activated because of the complexity of test patters. Therefore, Side-Chael Aalysis (SCA) ca also be deployed to detect HTs. These methods observe ad compare physical traits (power cosumptio, time delay, etc.) of a IC uder test agaist a trusted IC [15], [16]. A promisig approach for detectig HTs is to study delay measuremets, because the HT does ot eed to be triggered ad its mere presece ca impact a part of the IC path delays. I [12], [18], path delays are used as a figerprit for a trusted IC (Golde Model, or GM). The first purpose of our paper is to show how HTs ca be detected despite havig small size ad beig ot logically coected with elemets of critical data paths. A sigificat advatage of this method is the detectio of IC alteratios without activatig the payload of the HT ad by usig a low cost mea. The importace of ot oly limitig the study to critical paths is show. Moreover, the itra-die process variatios are cosidered i these aalyses. O the other side, previous works o SCA-based detectio have bee limited to either simulatios or power cosumptio measuremets o some real circuit. I [13], authors preset a practical evaluatio of HT detectio usig SCA o FPGA. But the experimets were performed o a sigle FPGA so the

3 iter-die process variatios were ot take ito accout. I our paper, we also study the HT detectio method based o ElectroMagetic (EM) measuremets which provide a better spatial ad temporal resolutio tha power measuremets hece improvig HT detectio result. Moreover, we propose a metric to evaluate the impact of iter-die process variatios i HT detectio based o EM measuremets accordig to HT size. Process variatios are studied o 8 differet Virtex 5 FPGA boards. The rest of this paper is orgaized as follows. Sectio II describes the structure of created HTs ad how they are iserted at layout level i FPGA. Sectio III presets the HT detectio usig delay aalysis approach. Sectio IV shows the results of HT detectio based o ElectroMagetic (EM) measuremets. Sectio V studies the impact of iter-die process variatios o HT detectio based o SCA. We fiish with a small coclusio ad some perspectives i sectio VI. II. Hardware Troja Isertio A. Hardware Troja Isertio Methodology Our attack sceario is the followig: attacker is a utrusted ASIC foudry. Upo receptio of the tape-out database (GDS file), the fouder iserts a HT before fabricatio. I order to reduce the impact of HT o the geuie circuit, the HT must be iserted keepig the origial placemet ad routig of target circuit. To imitate the HT isertio o ASICs, we eed to keep the same placemet ad routig betwee the golde circuit ad HT ifected circuit o FPGAs. Hece the oly differece betwee the two is the logic ad the itercoect utilized by the HT. To isert a HT, without modifyig the routig, we apply the followig steps i the Xilix framework: 1) Sythesize, traslate, map, place & route the origial circuit. I our case, it is a AES-128 block cipher. 2) Extract the Native Circuit Descriptio (NCD) file which cotai all the circuit, placemet & routig iformatio of origial circuit (this is the golde model). 3) Ope the NCD file usig FPGA Editor tool ad isert HT i uused LUTs ad Slices of FPGA, maually or by a script. 4) Geerate bit files for both origial ad ifected circuits with FPGA Editor. With this method, we ca esure that the placemet ad routig is the same i both golde ad HT-ifected circuit. It allows us to perform the proof-of-cocept of HT attack at ASIC layout level (the FPGA fabric is see as a ASIC). B. Hardware Troja Descriptio A HT is distiguished by its spread ito the IC, its size ad its behavior. For testig our method i differet cotexts, two types of HT were implemeted: a combiatioal ad a sequetial oe. The trigger part of the combiatioal HT scas 32 SubBytes sigals at the iput of the SubBytes step. The trigger is activated whe simultaeous occurreces at 1 of all the 32 SubBytes bits occur. Its payload cosists i causig a DOS. This HT uses.19% of slices i the FPGA, whereas AES implemetatio covers 38.26% of the FPGA slices. The sequetial HT icludes a 32-bit couter with a comparator which is icremeted for each AES ecryptio. The HT becomes active whe the couter is equal to a defied value. As for the combiatioal HT, the activatio of the sequetial HT ivolves a dey of service. For this HT,.36% of slices used i the FPGA were required. I both cases, durig our experimets, the two HTs were ot activated. Ideed, we focus o detectig their presece ito the FPGA before the payload is triggered. I additio, we isist that oe of the two HT are o the critical path. A. Approach III. HT Detectio Usig Delay Aalysis Most digital ICs work accordig to the priciple of sychroicity: they use a commo clock sigal to sychroize their iteral operatios. Whe a datum leaves a register bak o a clock risig edge, it progresses through the combiatioal logic, ad goes ito the ext register bak to be sampled o the ext clock risig edge. This is depicted i Fig. 1, where the square boxes represet registers ad the cloud represets the combiatioal logic. data clk Figure 1. D DFF Q D clk2q D pmax T clk + T skew T setup D DFF Iteral architecture ad timig of sychroous ICs The clock period T clk has to respect timig costraits, i particular a setup coditio represeted by equatio (1): T clk > D clk2q + D pmax + T setup T skew + T jitter. (1) This esures the datum is correctly stored i the register bak. This equatio is related to the delay betwee the clock risig edge ad the curret update of a register s output D clk2q, the value D pmax of the maximum propagatio time through the combiatioal logic. The T setup associated to the set-up time which is the amout of time for which a D Flip-Flop iput (DFF) must be stable before the clock s risig edge to esure reliable operatio. The T skew represets the skew or slight phase differece that may exist betwee the clock sigals at the iputs of two differet registers ad T jitter is the clock jitter. A hold time T hold expresses a equivalet costrait as the T setup, but after the clock edge. Chakraborty et al. implemeted a key-eablig additioal mode of operatio [7] usig logic testig ad Abramovici et al. used a differet approach with the desig of a re-cofigurable platform [1] to ispect the system of a aalog chip. I this paper, the proposed method did ot call for a additioal circuitry. Thus, there is o supplemetary cost durig the Q

4 maufactured step, ad it remais easy ad ecoomical to realize. The oly costrait is the access to the clock. Our approach is based o a clock glitch, aimig at turig the compariso ito a equality i Eq. (1). The clock period is reduced gradually util the last sigal trasitio of the datum becomes too close to the clock s risig edge. This triggers a set-up time violatio which leads the DFF s output ito a meta-stable state. I this way, the clock glitch establishes a good meas to iduce path delay violatio i ICs [2]. Figure 2. Priciple of path measuremet, for a give pair (P, K) Our hypothesis is the followig: the additio of HT i a desig ca have impact o the iteral sigals. Figure 2 illustrates the experimetal procedure. Delays of α, β ad γ are measured usig a iterative decrease of the clock period (with a 35 ps step). These delays are performed with a GM as a referece ad the with IC uder test. The isertio of a HT will shift the timigs, as circled i red i Fig. 2. The compariso of the critical path betwee the GM ad the circuit returig from fabricatio allows to detect a purported HT. I Fig. 2, the critical path is et β. Although the HT might ot have modified the structure of this path, this path will be iflueced (through the power-groud etwork) by the HT triggerig logic, ad thus will be slightly differet. Of course, if the HT has gates iserted i the path β, the its legth will be sigificatly loger. B. Model ad Results o Oe Chip Our experimets were made with three differet implemetatios of the AES: oe clea ad two ifected with a HT. From these implemetatios, we geerate three bit files which are iserted oe after the other ito the FPGA. We iject our clock glitch o the 1 th roud of the AES. Thus, we obtaied directly the faulted ciphertext. The experimet was repeated 1 times to lower measuremet oise, for each 1, radom pairs {plaitext, key} for all three bit files. Iteral sigal waveforms deped o the data processed, thus the critical path varies whe (P, K) varies. Therefore, a matrix is geerated to record the delay for all values of the detected AES bits. A total of 51 decrease steps of 35 ps were performed. From our data measuremets, we extract the critical path of AES bits, estimated by the umber decremets by clock steps eeded to fault each cosidered bit. I [14], the delay model is refied as the sum of a static part (d S ) ad a radom process variatio part (d R ). I our study, we defie the delay D GM of a et N a of the GM by Eq. (2), where d PV is the arbitrary delay iduced by the itradie process variatios ad d Mr is the radom metastability, evirometal ad factor oises (oted r): D GM (N a, r 1 ) = d S a + d PVa + d Mr1. (2) We assume that addig a HT i a device chages at least the delay of oe et. If the HT is close to a et N a (or directly coected to a et N a ), d HTa is defied as the radom delay added by the HT to the et N a i a ifected IC. Thus, the delay equatio for the et N a is: D HT (N a, r 2 ) = d S a + d PVa + d Mr2 + d HTa. (3) To deal with sources of ucertaity represeted by d Mr, we performed our experimets 1 times with the GM bit files. D GM (N a ) is the mea delay for the delay differeces 1 D GM (N a, r) of all 1 experimets performed o the same board for differet experimetal coditios. Compared to the GM, the ifected IC has a differet layout. Thus, if there is a HT, the delay differece D(N a, r) is described i Eq. (4): D(N a, r) = D(N a ) D HT (N a, r) = d Mr d HTb. (4) 1 We determie the differece D(N a ) D(N a ), for differet 1 bit files with ad without HT. As illustrated o Fig. 3, for the sake of clarity, four differeces were plotted: two for a uifected AES i light gree (Clea 1 ad Clea 2 ) ad two for each HT i dark red (HT comb ad HT seq ). The results are illustrated for two represetative pairs (P, K), amely o 13 ad 47. The tred is the same for all 5 tested pairs (P, K). This techique detects the two implemeted HTs. The X-axis is the bit umber (i rage 1, 128 ) ad the Y-axis is the delay differece calculated (refer to Eq. (4)). Delay differece (i ps) Delay differece (i ps) Figure Bit umber HT comb HT seq Clea 1 Clea Bit umber HT comb HT seq Clea 1 Clea 2 Impact of two HTs o delays, for (P, K) o 13 (up) ad o 47 (dow) Oe ca highlight o the importace to study ot oly the critical path but all the data path delays. Each implemeted

5 EM emaatios x Figure 4. EM measuremet of a sigle AES-128 ecryptio wire ca be cosidered as a HT sesor. Eve if o logical coectio exists betwee the desig ad the HT, both share the same power grid iside the FPGA. These electric coectios make the HT detectio easier. Besides, as the data path depeds o the data processed, it is relevat to use several (P, K) pairs, to detect differet sets of bits. Each oe brigs iformatio. As illustrated o Fig. 3, the more (P, K) pairs are studied, the more bits will be sampled, the more evidece about HT presece is collected. Furthermore, the false positive rate is decreased. C. First Coclusio I this first part, we have show that delays are affected, sometimes by as much as 1 s, if a HT is iserted. This method requires a access to the iteral clock of the desig. I cases where the iteral clock access caot be reachable, Side Chaels Aalysis ca be aother solutio to detect HTs. A EM measuremet approach is described i Sec. IV. IV. HT Detectio Usig Electromagetic Measuremet I this sectio, we preset the result of HT detectio by EM measuremet. The geuie AES ad the ifected AES with combiatioal HT preseted i II-B are used to evaluate this method. These two desigs are implemeted o FPGA Virtex 5 (LX3). The experimet is performed usig the setup described i Appedix B. The circuit is clocked with a frequecy of 24 MHz. EM traces are acquired for radom plaitexts, where each trace is averaged 1 times by oscilloscope to miimize the measuremet oise. A sigle EM trace is show i Fig. 4. We oticed that the SNR seems good thaks to averagig doe by oscilloscope. All the te rouds of ecryptio ca be distictively see i this trace. The figure 5 shows 3 traces (two traces for the geuie AES desig ad oe traces for ifected AES with combiatioal HT desig) for the same plaitext. The traces i black ad blue are for geuie AES desig take at differet momets with the same plaitext. That meas we implemet geuie AES desig o the FPGA Virtex5, we acquire the first trace with plaitext P1. The we tur off the setup, after we re-implemet geuie AES o the same FPGA ad we acquire the secod trace with the same plaitext P1. It allow us to evaluate the measuremet oise created by setup istallatio. Regardig Fig. 5, these two traces are early the same by averagig 1, EM Emaatio EM Emaatio x x Figure 5. Geuie AES 1 Geuie AES 2 Ifected AES Hardware troja detectio usig averaged EM traces times with oscilloscope. Therefore setup oise is removed. The third trace is the oe of ifected AES desig which is acquired with the same plaitext P1 as the two geuie AES traces. We oticed that the trace of ifected AES (i red) is differet comparig with the geuie AES traces at some samples. This differece comes from HT isertio. Therefore, the HT ca be easily detected by comparig directly the geuie AES traces ad ifected AES traces with the same plaitext. Notice that the plaitext is fixed but ukow ad that the HT is ever activated durig the experimets. V. Impact of Iter-Die Process Variatios o HT Detectio I the previous sectios III ad IV, HT isertio ca be easily detected by usig delay/em aalyses. But i these experimets, the geuie ad ifected circuits are programmed i the same FPGA. Therefore it is logical that the differece of delay or EM measuremet betwee these two desigs is visible which makes the detectio of the iserted HT easy. I a real sceario, geuie ad ifected circuits are two distict physical circuits. I this case, the compariso of delay or EM measuremet betwee geuie ad ifected desig is more difficult because of iter-die Process Variatios (PV). Ideed two circuits fabricated with the same process, ad i the same wafer, have slightly differet physical ad electrical behaviors. Therefore the result of HT detectio usig Side- Chael Aalysis varies. I this sectio, we study the impact of PV o the HT detectio method usig EM measuremet. More precisely, we wat to evaluate the probability of HT detectio accordig to its size takig ito accout the process variatios of 65 m techology. A. HT Detectio Feasibility with Iter-Die Process Variatios I order to evaluate the process variatio oise, a set of 8 FPGA Virtex 5 LX3 with the techology of 65 m are used. The EM detectio method is performed i these FPGA. Usig the test board FF324 Virtex 5 described i Appedix B, we ca easily chage the test FPGA while keepig other setup parts (probe positio, board test, etc) itact. It esures that we evaluate oly the impact of process variatios.

6 Absolute of differeces Figure 6. Geiue AES AES & HT Impact of Process Variatios o EM measuremets I order to evaluate the impact of HT size o the HT detectio probability, we implemeted 3 varieties of combiatioal HT described i Sec. II-B o the Virtex 5 FPGA. The descriptio of these 3 differet varieties is the followig: HT 1: is activated whe 2 5 = 32 SubBytes iput sigals are at 1. It occupies.5% of origial AES. HT 2: is activated whe 2 6 = 64 SubBytes iput sigals are at 1. It occupies 1.% of origial AES. HT 3: is activated whe 2 7 = 128 SubBytes iput sigals are at 1. It occupies 1.7% of origial AES. I total, four differet desigs (geuie AES, ifected AES with HT 1, HT 2 ad HT 3) are implemeted o 8 FPGA Virtex 5. For each implemetatio we acquired oe trace (averaged 1, times) for the same plaitext. So fially, we acquired 32 mea traces for both geuie ad ifected AES. I Fig. 6 we plotted the differece Dg j = G j E 8 (G) of all golde circuit iserted i 8 FPGA i gree, ad Dt s, j = T s, j E 8 (G) of all HT s ifected circuit i red. Our otatios are defied below: G j is the EM trace of jth ( j {1, 2,..., 8}) golde circuit, T s, j is the EM trace of jth HT s (s {1, 2, 3}) ifected circuit, ad E 8 (G) is the EM trace mea over all 8 golde circuits. We ca otice the static differeces betwee gree (or gray) curves that are due to process variatios. We also otice that the differece of EM measuremet i red (or black) for AES with HT 2 (1%) is bigger tha the fluctuatio of process variatios for certai samples thus allow the possibility to detect this HT. This clearly shows that the isertio of HT is detectable if we choose specific poits of iterest. B. False Negative Rate of HT Detectio As metioed before, the referece to build a SCA detectio method is maily biased by process variatios (PV), thus deterioratig HT detectio efficiecy. The process variatio effect is modeled by a radom oise with a Gaussia distributio [6]. I particular, some FPGAs will emit more ad some less. The impact of the HT is a determiistic shift of the EM emaatios, with more or less impact o differet fabricated ICs. Therefore the HT cotributio to the side-chael (e.g., the EM field) ca be modeled by a activity offset o a et used by the HT. This is illustrated o figure 7. Geuie circuit σ 1 σ 2 µ/2 +µ/2 P false egative P false positive Ifected circuit Figure 7. EM field probability desity fuctios for a geuie ad a ifected circuit This figure illustrates the activity distributio at a specific sample time ad for a set of referece devices. The blue Gaussia curve is the activity distributio without ay HT. Ad the red Gaussia curve is the distributio through the same set of circuits which cotais the ifected AES (with HT). It is merely a offset which depeds o the HT size, placemet ad positio relative to the probe i case of EM acquisitios. Usig this model, the probability of detectig a HT ca be calculated. Precisely, we ca estimate the false positive ad false egative probability of HT detectio as a fuctio of HT size for a set of ICs. P false egative = P false positive = ( ) 2 erf µ 2σ, (5) 2 where erf is error fuctio ad σ 1 σ 2 = σ. Returig to our specific case study, we apply the false egative rate equatio o the absolute of differeces. More precisely, we calculate the false egative rate o the sum of the local maxima of the absolute differeces Dg j ad Dt s, j. Ideed, we foud i Fig. 6 that the differece betwee geuie ad ifected AES traces are maily located at the trace peaks. Therefore the local maxima are poit of iterest ad HT detectio is logically based o these poit. By summig these local maxima, we ca icrease the HT detectio probability. The computatio of the false egative rate is the followig: Calculate Dg j ad Dt s, j. Fid the local maxima of Dg j ad Dt s, j. Sum the local maxima of each Dg j ad Dt s, j. Compute the false egative rate o the sum of local maxima. The false egative rates of HT occupyig.5%, 1% ad 1.7% of the AES area are respectively 26%, 17% ad 5%. We ca otice that the detectio probability icreases whe the HT size icreases. This is logical because the bigger the HT the more it cotributes to the IC activity (hece larger EM emaatios). We ca also otice that for a HT 1 of size.5%, there is a high false egative rate of 26% because of process variatios. For a HT 3 of size of 1.7%, the false egative rate decreases to 5% which is quite acceptable. I the state of the art, there are some obfuscatio techiques used to force a attacker to icrease the size of his HT hece improvig the detectio probability usig this approach. So the HT ca be detected eve with the presece of process variatios.

7 VI. Coclusio ad Perspectives I this paper, we studied the detectio of HT implated o FPGAs, without chagig the placemet ad routig of the origial circuit. This represets a proof of cocept study for ASIC circuit where HT are added by utrusted chip maufacturers before the fial fabricatio of the chip. First of all, a ovel HT detectio approach usig delay aalysis us preseted. This method is based o decreasig gradually the clock sigal to create clock glitches. The the IC critical paths delays for several bits are estimated with the faulted outputs ad umber of decreased clock steps. The HT detectio relies o the defied delay model for a et. Secod, a HT detectio method usig EM aalysis is also itroduced. It provides a better spatial ad temporal resolutio tha power measuremets. I these two methods, HT ca be detected by comparig directly the delay/em measuremet betwee geuie ad ifected desig usig AES as target circuit. Next, we tested HT of differet sizes to estimate the detectio probability as a fuctio of its size takig ito accout the iter-die process variatios. 8 differet FPGA of the same referece (Xilix LX3) are used to study the impact of iterdie process variatios o this detectio probability. We also itroduce the metric to detect HT by exploitig EM techiques. This metric sums the local maxima of the absolute differece of the EM captured traces. It predicts the probability of HT detectio with determied false positive ad false egative rates. The results show that, usig this metric, there is a probability greater tha 95% with a false egative rate of 5% to detect a HT larger tha 1.7% of the origial circuit area. Further extesio of this work ca iclude a more precise evaluatio of impact of process variatios o detectio probability usig both delay ad EM measuremets. This precisio ca be achieved by coductig the same experimets o FPGAs, where 8. Ackowledgmets This project has bee fuded by the Frech Govermet (BPI-OSEO), uder grat FUI #14 HOMERE (Hardware trojas : Meaces et robustesse des circuits itegrés) ad was partially supported by a DGA-MRIS scholarship. Refereces [1] Miro Abramovici ad Paul Bradley. Itegrated circuit security: ew threats ad solutios. I Proceedigs of the 5th Aual Workshop o Cyber Security ad Iformatio Itelligece Research: Cyber Security ad Iformatio Itelligece Challeges ad Strategies, 29. [2] Michel Agoya, Jea-Max Dutertre, David Naccache, Bruo Robisso, ad Assia Tria. Whe clocks fail: O critical paths ad clock faults. I Smart Card Research ad Advaced Applicatio, 21. [3] Maiak Baga ad Michael S Hsiao. Odette: A o-sca desig-for-test methodology for troja detectio i ics. I Hardware-Orieted Security ad Trust (HOST), 211 IEEE Iteratioal Symposium o, 211. [4] Shivam Bhasi, Jea-Luc Dager, Sylvai Guilley, Xua Thuy Ngo, ad Lauret Sauvage. Hardware Troja Horses i Cryptographic IP Cores. I Wielad Fischer ad Jör-Marc Schmidt, editors, FDTC, pages IEEE, 213. [5] Shivam Bhasi, ad Jea-Luc Dager Xua Thuy Ngo, Sylvai Guilley, ad Zakaria Najm. Ecodig the State of Itegrated Circuits: A Proactive ad Reactive Protectio agaist Hardware Trojas Horses. I Proceedigs of the 9th Workshop o Embedded Systems Security, WESS 14, New York, NY, USA, October ACM. New Dehli, Idia. DOI: / [6] Keith A Bowma, Steve G Duvall, ad James D Meidl. Impact of die-to-die ad withi-die parameter fluctuatios o the maximum clock frequecy distributio for gigascale itegratio. Solid-State Circuits, IEEE Joural of, 22. [7] Rajat Subhra Chakraborty, Somath Paul, ad Swarup Bhuia. Odemad trasparecy for improvig hardware troja detectability. 28. [8] U.S. Departmet Of Defese. Defese sciece board task force o high performace microchip supply. [9] Yuval Ishai, Maoj Prabhakara, Amit Sahai, ad David Wager. Private Circuits II: Keepig Secrets i Tamperable Circuits. I EUROCRYPT, volume 44 of Lecture Notes i Computer Sciece, pages Spriger, May 28 Jue St. Petersburg, Russia. [1] Susmit Jha. Radomizatio based probabilistic approach to detect troja circuits. I High Assurace Systems Egieerig Symposium, 28. HASE th IEEE, 28. [11] Yier Ji, Natha Kupp, ad Yiorgos Makris. Experieces i hardware troja desig ad implemetatio. I Hardware-Orieted Security ad Trust, 29. HOST 9. IEEE Iteratioal Workshop o, 29. [12] Yier Ji ad Yiorgos Makris. Hardware troja detectio usig path delay figerprit. I HOST 28. IEEE Iteratioal Workshop o, 28. [13] Sebastia Kutzer, Axel Y Poschma, ad Marc Stöttiger. Hardware troja desig ad detectio: a practical evaluatio. I Proceedigs of the Workshop o Embedded Systems Security, 213. [14] Sergey Morozov, Abhrail Maiti, ad Patrick Schaumot. A aalysis of delay based puf implemetatios o fpga. 21. [15] Miodrag Potkojak, Ai Nahapetia, Michael Nelso, ad Tammara Massey. Hardware troja horse detectio usig gate-level characterizatio. I Desig Automatio Coferece, 29. DAC 9. 46th ACM/IEEE, 29. [16] Reza Rad, Jim Plusquellic, ad Mohammad Tehraipoor. Sesitivity aalysis to hardware trojas usig power supply trasiet sigals. I Hardware-Orieted Security ad Trust, 28. HOST 28. IEEE Iteratioal Workshop o, 28. [17] Xilix. Sythesis Optios (XST). documetatio/sw mauals/xilix11/pp db xst sythesis optios. htm. [18] Xuehui Zhag, Ka Xiao, ad Mohammad Tehraipoor. Path-delay figerpritig for idetificatio of recovered ICs. I DFT 212, IEEE Iteratioal Symposium o, 212. Appedix To evaluate the HT detectio usig delay ad EM aalysis, a AES 128 bits is used as the target circuit. This AES eeds 1 rouds for oe cipher computatio. The proof-of-cocept is doe o FPGAs from Xilix [17]. A. Delay Measuremet Delay measuremet platform is composed of: Xilix Sparta 3AN based FPGA board. The test chip s omial clock period is 1 s, ad its core omial voltage is 1.2 V. Xilix Virtex V based FPGA board, used as a exteral clock. B. Electromagetic Measuremet EM measuremet platform is composed of: FF324 Virtex 5 experimetal board with a ZIF socket that allows to chage the device uder test (DUT). Xilix FPGA Virtex 5 (LX3) fabricated i 65 m techology ode. Lager RFU-5-2 probe that captures the global EM activity of the chip. 3 db Lager EMV power amplifier to amplify EM sigal comig from the probe. Agilet 54853A ifiiium DSO cofigured at 5 GS/s. Agilet E3631A stabilized power supply for the test board.