Hardware Trojan Detection

A non-invasive detection methodology that monitors unintended physical emissions—such as power consumption, electromagnetic radiation, or timing variations—during circuit operation. A hardware trojan, even when dormant, alters the parasitic capacitance and switching activity of the host chip, creating measurable anomalies in the side-channel profile.

• Power Trace Analysis: Compares transient current draw against a golden reference model
• Electromagnetic Emanation: Maps spatial EM field variations to localize malicious logic
• Timing Path Analysis: Detects added gate delays introduced by inserted trojan circuitry

This method is particularly effective against trojans that are too small to impact functional testing but still perturb the physical operating environment.

A structural verification approach that uses Automatic Test Pattern Generation (ATPG) to attempt to activate and observe the effects of inserted malicious logic. The core challenge is that trojans are designed to remain dormant under normal test conditions, requiring statistically rare activation sequences.

• N-Detect Testing: Applies multiple unique test patterns to each circuit node to increase the probability of triggering a trojan's rare activation condition
• Dummy Scan Flip-Flop Insertion: Adds transparent observation points to monitor internal nodes that would otherwise be inaccessible
• Path Delay Fingerprinting: Measures the propagation delay of critical paths to identify gates added by an adversary

Logic testing is most effective against always-on trojans or those with predictable trigger mechanisms, but struggles with large, complex systems-on-chip where exhaustive testing is infeasible.

A destructive but definitive detection technique that involves delayering the integrated circuit and imaging each layer using scanning electron microscopy (SEM) or optical microscopy. The extracted images are compared against the original GDSII layout file to identify any unauthorized additions, deletions, or modifications.

• Layer-by-Layer Imaging: Systematically removes and images each metal and polysilicon layer
• Netlist Extraction: Reconstructs the transistor-level schematic from imagery for formal equivalence checking
• Differential Analysis: Compares the recovered layout against a trusted golden design to flag anomalies

While highly accurate, this method is destructive, time-consuming, and expensive, making it suitable only for sampling-based verification in high-assurance supply chains.

A built-in self-test methodology that embeds a distributed network of ring oscillators across the chip layout. These oscillators are sensitive to local process variation, temperature, and voltage fluctuations. A hardware trojan introduces additional capacitive loading or switching activity that measurably shifts the oscillation frequency of nearby sensors.

• Frequency Delta Mapping: Creates a spatial heatmap of oscillator frequencies to identify regions with anomalous loading
• Transient Response Analysis: Monitors oscillator settling behavior during power-up to detect trojan activation
• On-Chip Calibration: Uses redundant oscillators to cancel out environmental noise and isolate malicious perturbations

This technique provides continuous, in-field monitoring throughout the device lifecycle, detecting trojans that activate only after deployment.

A detection methodology that exploits the localized heating caused by the additional switching activity of a hardware trojan. High-resolution infrared cameras or lock-in thermography systems capture the thermal map of an operating chip, with anomalous hot spots indicating the presence of unexpected logic.

• Lock-In Thermography: Modulates the power supply at a known frequency and uses phase-sensitive detection to isolate trojan-induced thermal signatures from background noise
• Differential Thermal Analysis: Compares thermal profiles against a trusted golden chip under identical operating conditions
• Spatial Resolution Enhancement: Uses super-resolution techniques to localize heat sources to individual gate-level regions

Thermal methods are completely non-contact and non-destructive, making them ideal for screening high-value components without impacting their operational integrity.

A mathematical approach that rigorously proves whether a manufactured circuit's netlist or layout is functionally equivalent to its original specification. Unlike simulation-based methods, formal verification exhaustively explores the entire state space to guarantee the absence of malicious modifications.

• Combinational Equivalence Checking: Uses SAT solvers to prove that two gate-level netlists produce identical outputs for all possible inputs
• Sequential Equivalence Checking: Verifies that finite state machines have identical behavior across all reachable states and transitions
• Property Checking: Formally verifies security assertions—such as "no unauthorized memory access paths exist"—against the implemented design

Formal methods provide mathematical certainty but face scalability challenges with modern multi-billion-transistor designs, requiring hierarchical and compositional verification strategies.