IEEE Consumer Electronics Magazine - November/December 2020 - 75

Figure 2. Comprehensive hardware Trojan taxonomy.10

manufacturing process, thereby necessitating verification strategies that can help in the early detection of both unintentional and intentional bugs.
Trusted Fabrication: The physical design of
the IC, once available, is sent to the foundry for
fabrication. The challenges of manufacturing
large-scale complex designs with strict quality
constraints at shrinking nanometer technology
have caused most of the design houses to rely
on external fabrication facilities for manufacturing their ICs. For instance, the SoCs used by
Apple for their latest phones have been manufactured in an external foundry located in a foreign
country.6 The fabrication of a design at a foreign
foundry again poses trust issues due to the possibility of malicious alterations of the design
before fabrication. Due to the availability of the
physical design for fabrication, an adversary at
the untrusted facility could utilize the unused
space within the layout or modify the gates and
interconnects of the existing design to integrate
malicious logic. Observing such modifications
requires destructive reverse engineering of the
fabricated IC. Since complete reverse engineering of the IC involves various expensive and
time-consuming steps, it is not feasible for verifying all suspect ICs. Furthermore, post-silicon verification/test, which checks the functionality and
looks for physical defects, only exercises a small
portion of the extremely large input space that
exists in modern ICs, and hence, not suitable for
triggering and observing Trojan impact that is
tailored to activate at a very rare instance. After
the fabricated ICs are tested and packaged, they
are assembled in a board-level system. The
assembly process, again, could take place in a
facility other than the original designer of the
product. For example, Apple iPhones are

November/December 2020

commonly assembled by third-party vendors situated in foreign countries.7 Hardware Trojans
can be integrated even during the assembly process of the Printed Circuit Board (PCB) by altering the trace parameters or by introducing new
components within the internal layers of the circuit board.8 The final product is made available
to the market after assembling and testing.
When the product is finally in the field, the
adversary can activate the Trojan by sending
specific input signals to the system or component containing the alteration. The Trojan could
also be designed to automatically activate after
a specific period (e.g., time bomb) or at a particular operating condition (e.g., temperature, supply voltage).9

Trust Issues at Various Stages
Hardware Trojans can be classified based on
attributes such as abstraction level of the design,
phase of insertion in the supply chain, trigger
mechanism, the impact of activation, and location
of insertion. Figure 2 illustrates a comprehensive
taxonomy presented in this work.10 We observe
that the Trojan logic could be introduced at any
abstraction of the design and can be modified to
produce different malicious outcomes based on
the various payload mechanisms. For instance, the
Trojan in Figure 3(a) inverts the state of a critical
signal Corg when a set of internal signals in the
design A; B; C; D become logic high simultaneously. Figure 3(b) illustrates a modification in
the layout of a cache memory array where the payload causing a conditional incorrect read is
designed by shorting the bit line to the ground.11
The design consideration for the attacker
while inserting the Trojan varies depending on
the threat model. For example, an attacker at

75
IEEE Consumer Electronics Magazine - November/December 2020

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - November/December 2020
