DeTrust

TLDR

Hardware Trojans inserted during design pose a serious threat, and although existing verification techniques can flag many known backdoors, attackers may develop new Trojans that evade these methods. The paper proposes DeTrust, a systematic methodology for designing hardware Trojans that evade current verification techniques. DeTrust preserves the Trojan’s malicious function while creating stealthy implicit triggers by distributing trigger logic across multiple sequential and combinational levels and blending it with normal circuitry, making it indistinguishable from benign logic. Experiments demonstrate that DeTrust enables attackers to successfully bypass state‑of‑the‑art hardware trust verification.

Abstract

Hardware Trojans (HTs) inserted at design time by malicious insiders on the design team or third-party intellectual property (IP) providers pose a serious threat to the security of computing systems. Researchers have proposed several hardware trust verification techniques to mitigate such threats, and some of them are shown to be able to effectively flag all suspicious HTs implemented in the Trust-Hub hardware backdoor benchmark suite. No doubt to say, adversaries would adjust their tactics of attacks accordingly and it is hence essential to examine whether new types of HTs can be designed to defeat these hardware trust verification techniques. In this paper, we present a systematic HT design methodology to achieve the above objective, namely \emph{DeTrust}. Given an HT design, DeTrust keeps its original malicious behavior while making the HT resistant to state-of-the-art hardware trust verification techniques by manipulating its trigger designs. To be specific, DeTrust implements stealthy implicit triggers for HTs by carefully spreading the trigger logic into multiple sequential levels and combinational logic blocks and combining the trigger logic with the normal logic, so that they are not easily differentiable from normal logic. As shown in our experimental results, adversaries can easily employ DeTrust to evade hardware trust verification.