On hardware Trojan design and implementation at register-transfer level

There have been a number of hardware Trojan (HT) designs at register-transfer level (RTL) in the literature, which mainly describe their malicious behaviors and trigger mechanisms. Generally speaking, the stealthiness of the HTs is shown with extremely low sensitization probability of the trigger events. In practice, however, based on the fact that HTs are not sensitized with verification test cases (otherwise their malicious behaviors would have manifested themselves), designers could focus on verification corners for HT detection. Consequently, a stealthy HT not only requires to be hard to trigger, but also needs to be able to evade those hardware trust verification techniques based on “unused circuit identification (UCI)”. In this paper, we present new HT design and implementation techniques that are able to achieve the above objectives. In addition, attackers would like to be able to control their HTs easily, which is also considered in the proposed HT design methodology. Experimental results demonstrate that HTs constructed with the proposed technique are both hard to be detected and easy to be controlled when compared to existing HTs shown in the literature.