Enabling unauthorized RF transmission below noise floor with no detectable impact on primary communication performance

With increasing diversity of supply chains from design to delivery, there is an increasing risk of unauthorized changes within an IC. One of the motivations for this type change is to learn important information (such as encryption keys, spreading codes) from the hardware and pass this information to a malicious party through wireless means. In order to evade detection, such unauthorized communication can be hidden within legitimate bursts of transmit signal. In this paper, we present a stealth circuit for unauthorized transmissions which can be hidden within the legitimate signal. A CDMA-based spread spectrum with a CDMA encoder is implemented with a handful of transistors. We show that the unauthorized signal does not alter the circuit performance while being easily detectable by the malicious receiver.