Trojan Localization Using Information Flow Tracking Properties in SoC Designs

Complex systems-on-chip (SoCs) are designed by using several intellectual property cores (IPs) to reduce time-to-market. Malicious back-door or Trojan insertions by these third-party IP (3-PIP) vendors and untrustworthy EDA tools endanger SoC’s safety and security. It is thus crucial to develop strategies that automatically detect and localize these Trojans to a small portion of the SoC design. In this paper, we present a formal methodology where a variety of Trojans are injected into the design violating the information flow tracking properties of the design and perform Trojan localization using an extended iterative probing algorithm to obtain a concise set of suspicious signals. We perform our experimentation on an OpenRISC-1200 SoC to localize various types of Trojans injected to compromise the safety of 12 information flow properties. Localization is achieved by extracting various Trojan trigger scenarios. We bolster the effectiveness of the methodology with the help of certain critical figures of merit.