Simple tri-state logic Trojans able to upset properties of ring oscillators

Inserting hardware Trojans (HT) in ring oscillators (RO) of integrated systems is a malicious method that can considerably modify the behaviour of system circuits to produce undesired operations. This work presents and demonstrates three still unknown types of transistor-level Trojans based on the classic tri-state logic. If triggered, the presented HT are able to substantially change the jitter and frequency of RO. If disabled, thanks to their tri-state logic and tiny sizes, the circuit behaviour is not significant modified, making the Trojan detection through conventional functional testing or side-channel analysis unlikely. Results show the typical frequency of a 7-stage RO in CMOS 65-nm technology is kept within process corners if HT is off, and it is decreased by a factor of up to 0.7 when HT is on.