Advancing the state-of-the-art in hardware Trojans design

Electronic Design Automation (EDA) industry heavily reuses third party IP cores which are vulnerable to insertion of Hardware Trojans (HTs) at design time by third party IP core providers. State of the art research has shown that existing HT detection techniques, which claim to detect all publicly available HT benchmarks, can still be defeated by carefully designing new sophisticated HTs. The reason being that these techniques consider the HT landscape to be limited only to the publicly known HT benchmarks. However the adversary is not limited to these HTs and may devise new HT design principles to bypass these countermeasures. In this paper, we discover certain crucial properties of trigger activated HTs which lead to the definition of an exponentially large class of Deterministic Hardware Trojans H
_D
that an adversary can (but is not limited to) design. The discovered properties serve as HT design principles which help us understand the tremendous ways available to an adversary to design a HT, and show that the existing publicly known HT benchmarks are just the tip of the iceberg on this huge landscape.