Enhancing Trojan Detection by Finding LTL and Taint Properties in RTL Circuit Designs: A Case Study

The advent of multi-vendor participation for circuit design has introduced new hardware security concerns, mainly, exploitation of code bugs and insertion of malicious circuits (Hardware Trojans). In this work, we detect register transfer language (RTL) Trojan designs using Linear-time Temporal Language (LTL) and Taint Propagation (TP) to verify components and signal paths on suspicious circuits. We demonstrate that LTL methods can detect denial of service (DoS), data leak, and change of functionality attacks while TP methods can detect DoS, and data leak attacks. Some Trojans can also be described as an LTL and a Taint problem which allows multiple tools to be used for security validation and improves the odds of detecting Trojan vulnerabilities.