A Non-Reversible Insertion Method for Hardware Trojans Based on Path Delay Faults

This paper presents a non-reversible method for stealthily inserting hardware Trojan (HT) based on a path delay fault called Path Delay HT (PDHT). While PDHT is hardly detected by the conventional methods including Monte-Carlo tests, its practicality is still unclear because a rarely sensitized path used for PDHT is selected and exploited in a deterministic manner. Such deterministic method indicates that we can find possible PDHT-inserted paths by its reversed method. In addition, the conventional method uses a genetic algorithm to add extra delays onto the selected path for inducing a path delay fault, and therefore, we have a difficulty in evaluating the resistance/vulnerability of a circuit to PDHT. This paper first presents a new method for selecting sufficiently rare paths to insert PDHT at random. We then show that the detectability/stealthiness of PDHT is related to switching activity (i.e., glitch effect), and present a new systematic method for inducing a path delay fault instead of GA. We demonstrate through an experimental PDHT-insertion and a Monte-Carlo test that the PDHT inserted by our method is sufficiently undetectable in comparison with the conventional method.