On the Detection and Circumvention of Bitstream-level Trojans in FPGAs

The hardware Trojan problem is the manifestation of the arms race between the attacker and the defender, where each party tries to innovate the corresponding methodologies. This work mainly focuses on the two aspects of hardware Trojans in reconfigurable systems: the defender's perspective that corresponds to the bitstream-level Trojan detection technique, and the attacker's perspective that corresponds to a novel FPGA Trojan attack. From the defender's perspective, we introduce a first-ever successful pre-configuration countermeasure against the “Malicious LUT”-hardware Trojan, by employing bitstream-level Proof-Carrying Hardware (PCH) and present the complete design-and-verification flow for iCE40 FPGAs. Likewise, from an attacker's perspective, we present a novel attack that leverages malicious routing of the inserted Trojan circuit to acquire a dormant state even in the generated and transmitted bitstream. Since the Trojan is injected in a post-synthesis step and remains unconnected in the bitstream, the presented attack can currently neither be prevented by conventional testing and verification methods nor by bitstream-level verification techniques.