Download - Trojans In SRAM Circuits
![Page 1: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/1.jpg)
Prepared for BTW’2014
Trojans In SRAM Circuits
Senwen Kan - AMD/SMUJennifer Dworak - SMU
![Page 2: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/2.jpg)
Overview
Background
Motivation
Trojan Design
Inserting Trojans in SRAM
Experimental Results
![Page 3: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/3.jpg)
Background
Israeli use of Electronic Warfare in “Operation Orchard” - 2007, disabled Syrian Air Defense Systems
Some Speculate “Kill Switch”
French Military Contractors have Intentionally built in “Kill Switch” in their military hardware
What are Trojans
Sequential Vs Combinational
Always on Vs Triggered on some condition
Leakage, Denial-of-Service (DoS)
3
![Page 4: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/4.jpg)
Why SRAMs?
Hard to Detect
Simple SRAM 32X32
32 Entries
32 bit wide
2^37 Terms to Trigger on Address lines and/or data
Space to Insert
![Page 5: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/5.jpg)
Why SRAMs (Cont)
SRAMs maybe external IP
SRAMs maybe used widely across an SoC, processor caches, register files, storing exception report, used by Crypto Units, FPGAs, & so on…
Can’t Synthesize to netlist (exception would be latch arrays)
Don’t have accurate ATPG Models
![Page 6: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/6.jpg)
Trojan Circuits
Trojan 1
Combinational
DoS
5 Sub Trojans
Once Triggered will Stay on
2 Payload Mechanisms
Tri-Stating
Scrambling
![Page 7: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/7.jpg)
Trojan Circuits (Cont)
Trojan 2
Sequential
DoS
Triggering Mechanism 2 part
Payload is Tri-Stating
![Page 8: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/8.jpg)
Trojan Circuits (Cont) Trojan 3
Combinational
Always on
DoS
Designed to be evasive
Good Design code:
assign data_in[W:0] = good_data[W:0];
Trojan’ed Design code
assign data_in[0] = good_data[0]^(good_data[W:0]==TrojanKeyWord);
assign data_in[W:1] = good_data[W:1];
Meant to make coverage tools not detect it - at least everything toggled
![Page 9: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/9.jpg)
Trojan Insertion
Selected 4 Types of industrial SRAMs
2 from OpenSparc Design Library
TSA - used by TLU for exceptions
Used by network interface
2 from Internal Design Library
Processor Data Caches
![Page 10: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/10.jpg)
Experimental Results
More Details in the Paper
But Essentially, 5 to 10 million cycles of Randomized Simulation can’t detect anything
Did 6N BIST Sims, not catching Anything
![Page 11: Trojans In SRAM Circuits](https://reader036.vdocument.in/reader036/viewer/2022081421/56813867550346895da016a4/html5/thumbnails/11.jpg)
Q&A