Analog Hardware

Trojan
Aaron Haywood
Richard Jiles

What is a hardware Trojan?

Circuits with multiple operating regions
Generally the other modes are hidden
Must be prevented from reaching market!
Hardware Trojans can be implemented at various stages
of the IC build process
Do you trust your fab workers after you outsourced?

Analog Hardware Trojan

Potential circuit-based security vulnerability
Dual modes of operation at normal operating temperatures

<<<<<insert picture of Vout>>>>>

Regular Output

Trojan Output

Circuit Design
Widlar Reference Generator
Developed by Bob Widlar, circuit designer at Fairchild and National
Semiconductor

Common bias generator

<<<<insert circuit schematic >>>>>

Triggering the Alternate State

Voltage and Temperature Hysteresis.
Exploitable through temperature controls

Incorrect
Result!
A Trojan is not
easy to find,
thats why its
a Trojan!

Triggering the Results

Schematic setup and testing

Using convergence aides

These help set initial conditions of a schematic
Even then, using
the correct
values to trigger
a circuit is not
easy.

Correct settings
V2 & V4 = 0V

Inverter Inputs = 5V

But thats not it!

You will only get the forward direction (increasing
temperature with this. You must append negative
results.
You must select to sweep backward

Confirmed Results
Now with the two modes of operation confirmed we can
move onto the layout form
175 Degrees C
11 Degrees C

Layout formation
Industry Standard?
No!
It works, but can be optimized
Moving the vertical transistors
into a horizontal direction

Proof of LVS
DRC errors corrected
Extracted the layout
Verified its integrity
Dont believe us?
Ask for a live demo!
(Seriously though, it took a long time)

What are the threats?

These properties of a circuit can be exploited!

Exact Exploitation Method

A temperature-controlled biasing circuit?

Potential solutions
Output monitoring
Temperature based shutdown
Turn off the circuit at 170 degrees with the given
devices
Most generic solder melts at 220C 450C