COVERT: Trojan Detection in COTS Hardware via Statistical Activation of Microarchitectural Events
By Mahmudul Hasan 1, Sudipta Paria 2, Swarup Bhunia 2 and Tamzidul Hoque 1
1 Department of Electrical Engineering and Computer Science, University of Kansas, Lawrence, KS 66045, USA
2 Department of Electrical and Computer Engineering, University of Florida, Gainesville, FL 32611, USA
Abstract
Commercial Off-The-Shelf (COTS) hardware, such as microprocessors, are widely adopted in system design due to their ability to reduce development time and cost compared to custom solutions. However, supply chain entities involved in the design and fabrication of COTS components are considered untrusted from the consumer’s standpoint due to the potential insertion of hidden malicious logic or hardware Trojans (HTs). Existing solutions to detect Trojans are largely inapplicable for COTS components due to their black-box nature and lack of access to a golden model. A few studies that apply require expensive equipment, lack scalability, and apply to a limited class of Trojans. In this work, we present a novel golden-free trust verification framework, COVERT, for COTS microprocessors, which can efficiently test the presence of hardware Trojan implants by identifying microarchitectural rare events and transferring activation knowledge from existing processor designs to trigger highly susceptible internal nodes. COVERT leverages Large Language Models to automatically generate test programs that trigger rare microarchitectural events, which may be exploited to develop Trojan trigger conditions. By deriving these events from publicly available Register Transfer Level implementations, COVERT can verify a wide variety of COTS microprocessors that inherit the same Instruction Set Architecture. We have evaluated the proposed framework on open-source RISC-V COTS microprocessors and demonstrated its effectiveness in activating combinational and sequential Trojan triggers with high coverage, highlighting the efficiency of the trust verification. By pruning rare microarchitectural events from mor1kx Cappuccino OpenRISC processor design, COVERT has been able to achieve more than 80% trigger coverage for the rarest 5% of events in or1k Marocchino and PicoRV32 as COTS processors.
Index Terms — Trojan Detection, Test Generation, Microarchitectural Events, COTS, Combinational and Sequential Trojans.
To read the full article, click here
Related Semiconductor IP
- DFI 6.0 Verification IP
- TSMC 7nm 0V75 / 0V9 ESD Local Clamp – Low Cap
- TSMC 65nm 3V3 ESD Local Clamp – Rad Hard
- TSMC 5nm 1V8, 1.2V and 0.9V ESD Local Protection – Low Cap
- TSMC 3nm 3V3 ESD Local Clamp
Related Articles
- DRsam: Detection of Fault-Based Microarchitectural Side-Channel Attacks in RISC-V Using Statistical Preprocessing and Association Rule Mining
- A Survey on the Design, Detection, and Prevention of Pre-Silicon Hardware Trojans
- TROJAN-GUARD: Hardware Trojans Detection Using GNN in RTL Designs
- The Growing Imperative Of Hardware Security Assurance In IP And SoC Design
Latest Articles
- Hardware Acceleration of Block-Diffusion LLM for Edge Devices
- Scalable AXI4 Transaction Monitoring for Mixed-Criticality SoCs: From Phase-Level Precision to ID-Level Efficiency
- Hardware-managed heterogeneous high-bandwidth memory and flash in LLM inference systems
- LACE: Large Language Model Aided Multi-Agent Framework for Agile RISC-V Instruction Extension
- A Process-Aware Hybrid Si/IGO Monolithic-3D 6T SRAM with BEOL Pass-Gates for the 2nm Node