IP Library Granted Patent US 12,585,783
Granted Patent B2
US 12,585,783 · App. 17/191,038 · Granted Mar 24, 2026

Graph-based approach towards hardware trojan vulnerability analysis

Inventor: Sheikh Ariful Islam (Tampa, FL)
Assignee: UNIVERSITY OF SOUTH FLORIDA
G06F21/577G06F2221/034
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,585,783
App. No.
17/191,038
Granted
Mar 24, 2026
Kind
B2
Abstract

The present disclosure describes various embodiments of hardware trojan triggering (HTT) signal analysis. As such, an exemplary method comprises capturing switching activity of nodes for a design of an integrated circuit during a simulation of an application of a test pattern to the design; identifying one or more nodes in a graphical representation of the design that do not toggle within an individual window of time across multiple windows of time; determining unique paths that can be formed by the identified nodes within each of the multiple windows of time; determining one or more unique paths that occur across consecutive windows of time; appending the one or more unique paths that occur across consecutive windows of time in a set; and outputting the one or more unique paths in the set as rare trojan horse triggering paths for the design. Other systems and methods are also presented.

Claims (59)

1 . A non-transitory computer readable storage medium having instructions stored thereon that, in response to execution by a computing device, cause the computing device to:

detect a hardware trojan triggering signal in a design of an integrated circuit, using a graph-based analysis that is golden-design agnostic comprising:

performing a simulation of an application of a test pattern running on an integrated circuit having the design, which simulates gate-level activity of the integrated circuit;

capturing switching activity of nodes for the design of the integrated circuit during the simulation;

identifying one or more nodes in a graphical representation of the design that do not toggle within an individual window of time of a sequence of multiple, non-overlapping windows of time during the simulation, wherein each window of time has a same period comprising a predetermined time period of two or more consecutive clock cycles;

identifying a set of rare paths of the design for each window of the sequence of multiple, non-overlapping windows of time, wherein each rare path for a given window:

is comprised of two or more nodes identified as not having toggled within the given window;

has distinct endpoints which are not in the same graph level; and

is not a segment of a critical path of the design;

determining a subset of unique rare paths of the set of rare paths for each window of the sequence of multiple non-overlapping windows of time, wherein each unique rare path is not a segment of another rare path within a same window;

identifying one or more unique rare paths of the design that occur across consecutive windows of time;

appending the one or more unique rare paths that occur across the consecutive windows of time in a set of dominating unique rare paths; and

output the one or more unique rare paths in the set of dominating unique rare paths as rare trojan horse triggering paths for the design.

2 . The non-transitory computer readable medium of claim 1 , wherein the instructions further cause the computing device to:

determine a range of activation times for one of the rare trojan horse triggering paths; and

output the range of activation time for at least one of the rare trojan horse triggering paths.

3 . The non-transitory computer readable medium of claim 2 , wherein the range of activation times is determined by identifying a beginning for the range corresponding to a start point for an earliest one of the consecutive windows of time for the rare trojan horse triggering path and identifying an end for the range corresponding to an endpoint for a farthest one of the consecutive windows of time for the rare trojan horse triggering path.

4 . The non-transitory computer readable medium of claim 2 , wherein the instructions further cause the computing device to compare the range of activation times for the at least one of the rare trojan horse triggering paths with an activation time range of an existing hardware trojan horse instance and output an alert when the range of activation times matches with the activating time range of the existing hardware trojan horse instance.

5 . The non-transitory computer readable medium of claim 2 , wherein the graphical representation of the design comprises a netlist represented as a directed acyclic graph.

6 . A system comprising:

a processor; and

a memory having instructions that, when executed by the processor, cause the processor to:

detect a hardware trojan triggering signal in a design of an integrated circuit, using a graph-based analysis that is golden-design agnostic comprising:

performing a simulation of an application of a test pattern running on an integrated circuit having the design, which simulates gate-level activity of the integrated circuit;

capturing switching activity of nodes for the design of the integrated circuit during the simulation;

identifying one or more nodes in a graphical representation of the design that do not toggle within an individual window of time of a sequence of multiple, non-overlapping windows of time during the simulation, wherein each window of time has a same period comprising a predetermined time period of two or more consecutive clock cycles;

identifying a set of rare paths of the design for each window of the sequence of multiple, non-overlapping windows of time, wherein each rare path for a given window:

is comprised of two or more nodes identified as not having toggled within the given window;

has distinct endpoints which are not in the same graph level; and

is not a segment of a critical path of the design;

determining a subset of unique rare paths of the set of rare paths for each window of the sequence of multiple non-overlapping windows of time, wherein each unique rare path is not a segment of another rare path within a same window;

identifying one or more unique rare paths of the design that occur across consecutive windows of time;

appending the one or more unique rare paths that occur across the consecutive windows of time in a set of dominating unique rare paths; and

output the one or more unique rare paths in the set of dominating unique rare paths as rare trojan horse triggering paths for the design.

7 . The system of claim 6 , wherein the instructions further cause the processor to:

determine a range of activation times for one of the rare trojan horse triggering paths; and

output the range of activation time for at least one of the rare trojan horse triggering paths.

8 . The system of claim 7 , wherein the range of activation times is determined by identifying a beginning for the range corresponding to a start point for an earliest one of the consecutive windows of time for the rare trojan horse triggering path and identifying an end for the range corresponding to an endpoint for a farthest one of the consecutive windows of time for the rare trojan horse triggering path.

9 . The system of claim 7 , wherein the instructions further cause the processor to compare the range of activation times for the at least one of the rare trojan horse triggering paths with an activation time range of an existing hardware trojan horse instance and output an alert when the range of activation times matches with the activating time range of the existing hardware trojan horse instance.

10 . The system of claim 7 , wherein the graphical representation of the design comprises a netlist represented as a directed acyclic graph.

11 . A method comprising:

detecting, by a computing device, a hardware trojan triggering signal in a design of an integrated circuit, using a graph-based analysis that is golden-design agnostic comprising:

performing a simulation of an application of a test pattern running on an integrated circuit having the design, which simulates gate-level activity of the integrated circuit;

capturing switching activity of nodes for the design of the integrated circuit during the simulation;

identifying one or more nodes in a graphical representation of the design that do not toggle within an individual window of time of a sequence of multiple, non-overlapping windows of time during the simulation, wherein each window of time has a same period comprising a predetermined time period of two or more consecutive clock cycles;

identifying a set of rare paths of the design for each window of the sequence of multiple, non-overlapping windows of time, wherein each rare path for a given window:

is comprised of two or more nodes identified as not having toggled within the given window;

has distinct endpoints which are not in the same graph level; and

is not a segment of a critical path of the design;

determining a subset of unique rare paths of the set of rare paths for each window of the sequence of multiple non-overlapping windows of time, wherein each unique rare path is not a segment of another rare path within a same window;

identifying one or more unique rare paths of the design that occur across consecutive windows of time;

appending the one or more unique rare paths that occur across the consecutive windows of time in a set of dominating unique rare paths; and

outputting the one or more unique rare paths in the set of dominating unique rare paths as rare trojan horse triggering paths for the design.

12 . The method of claim 11 , further comprising:

determining, by the computing device, a range of activation times for one of the rare trojan horse triggering paths; and

outputting, by the computing device, the range of activation time for at least one of the rare trojan horse triggering paths.

13 . The method of claim 12 , wherein the range of activation times is determined by identifying a beginning for the range corresponding to a start point for an earliest one of the consecutive windows of time for the rare trojan horse triggering path and identifying an end for the range corresponding to an endpoint for a farthest one of the consecutive windows of time for the rare trojan horse triggering path.

14 . The method of claim 12 , further comprising comparing the range of activation times for the at least one of the rare trojan horse triggering paths with an activation time range of an existing hardware trojan horse instance and outputting an alert when the range of activation times matches with the activating time range of the existing hardware trojan horse instance.

15 . The method of claim 12 , wherein the graphical representation of the design comprises a netlist represented as a directed acyclic graph.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 11, 2021
From: ISLAM, SHEIKH ARIFUL
To: UNIVERSITY OF SOUTH FLORIDA
Reel/Frame 055568/0086 →
Continuity (2)
Provisional Application 62987670 · Mar 10, 2020
Related Publication 20210286881A1 · Sep 16, 2021
References Cited (67)
US 8176454B2 · Potkonjak · 2012 [cited by examiner]
US 8219946B1 · Manovit · 2012 [cited by examiner]
US 8402401B2 · Chakraborty · 2013 [cited by examiner]
US 9177119B2 · Potkonjak · 2015 [cited by examiner]
US 9513329B2 · Potkonjak · 2016 [cited by examiner]
US 9569582B2 · Arbel · 2017 [cited by examiner]
US 9916449B2 · Sethumadhavan · 2018 [cited by examiner]
US 10409994B1 · Kammler · 2019 [cited by examiner]
US 10614187B2 · Rajendran · 2020 [cited by examiner]
US 11144648B2 · Bhunia · 2021 [cited by examiner]
US 11270002B2 · Tehranipoor · 2022 [cited by examiner]
US 11449611B2 · Schat · 2022 [cited by examiner]
US 11568046B2 · Mishra · 2023 [cited by examiner]
US 11580265B2 · Mishra · 2023 [cited by examiner]
US 20110113392A1 · Chakraborty · 2011 [cited by examiner]
US 20120278893A1 · Jyothi · 2012 [cited by examiner]
US 20120317454A1 · Krenz-Baath · 2012 [cited by examiner]
US 20160098558A1 · Vedula · 2016 [cited by examiner]
US 20160098565A1 · Vedula · 2016 [cited by examiner]
US 20170228562A1 · Guilley · 2017 [cited by examiner]
US 20170310688A1 · Lecomte · 2017 [cited by examiner]
US 20180121585A1 · Cherupalli · 2018 [cited by examiner]
US 20180204002A1 · Khorrami · 2018 [cited by examiner]
US 20180357345A1 · Cherupalli · 2018 [cited by examiner]
US 20190347417A1 · Tehranipoor · 2019 [cited by examiner]
US 20200104485A1 · Crouch · 2020 [cited by examiner]
US 20200302064A1 · Bhunia · 2020 [cited by examiner]
US 20200326373A1 · Dickens · 2020 [cited by examiner]
US 20200387601A1 · Schat · 2020 [cited by examiner]
US 20210003630A1 · Mishra · 2021 [cited by examiner]
US 20210049266A1 · Schat · 2021 [cited by examiner]
US 20210097220A1 · Bhunia · 2021 [cited by examiner]
CN 112685800A · 2021 [cited by examiner]
WO WO2014144857A2 · 2014 [cited by examiner]
WO WO2020150448A1 · 2020 [cited by examiner]
X. Zhang and M. Tehranipoor, “Case study: Detecting hardware Trojans in third-party digital IP cores,” 2011 IEEE International Symposium on Hardware-Oriented Security and Trust, San Diego, Ca, USA, 2011, pp. 67-70, doi:… [cited by examiner]
E.-R. Zhou, S. -Q. Li, J. -H. Chen, L. Ni, Z. -X. Zhao and J. Li, “A Novel Detection Method for Hardware Trojan in Third Party IP Cores,” 2016 International Conference on Information System and Artificial Intelligence (… [cited by examiner]
J. Cruz, F. Farahmandi, A. Ahmed and P. Mishra, “Hardware Trojan Detection Using ATPG and Model Checking,” 2018 31st International Conference on VLSI Design and 2018 17th International Conference on Embedded Systems (VL… [cited by examiner]
Xiaotong Cui, Elnaz Koopahi, Kaijie Wu, and Ramesh Karri. 2018. Hardware Trojan Detection Using the Order of Path Delay. J. Emerg. Technol. Comput. Syst. 14, 3, Article 33 (Jul. 2018), 23 pages. https://doi.org/10.1145/… [cited by examiner]
Ranjbar, O., Bayat-Sarmadi, S., Pooyan, F. et al. A Unified Approach to Detect and Distinguish Hardware Trojans and Faults in SRAM-based FPGAs. J Electron Test 35, 201-214 (2019). https://doi.org/10.1007/s10836-019-0578… [cited by examiner]
S. Narasimhan, X. Wang, D. Du, R. S. Chakraborty and S. Bhunia, “TeSR: A robust Temporal Self-Referencing approach for Hardware Trojan detection,” 2011 IEEE International Symposium on Hardware-Oriented Security and Trus… [cited by examiner]
Basak Chowdhury, A. (2016). Optimized ATPG for hardware trojan detection (Doctoral dissertation, Indian Statistical Institute, Kolkata). [cited by examiner]
X. Chen et al., “Hardware Trojan Detection in Third-Party Digital Intellectual Property Cores by Multilevel Feature Analysis,” in IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 37, N… [cited by examiner]
Q. Liu, P. Zhao and F. Chen, “A Hardware Trojan Detection Method Based on Structural Features of Trojan and Host Circuits,” in IEEE Access, vol. 7, pp. 44632-44644, 2019, doi: 10.1109/Access.2019.2908088. [cited by examiner]
Shakya, B., He, T., Salmani, H., Forte, D., Bhunia, S., & Tehranipoor, M. (2017). Benchmarking of hardware trojans and maliciously affected circuits. Journal of Hardware and Systems Security, 1, 85-102. [cited by examiner]
S. Deyati, B. J. Muldrey and A. Chatterjee, “Trojan detection in digital systems using current sensing of pulse propagation in logic gates,” 2016 17th International Symposium on Quality Electronic Design (ISQED), Santa … [cited by examiner]
Banga et al., Guided Test Generation for Isolation and Detection of Embedded Trojans in ICs, in Proceedings of the 18th ACM Great Lakes Symposium on VLSI, 2008, pp. 363-366. [cited by applicant]
Cha et al., Efficient Trojan Detection Via Calibration of Process Variations, in 2012 IEEE 21st Asian Test Symposium, pp. 355-361. [cited by applicant]
Chakraborty et al., MERO: A Statistical Approach for Hardware Trojan Detection, in International Workshop on Cryptographic Hardware and Embedded Systems, 2009, pp. 396-410. [cited by applicant]
Cherupalli et al., Graph-Based Dynamic Analysis: Efficient Characterization of Dynamic Timing and Activity Distributions, in 2015 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pp. 729-735. [cited by applicant]
Cruz et al., An Automated Configurable Trojan Insertion Framework for Dynamic Trust Benchmarks, in 2018 Design, Automation & Test in Europe Conference & Exhibition, pp. 1610-1615. [cited by applicant]
Exurville et al., Resilient Hardware Trojans Detection Based on Path Delay Measurements, in 2015 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), pp. 151-156. [cited by applicant]
Hu et al., Detecting Hardware Trojans with Gate-Level Information-Flow Tracking, Computer (Published by the IEEE Computer Society), Aug. 2016, pp. 44-52. [cited by applicant]
Huang et al., MERS: Statistical Test Generation for Side-Channel Analysis Based Trojan Detection, iIn Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 130-141. [cited by applicant]
Islam et al., Empirical Word-Level Analysis of Arithmetic Module Architectures for Hardware Trojan Susceptibility, in 2018 Asian Hardware Oriented Security and Trust Symposium (AsianHOST), pp. 109-114. [cited by applicant]
Ismari et al., On Detecting Delay Anomalies Introduced by Hardware Trojans, in 2016 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pp. 1-7. [cited by applicant]
Jin et al., Hardware Trojan Detection Using Path Delay Fingerprint, in 2008 IEEE International Workshop on Hardware-Oriented Security and Trust, pp. 51-57. [cited by applicant]
Lamech et al., Trojan Detection Based on Delay Variations Measured Using a High-Precision, Low-Overhead Embedded Test Structure, in 2012 IEEE International Symposium on Hardware-Oriented Security and Trust, pp. 75-82. [cited by applicant]
Li et al., At-Speed Delay Characterization for IC Authentication and Trojan Horse Detection, in 2008 IEEE International Workshop on Hardware-Oriented Security and Trust, pp. 8-14. [cited by applicant]
Rai et al., Performance of Delay-Based Trojan Detection Techniques Under Parameter Variations, in 2009 IEEE International Workshop on Hardware-Oriented Security and Trust (HOST), pp. 58-65. [cited by applicant]
Salmani et al., Layout-Aware Switching Activity Localization to Enhance Hardware Trojan Detection, IEEE Transactions on Information Forensics and Security, 2012, 7(1):76-87. [cited by applicant]
Salmani et al., A Novel Technique for Improving Hardware Trojan Detection and Reducing Trojan Activation Time, IEEE Transactions on Very Large Scale Integration (VLSI) Systems, 2012, 20(1):112-125. [cited by applicant]
Savnik, Index Data Structure for Fast Subset and Superset Queries, in International Conference on Availability, Reliability, and Security, 2013, pp. 134-148. [cited by applicant]
Wolff et al., Towards Trojan-Free Trusted ICs: Problem Analysis and Detection Scheme, in 2008 Design, Automation and Test in Europe, IEEE, pp. 1362-1365. [cited by applicant]
Xiao et al., A Clock Sweeping Technique for Detecting Hardware Trojans Impacting Circuits Delay, IEEE Design & Test, 2013, 30(2):26-34. [cited by applicant]
Yoshimizu, Hardware Trojan Detection by Symmetry Breaking in Path Delays, in 2014 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), pp. 107-111. [cited by applicant]
Zhang et al., Path-Delay Fingerprinting for Identification of Recovered ICs, in 2012 IEEE International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFT), pp. 13-18. [cited by applicant]