Chip Trojan Test Set Generation Method Based on Vulnerability Analysis

Abstract

The application discloses a chip Trojan horse test set generation method based on vulnerability analysis, which comprises the following steps: first, a register transfer level (RTL) code of a circuit is used to obtain a chip layout result, and a chip layout information point set is obtained from the chip layout result; then, a layout space margin and a routing channel margin after chip layout wiring is completed are analyzed to obtain a chip layout vulnerability matrix; and finally, a vulnerable point in the chip layout vulnerability matrix is selected for hardware Trojan horse implantation to generate a chip layout level hidden hardware Trojan horse test set. The application analyzes physical resources such as a layout space margin and a routing channel margin of a chip layout, analyzes power consumption characteristics of the chip layout on the basis, designs a vulnerability index of the chip layout, selects a vulnerable point, and obtains a chip layout hidden by a hardware Trojan horse, namely, a chip Trojan horse test set. The application promotes the development of a hardware Trojan horse detection technology and improves the defense capability of a chip.

Description

Technical Field

[0001] The present invention belongs to the field of hardware security, and in particular relates to a chip Trojan test set generation method based on vulnerability analysis. Background Art

[0002] Hardware Trojans are malicious modifications or additions to the underlying hardware circuits. They can modify circuit logic, steal user information, and destroy circuit functions. They are extremely destructive (Reference: "Hardware Trojan: Threats and emerging solutions", R.S. Chakraborty, N. Seetharam and B. Swarup, Proceedings of the 14th I EEE International High Level Design Validation and Test Workshop, pp. 166-171, 2009). They are also flexible in insertion and concealed in their locations, which can seriously affect chip functions. This quickly attracted a large number of researchers to the field of hardware Trojan detection and design. Mark et al. (reference: "Benchmarking of hardware trojans and maliciously affected circuits", B. Shakya, T. He, H. Salmani, et al., Journal of Hardware and Systems Security, 2017, 1(1):85-102) developed a classification standard for hardware Trojans after detailed discussion and designed the Trus tHub standard test suite, which greatly promoted the advancement of hardware Trojan detection technology. Thanks to the efforts of scientific researchers, the detection accuracy of hardware Trojan detection technology has become increasingly higher. However, existing hardware Trojan test suites are increasingly insufficient to support the further development of detection technology, and designers are required to design more covert test suites.

[0003] In 2010, Zhang Peng et al. (reference: "Hardware Trojan Design Based on Electromagnetic Leakage Correlation Analysis", Zhang Peng, Zou Cheng, Deng Gaoming, Chen Kaiyan, Hardware Trojan Design Based on Electromagnetic Leakage Correlation Analysis, Journal of Huazhong University of Science and Technology (Natural Science Edition), 2010, 38(10):22-25. DOI:10.13245 / j.hust.2010.10.012) used spread spectrum communication technology to reduce the electromagnetic radiation of Trojan devices by performing spread spectrum modulation on the encrypted data in the chip, and extracted the encrypted data through correlation analysis, thus completing the Trojan implantation in the Advanced Encryption Standard circuit. In 2014, Byeongju et al. (reference: “A Resizing Method to Minimize Effects of Hardware Trojans”, B. Cha and S. K. Gupta, 2014 IEEE 23rd Asian Test Symposium, 2014, pp. 192-199, doi: 10.1109 / ATS.2014.44) proposed a new Trojan circuit design method. This method minimizes the impact of the Trojan circuit on the parent circuit by adjusting the size of the gate circuit, and reduces the impact of the Trojan circuit on the path delay by rearranging the gates. In 2021, Wu Lingjuan et al. (reference: "Design and detection of hardware Trojans based on satisfiability irrelevant items", Wu Lingjuan, Zhu Jiacheng, Tang Shibo et al., "Journal of Network and Information Security", 2021, 7(02): 35-42) hid lightweight hardware Trojans in satisfiability irrelevant items that were not covered when the circuit was working normally, making the circuit after the Trojan was implanted completely equivalent to the original circuit function.

[0004] The present invention first extracts information and performs topological structure analysis on the chip layout, and based on the layout vulnerability analysis results, proposes a new method for generating a hardware Trojan test set. Summary of the Invention

[0005] Based on the results of chip layout vulnerability analysis, this paper proposes a method for hiding hardware Trojans at the chip layout level, ultimately resulting in a robust chip Trojan test set. The hardware Trojans in this test set are highly concealed, which can promote the development of hardware Trojan detection technology and enhance chip defense capabilities.

[0006] The present invention proposes a chip Trojan test set generation method based on vulnerability analysis, which includes the following contents:

[0007] S1) Steady-state temperature information extraction

[0008] Obtain the register transfer level RTL (RTL) design code of a circuit, use EDA (Electronic Design Automation, EDA) tools to complete the logic design and physical design of the RTL circuit, obtain the chip layout results, analyze the chip layout results, write auxiliary scripts, and finally obtain the chip layout information point set N = {n1, n2, ..., n l×r}, where the vth chip layout information point n v Corresponding to any v-th chip layout area, v = 1, 2, ..., l × r; l and r represent the number of units divided horizontally and vertically in the chip layout respectively; calculate any chip layout information point n v Steady-state information, that is, steady-state temperature Steady-state arrival time And the steady-state information of the chip layout information points is summarized as a steady-state feature vector:

[0009]

[0010] in, Indicates that the steady-state temperature and steady-state arrival time Splicing to form chip layout information point n v After the steady-state feature extraction of each chip layout information point is completed, the vulnerable point analysis of the chip layout can be carried out;

[0011] S2) Chip Layout Vulnerability Analysis

[0012] According to the standard library design principles, the chip physical design stage will go through several key steps: layout planning, layout and routing. In the layout planning stage, the EDA tool will map the logical description of the chip in the netlist to the physical description of the chip layout and optimize indicators such as device interconnection. In the subsequent layout and routing process, the EDA tool will place the standard library cells on the chip layout and use the metal layer routing channels to complete the device interconnection. After the chip layout routing is completed, the layout space margin and routing channel margin are analyzed, and the minimum standard cell area in the current standard cell library is recorded as S min , chip layout area n v , that is, chip layout information point n v The layout space margin is The routing channel allowance is but:

[0013]

[0014] in, is the chip layout area n vThe vulnerability index of hardware Trojans can be implanted. By analyzing each information point of the entire chip layout as above, we can obtain the chip layout vulnerability matrix:

[0015]

[0016] The smaller the chip, the less resources the chip layout has, and the harder it is to insert a hardware Trojan. However, compact layout resources also increase the area n. v Physical field parameters make hardware Trojan detection more difficult;

[0017] After completing the vulnerability analysis of the entire chip layout, you can start generating test sets;

[0018] S3) Test set generation

[0019] Arrange the vulnerability index of each chip layout information point in the chip layout vulnerability matrix CV in ascending order when the hardware Trojan is implanted, select the chip layout information points corresponding to the first q vulnerability indices as the vulnerable points, and implant the hardware Trojan, where q≤l×r and q is a positive integer;

[0020] These q vulnerable points constitute the chip layout information point set N1, also known as the chip layout area N1. Taking N1 as the target implantation area, a set of hardware Trojan devices are implanted into N1 to generate a chip Trojan test set based on vulnerability analysis.

[0021] In the present invention, the chip Trojan test set refers to the chip layout result after the hardware Trojan device is hidden at the chip layout level. Therefore, the focus of the automatic construction method of the chip Trojan test set is the design of the hardware Trojan layout-level hiding method. The present invention designs the vulnerability index of the chip layout by analyzing the physical resources such as the layout space margin and the wiring channel margin of the chip layout, and on this basis, combining the analysis of the power consumption characteristics of the chip layout. On the basis of obtaining the chip layout vulnerability matrix, the low vulnerability index points of the chip layout, that is, the vulnerable points, are selected for hardware Trojan implantation and hiding, and the chip layout after the hardware Trojan is hidden is obtained, that is, the chip Trojan test set. The present invention provides a better chip Trojan test set automatic construction method, which can promote the development of hardware Trojan detection technology and enhance the defense capability of the chip. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is the overall flow chart of the test set generation method of the present invention;

[0023] Figure 2 This is a flowchart of the hardware Trojan implantation process of the present invention;

[0024] Figure 3 This is the analysis result of the chip layout area N1 of the present invention;

[0025] Figure 4 This is a schematic diagram of the L' region of the present invention;

[0026] Figure 5 This is a schematic diagram of the adjacency relationship of the standard devices of the present invention;

[0027] Figure 6 This invention v The position correspondence diagram with the N1 area. DETAILED DESCRIPTION

[0028] The following is a more detailed description of the embodiments of the present invention with reference to the accompanying drawings and reference numerals, so that those skilled in the art can implement the embodiments according to the present invention after studying the present description. It should be understood that the embodiments described in this example are only for explaining the present invention and are not intended to limit the present invention.

[0029] The present invention targets the chip layout after the physical design is completed. First, vulnerability analysis is performed on the chip layout after the layout is completed to confirm the hidden position of the hardware Trojan; then, the offset vector is set through the Electronic Design Automation (EDA) tool to complete the relocation of the hardware Trojan unit, while minimizing the impact of the Trojan implant on the parent circuit and improving the concealment of the hardware Trojan on the chip; finally, the subsequent physical design processes such as wiring and clock tree synthesis are completed on the updated layout to obtain a test set with better concealment. The overall process of the chip Trojan test set generation method based on vulnerability analysis proposed by the present invention is as follows: Figure 1 shown.

[0030] Given a circuit's register-transfer level (RTL) design code, the specific steps for vulnerability analysis and constructing a chip Trojan test set are as follows:

[0031] (1) Steady-state temperature information extraction

[0032] Use EDA tools to complete the logic design and physical design of the RTL circuit and obtain the chip layout results. Analyze the chip layout results, write auxiliary scripts, and finally obtain the chip layout information point set N = {n1, n2, ..., n l×r}, where the vth chip layout information point n v (v=1,2,...,l×r) corresponds to any v-th chip layout area, as follows Figure 6 As shown; l and r represent the number of units divided horizontally and vertically in the chip layout respectively. Calculate each chip layout information point n v Steady-state information, that is, steady-state temperature Steady-state arrival time The steady-state information of each chip layout information point is summarized as a steady-state eigenvector:

[0033]

[0034] in, Indicates that the steady-state temperature and steady-state arrival time Splicing to form chip layout information point n v After completing the chip layout for each information point n v After the steady-state feature vector is extracted, the vulnerability analysis of the chip layout can be performed.

[0035] (2) Layout Vulnerability Analysis

[0036] According to the standard library design principles, the physical design stage of the chip will go through several key steps: layout planning, layout and routing. In the layout planning stage, the EDA tool will map the logical description of the chip in the netlist to the physical description of the chip layout and optimize indicators such as device interconnection. In the subsequent layout and routing process, the EDA tool will place the standard library cells on the chip layout and use the metal layer routing channels to complete the device interconnection. Here, we analyze the layout space margin and routing channel margin after the layout routing is completed, and record the minimum standard cell area in the current standard cell library as S min , chip layout area n v (i.e. chip layout information point n v )’s layout space margin is The routing channel allowance is but:

[0037]

[0038] in, is the chip layout area n v The vulnerability index of hardware Trojans. By analyzing each information point of the entire chip layout as above, we can get the chip layout vulnerability matrix:

[0039]

[0040] The smaller the chip, the less resources it has in the chip layout, and the harder it is to insert a Trojan. However, compact layout resources also increase the area n. v physical field parameters, making Trojan detection more difficult.

[0041] After completing the vulnerability analysis of the entire chip layout, you can start generating test sets.

[0042] (3) Test set generation

[0043] A chip Trojan test set based on vulnerability analysis refers to the chip layout results after hardware Trojan devices are hidden on the chip layout. This method analyzes the chip layout containing the hardware Trojan and, through a concealment method, modifies the original layout of the devices to distribute and hide the Trojan devices at vulnerable points on the chip layout. The physical design process after the layout is completed using EDA tools, ultimately resulting in the chip layout results after the hardware Trojan is hidden at the chip vulnerable points, i.e., the chip Trojan test set based on vulnerability analysis.

[0044] Arrange the vulnerability index of each chip layout information point in the chip layout vulnerability matrix CV in ascending order when the hardware Trojan is implanted, select the chip layout information points corresponding to the first q vulnerability indices as the vulnerable points, and implant the hardware Trojan, where q≤l×r and q is a positive integer;

[0045] These q vulnerable points form a chip layout information point set (chip layout area) N1, The process of implanting a set of hardware Trojan devices into N1 as the target implant area is as follows: Figure 2 shown.

[0046] Figure 2 The following three steps are mainly completed:

[0047] Step 1: Layout topology analysis

[0048] For the chip layout area N1, the EDA tool is used to extract the original device set A on N1. The size of set A is set to c1. Set A includes all devices on the chip layout area N1. Specifically, it is divided into logic devices and non-logic devices tapfillers. All devices in the present invention can be called standard devices, because the devices used in chip design are taken out from the standard cell library. And record the adjacent devices, coordinates p, width w and other information of each standard device in set A, thereby extracting the chip layout topology. After the chip layout topology structure is extracted, the blank layout space set between each two adjacent devices can be obtained, which is called S. The size of set S is c0, as shown in Figure 3 As shown. Record the coordinates p and width w of element s in set S.

[0049] Figure 3In the context of the present invention, a tapfiller is a special non-logical device implanted during the layout generation process of the EDA tool to eliminate the latch-up effect of the chip. Specifically, the tapfiller applies a bias voltage to the substrate at a fixed interval to reduce the parasitic resistance of the substrate, preventing the transistor voltage from reaching the conduction requirement, thereby cutting off the positive feedback loop of the latch-up effect and eliminating the latch-up effect. Therefore, when making layout changes to the layout, the present invention treats the tapfiller as an immovable device and does not change the coordinate position of the tapfiller device.

[0050] In addition, the topology reconstruction results after the layout topology structure analysis is completed are given in set A, taking three standard devices cell1, cell2, and cell3 as an example, as shown in Figure 4 shown. Figure 4 In the , w represents the device width; p represents the device coordinates; left represents the adjacent device on the left side of the device, and right represents the adjacent device on the right side of the device. When left or right is None, it means that there is no adjacent device on the left or right side of the current device; fixed represents whether the current device is movable. If fixed is false, the device is movable. If fixed is true, the current device cannot be moved and the layout position cannot be changed. Figure 4 This shows that after extracting the chip layout information, this step reconstructs the basic information and adjacency relationship of the devices in set A, providing a guarantee for subsequent Trojan implantation.

[0051] After the layout topology analysis is completed, the hardware Trojans can be implanted in sequence.

[0052] Step 2: Implant in sequence

[0053] Based on the standard library design principle, EDA tools will place standard devices of equal height in rows on the chip layout. Therefore, the present invention converts the size and area analysis of devices on the chip layout into a direct analysis of the width w of each device.

[0054] First, the script processes the information report to obtain the hardware Trojan device set T. The size of set T is set to c3. The largest device size in set T is obtained. Since standard devices are all of the same height, the width w of each device element in set T can be directly compared. The width of the largest Trojan device in set T is recorded as w t-max Then, check the chip layout division result in step (1), and record the width of N1 area as w n-max If w t-max >w n-max, then it is determined that there are devices in the set T that cannot be implanted in area N1, and the device layout cannot be completed. It is necessary to reduce the chip layout granularity, set l = l-1, r = r-1, and then jump to step (1) to re-divide the chip layout. t-max ≤w n-max , the hardware Trojan device can be implanted using the sequential implantation method.

[0055] The specific steps for implanting a hardware Trojan device using the sequential implantation method are as follows:

[0056] a) Sort the elements in sets S and T in descending order of width w to obtain an ordered queue where s j Represents an ordered queue Q S The elements with the sequence number j are sorted from large to small in the middle width, t j′ Represents an ordered queue Q T Sort the elements numbered j′ in the middle width from largest to smallest, j=1,2,...,c0, j′=1,2,...,c3, and then jump to step b).

[0057] b) If Q T If Q is empty, jump to step c). T Not empty but Q S If Q is empty, the sequential implantation method ends directly. T , Q S When both are not empty, take Q S , Q T The first element of the team is denoted as s0, t0. The width of s0 is The coordinates are The width of t0 is The coordinates are like Then remove s0 and t0 from the queue and make Update the coordinates of the first element in the set T. Update Q S , Q T The first element of the team, repeat step b); if It is determined that there is a Trojan device that is too wide to be implanted, and the sequential implantation method ends directly.

[0058] c) The hardware Trojan is successfully implanted, and the layout position search of all Trojan devices is completed. Based on the updated coordinate information of each device in the current set T, a coordinate update script is output. This coordinate update script is run in the EDA tool to update the chip layout. After completing the subsequent physical design process, the chip layout after the hardware Trojan is hidden can be obtained, that is, the chip Trojan test set based on vulnerability analysis is generated.

[0059] Step 3: Implant row by row

[0060] When the chip layout cannot be completed by sequential implantation without changing the coordinate positions of the original devices in the original device set A of area N1, the Trojan device implantation will be carried out by analyzing the area N1 row by row.

[0061] First, divide each row of area N1 in turn to obtain a set of in-row layout sub-areas L, with a size of c5. Record each layout sub-area l in L i Coordinate p of (i=1,2,...,c5) li , original device set A i For ease of understanding, a row L' in region N1 is used for illustration. The structure of L' is as follows: Figure 5 shown.

[0062] Figure 5 In the figure, the tapfiller device and the chip layout boundary divide L′ into three parts, namely three layout sub-areas, namely l′1, l′2, and l′3 from left to right; e1 and e2 are the original devices in area L′.

[0063] First, let's take the layout of subregion l'2 as an example. The left edge of l'2 overlaps with the left edge of the original device e1. To implant a Trojan device in region l'2, we only need to consider the width from the right edge of e1 to the right edge of l'2. There's no need to move e1, as this is already the maximum layout space available for Trojan device implantation in region l'2.

[0064] Next, we analyze region l′3. l′3 is divided by the original device e2 into two implantable regions, left and right. We can compare the sizes of the left and right regions with the hardware Trojan device and implant the Trojan device that can accommodate it. Alternatively, we can move e2 within l′3, integrating the layout spaces of the left and right regions and converting l′3's situation to be the same as l′2, allowing us to determine if a Trojan device is implanted.

[0065] The present invention proposes the concept of the proximity principle, which is to move the original device to the closer side boundary by comparing the distance between the original device and the left and right boundaries of the layout sub-region. Taking e2 in l'3 as an example, in order to integrate the left and right layout space margins in l'3, when moving e2, the distance from the left boundary of e2 to the left boundary of l'3 is first calculated, and then the distance from the right boundary of e2 to the right boundary of l'3 is calculated. By comparing the two distances, e2 is moved to the closer side boundary, and the left boundary (or right boundary) of e2 is overlapped with the left boundary (or right boundary) of l'3, thereby achieving the effect of integrating the left and right layout space margins in l'3.

[0066] Finally, the region l′1 is analyzed. There is no original device in the region l′1, so it is only necessary to determine whether the Trojan device is implanted based on the width of the Trojan device to be implanted and the overall width of the region l′1.

[0067] During the row-by-row implantation process, the placement results of the sequential implantation are retained. That is, only the devices in set T that have not been fully implanted in the sequential implantation process will continue to be searched for placement positions, while the already placed Trojan devices will be treated as the original devices in region N1. Assuming that the set of remaining hardware Trojan devices in T is T0, and the size of set T0 is c6, the specific process for implanting the remaining hardware Trojan device set T0 into region N1 is as follows (Note: Because the row-by-row implantation process involves the exchange of the remaining Trojan device elements in set T0 with the elements of the original device set A in region N1, after the elements of set A are added to set T0, T0 can be called the set of devices to be placed. The set of devices to be placed T0 contains all the logic devices that need to find a valid placement position):

[0068] a) First, divide each row of area N1 into a set of sub-areas L within the row, with a size of c5. i (i=1,2,...,c5) are sorted in descending order according to the layout margin width first and the number of internal original devices second, that is, the elements with larger layout margin width are in front; when the layout margin width is the same, the elements with more internal original devices are in front, and the priority queue is obtained. Record priority queue Q L Each element l in i Width of (i=1,2,...,c5) coordinate (in, Respectively represent l i The horizontal and vertical coordinate values ​​of the original device set A i , set A i The size of f i .

[0069] b) If after the sequential implantation is completed, there is a set of remaining hardware Trojan devices T0 of size c6 (c6≤c3) that have not been successfully implanted in area N1, then the elements in set T0 are sorted in descending order of width to form an ordered queue

[0070] c) If If is empty, jump to step e). Not empty, take The first element of the squadron (denoted as t0, the coordinates of t0 are Width is ); take Q LThe first element of the team (recorded as l0), the original device set on l0 is A0, and the width is The coordinates are Sort the elements in set A0 in increasing order by width to get an ordered queue where a j″ Represents the elements in the ordered queue Q0 with the sequence number j″ sorted from small to large, j″=1,2,...,f0; then sort the elements in the set A0 in ascending order according to the horizontal coordinate value to obtain the ordered queue where a j″′ Indicates the element with the order number j″′ in the ordered queue Q′0, where j″′=1,2,...,f0.

[0071]

[0072] in, Represents the sum of the widths of all elements in set A0.

[0073] Jump to step d). If equation (1-4) is not satisfied, it means that after adjusting the layout position of the original device (i.e., the coordinate value of the element in A0) in area l0, sufficient layout space can be obtained for t0 to be implanted. Therefore, t0 is dequeued, and the original devices on l0 (i.e., the devices in set A0) are moved to the closer edge of l0 according to the proximity principle, and the coordinates of the elements in Q′0 are updated in turn:

[0074]

[0075] In formula (1-5), in order to show all cases, the present invention assumes that a′1 and a′2 are closer to the left boundary of l0, and and Closer to the right boundary of l0. Therefore, when the coordinates are updated, a′1 and a′2 are closer to the left boundary of l0 (i.e. the horizontal coordinate value ) is used as a reference to update the coordinate values. After the coordinates of a′1 and a′2 are updated, the two devices are connected on l0 (i.e. one side of the boundary coincides). Similarly, and Take the right boundary of l0 (i.e. the horizontal coordinate value ) to update the coordinate value. After the update is completed and Also connected.

[0076] Because the elements in Q′0, Q0, and A0 are one-to-one corresponding, when the coordinate information of the elements in Q′0 is updated, the coordinate information of the elements in Q0 and A0 is also updated synchronously. After the coordinates of the elements in Q′0 are updated, according to the principle of proximity, the devices close to the left boundary of l0 are moved close to the left boundary, and the devices close to the right boundary of l0 are moved close to the right boundary. Then the layout space margin in l0 is integrated together to obtain the sorted layout area. Let the coordinates of the sorted layout area be (x0, y0), then let p t0 = (x0, y0), the implantation of t0 is completed. At this time, t0 becomes the layout device on l0, so l0 is added to the original device set A0 and the set A0 is updated. According to the updated set A0, the original device set information of l0 is updated synchronously. Repeat step c) for the first element of the team.

[0077] d) If If is empty, jump to step e). If it is not empty, then take the current The first element of the team is t0; take Q L The first element is l0. Initialize an empty device queue R. Let m = 1 (m is used to represent the element number in Q0).

[0078] d1) If m = f0, jump to step e). If m < f0, set m = m + 1. At this time, if:

[0079]

[0080] in, Refers to the sum of the widths from the mth item to the f0th item in Q0.

[0081] Repeat step d1). When formula (1-6) is not satisfied, let R = {a1, a2, ..., a m-1}, jump to step d2).

[0082] d2) If satisfied

[0083]

[0084] Among them, r0 is the first element of queue R, is the width of r0.

[0085] Then remove the first element r0 from R and repeat step d2. If equation (1-7) is not satisfied, the following three cases can be discussed:

[0086] ①If satisfied

[0087]

[0088] Among them, ∑ R w represents the sum of the widths of the elements in queue R.

[0089] This means that the total width of the devices in the device queue R that needs to be removed from l0 is equal to the width of the Trojan device t0. At this time, if R is a single-element set, it means that when the remaining Trojan device set, that is, t0 of the device set to be laid out T0, is implanted into l0, another device to be laid out is generated (this device to be laid out is a single element in R). The size of the set T0 and the total width of all its elements have not changed, and this layout is invalid. Select queue Q L The next element in (if the current traversal has reached Q L If the device is at the end of the queue, jump to step e) to replace the current l0 and repeat step d). If R is a multi-element set, then t0 is dequeued, all elements in queue R are removed from set A0, and t0 is added to set A0. According to the proximity principle, the devices close to the left boundary of l0 are moved close to the left boundary, and the devices close to the right boundary of l0 are moved close to the right boundary, and the current layout space margin is integrated into l0 (that is, the currently sorted layout area). The coordinates of the currently sorted layout area are recorded as (x′0, y′0), and p is updated at the same time. t0 =(x′0,y′0), complete the t0 implantation. Finally, add the elements in queue R to the set T0; add all the elements in queue R to the queue In and current Sort the elements in by increasing width, and then jump to step c).

[0090] ②If satisfied

[0091]

[0092] This means that the total width of the devices in the device set R that needs to be moved out of l0 is less than the width of the Trojan device t0. t0 is dequeued, all elements in the queue R are removed from the set A0, and t0 is added to the set A0. According to the principle of proximity, the devices close to the left boundary of l0 are moved close to the left boundary, and the devices close to the right boundary of l0 are moved close to the right boundary, and the current layout space margin is integrated into l0 (that is, the currently sorted layout area). The coordinates of the currently sorted layout area are recorded as (x′0, y′0), and p is updated at the same time. t0 =(x′0,y′0), complete the t0 implantation. Finally, add the elements in queue R to the set T0; add all the elements in queue R to the queue In and current Sort the elements in by increasing width, and then jump to step c).

[0093] ③If satisfied

[0094]

[0095] This means that the total width of the devices in the device set R that needs to be moved out of l0 is greater than the width of the Trojan device t0. At this time, if any element in the queue R is moved out of l0, the total number of devices to be placed and the width of the placed devices will increase, which is contrary to the original intention of the row-by-row implantation method to gradually reduce the width of the devices to be placed and the number of placed devices. It is necessary to select queue Q L The next element in (if the current traversal has reached Q L At the end of the queue, jump to step e)) to replace the current l0 and jump to step d).

[0096] e) If If it is empty, the hardware Trojan is implanted successfully, and the layout position search of all devices to be laid out on the given layout area N1 is completed. According to the updated coordinate information of each device in the current set A and set T, the coordinate update script is output. The coordinate update script is run in the EDA tool to update the chip layout. After completing the subsequent physical design process, the chip layout after the hardware Trojan is hidden can be obtained, that is, the chip Trojan test set based on vulnerability analysis is generated. If If it is not empty, it means that the region N1 cannot complete the implantation of the hardware Trojan device set T, and jumps to step (4).

[0097] (4) Increase implantation points

[0098] When jumping to step (4), it means that the selected q vulnerable points cannot provide enough layout space for hardware Trojan implantation, then set q = q + 1, and then jump to step (3) to try Trojan implantation again until a chip Trojan test set based on vulnerability analysis can be generated.

[0099] Example

[0100] The following test set generation experiment is performed using the RTL code of the AES series circuit provided by the Trust-Hub website as an example. The experimental results are shown in Table 1 below.

[0101] Table 1 Comparison of detection rates between initial layout and hidden layout

[0102]

[0103] As can be seen from Table 1, before being processed by the method proposed in the present invention, the detection probability of hardware Trojans in the chip layout of the original test set was 100%, that is, the original layout strategy could not hide the hardware Trojans; after being processed by this method, the detection rate of the chip Trojan test set where the Trojans were hidden dropped significantly to about 50%. From a probabilistic perspective, the current detection means cannot distinguish between different types of test samples in the test set, and the hardware Trojans are well hidden. The chip Trojan test set based on vulnerability analysis was successfully generated, and the present invention is effective.

[0104] The embodiments described above are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

Claims

1. A chip Trojan test set generation method based on vulnerability analysis, characterized in that: The method comprises the following steps: S1) Steady-state temperature information extraction Obtain the register transfer level RTL design code of a circuit, use EDA tools to complete the logic design and physical design of the RTL circuit, obtain the chip layout results, analyze the chip layout results, write auxiliary scripts, and finally obtain the chip layout information point set N = {n1, n2, ..., n l×r }, where the vth chip layout information point n v Corresponding to any v-th chip layout area, v = 1, 2, ..., l × r; l and r represent the number of units divided horizontally and vertically in the chip layout respectively; calculate any chip layout information point n v Steady-state information, that is, steady-state temperature Steady-state arrival time And the steady-state information of the chip layout information points is summarized as a steady-state feature vector: in, Indicates that the steady-state temperature and steady-state arrival time Splicing to form chip layout information point n v After the steady-state feature extraction of each chip layout information point is completed, the vulnerable point analysis of the chip layout can be carried out; S2) Chip Layout Vulnerability Analysis According to the standard library design principles, the chip physical design stage will go through several key steps: layout planning, layout and routing. In the layout planning stage, the EDA tool will map the logical description of the chip in the netlist to the physical description of the chip layout and optimize indicators including device interconnection. In the subsequent layout and routing process, the EDA tool will place the standard library cells on the chip layout and use the metal layer routing channels to complete the device interconnection. After the chip layout routing is completed, the layout space margin and routing channel margin are analyzed, and the minimum standard cell area in the current standard cell library is recorded as S min , chip layout area n v , that is, chip layout information point n v The layout space margin is The routing channel allowance is but: in, is the chip layout area n v The vulnerability index of hardware Trojans can be implanted. By analyzing each information point of the entire chip layout as above, we can obtain the chip layout vulnerability matrix: The smaller the chip, the less resources the chip layout has, and the harder it is to insert a hardware Trojan. However, compact layout resources also increase the area n. v Physical field parameters make hardware Trojan detection more difficult; After completing the vulnerability analysis of the entire chip layout, you can start generating test sets; S3) Test set generation Arrange the vulnerability index of each chip layout information point in the chip layout vulnerability matrix CV in ascending order when the hardware Trojan is implanted, select the chip layout information points corresponding to the first q vulnerability indices as the vulnerable points, and implant the hardware Trojan, where q≤l×r and q is a positive integer; These q vulnerable points constitute the chip layout information point set N1, also known as the chip layout area N1. The process of implanting a set of hardware Trojan devices into N1, targeting the implant area, includes: S31) Chip layout topology analysis For chip layout area N1, use EDA tools to extract the original device set A on N1. The size of set A is set to c1, and the adjacent device, coordinates p, and width w information of each standard device in set A are recorded. In this way, the chip layout topology structure is extracted. After the chip layout topology structure is extracted, the set of blank layout spaces between any two adjacent devices can be obtained, called S. The size of set S is c0, and the coordinates p and width w of any element s in set S are recorded. After the chip layout topology analysis is completed, the hardware Trojans can be implanted in sequence; S32) Implant in sequence Based on the standard library design principles, EDA tools place standard devices of equal height in rows on the chip layout, converting the size and area analysis of the devices on the chip layout into a direct analysis of the width w of each device; First, the script processes the information report to obtain the hardware Trojan device set T. The size of set T is set to c3. The largest device size in set T is obtained. Since standard devices are all of the same height, the width w of each device element in set T can be directly compared. The width of the largest Trojan device in set T is recorded as w t-max Then, check the chip layout division result in step S1), and record the width of area N1 as w n-max , if w t-max >w n-max , then it is determined that there are devices in the set T that cannot be implanted in area N1, and the device layout cannot be completed. It is necessary to reduce the chip layout division granularity, set l = l-1, r = r-1, and then jump to step S1), re-divide the chip layout to obtain the chip layout information point set; if w t-max ≤w n-max , then the hardware Trojan device is implanted using the sequential implantation method, wherein the hardware Trojan device implantation using the sequential implantation method specifically includes the following steps: S321) Sort the elements in the sets S and T in descending order by width w to obtain an ordered queue. where s j Represents an ordered queue Q S The elements with the sequence number j are sorted from large to small in the middle width, t j′ Represents an ordered queue Q T Sort the elements with sequence number j′ in the middle width from largest to smallest, j=1, 2, ..., c0, j′=1, 2, ..., c3, and then jump to step S322); S322) If Q T is empty, jump to step S323); if Q T Not empty but Q S Is empty, the sequential implantation method ends directly; when Q T , Q S When both are not empty, take Q S , Q T The first elements of the team are s0 and t0, where the width of s0 is The coordinates are The width of t0 is The coordinates are like Then remove s0 and t0 from the queue and make Update the coordinates of the first element of the set T; update Q S , Q T The first element of the team, repeat step S322); if If it is determined that there is a hardware Trojan device that is too wide to be implanted, the sequential implantation method ends directly; S323) The hardware Trojan is successfully implanted, and the layout position search of all Trojan devices is completed. Based on the updated coordinate information of each device in the current set T, a coordinate update script is output. The coordinate update script is run in the EDA tool to update the chip layout. After completing the subsequent physical design process, the chip layout after the hardware Trojan is hidden can be obtained, that is, the chip Trojan test set based on the vulnerability analysis is generated; S33) Implant row by row When sequential implantation fails to complete the chip layout without changing the coordinate positions of the original devices in the original device set A in region N1, a hardware Trojan device implantation method will be used to analyze region N1 row by row: Divide each row of area N1 in turn to obtain a set of in-row layout sub-areas L, with a size of c5. Record each layout sub-area l in L. i , i=1,2,...,c5 Original Device Set A i For ease of understanding, a row L' in region N1 is used for illustration: In a row L′, the tapfiller device and the chip layout boundary divide L′ into three parts, namely three layout sub-areas, which are represented as l′1, l′2, and l′3 from left to right. e1 and e2 are the original devices in area L′. The tapfiller is a special non-logical device implanted during the chip layout generation process of the EDA tool to eliminate the latch effect of the chip. Therefore, when the chip layout is changed, the tapfiller is regarded as an immovable device and its coordinate position is not changed. First, let's take the layout sub-region l'2 as an example. The left border of l'2 coincides with the left border of the original device e1. To implant a hardware Trojan device in region l'2, we only need to consider the width from the right border of e1 to the right border of l'2. There is no need to move e1, because this is already the maximum layout space available for hardware Trojan devices in region l'2. Then, the layout sub-region l′3 is analyzed. l′3 is divided into two implantable regions, left and right, by the original device e2. The sizes of the left and right implantable regions are compared with the hardware Trojan device, and the hardware Trojan device that can be accommodated is implanted. Alternatively, by moving e2 inside l′3, the layout space of the left and right implantable regions is integrated, and the situation of l′3 is converted to the same as that of l′2, and then the hardware Trojan device is determined. The concept of the proximity principle is proposed here. That is, when moving the original device, by comparing the distance between the original device and the left and right boundaries of the layout sub-region, the original device is moved to the side boundary that is closer. Taking e2 in l′3 as an example, to integrate the left and right layout space margins in l′3, when moving e2, first calculate the distance from the left boundary of e2 to the left boundary of l′3, and then calculate the distance from the right boundary of e2 to the right boundary of l′3. By comparing the two distances, e2 is moved to the closer side boundary, and the left boundary of e2 is overlapped with the left boundary of l′3, or the right boundary of e2 is overlapped with the right boundary of l′3, thereby achieving the effect of integrating the left and right layout space margins in l′3. Finally, the layout sub-region l′1 is analyzed. Since there are no original devices in the layout sub-region l′1, it is only necessary to determine the implantation of the hardware Trojan device based on the width of the hardware Trojan device to be implanted and the overall width of the region l′1. During the row-by-row implantation process, the placement results of the sequential implantation will be retained, that is, only the devices in set T that have not been implanted in the sequential implantation will continue to be searched for placement positions, and the already placed hardware Trojan devices will be processed as the original devices of area N1. Assuming that the remaining hardware Trojan device set in T is T0, and the size of set T0 is c6, the specific process of implanting the remaining hardware Trojan device set T0 into area N1 is as follows. Since the row-by-row implantation process involves exchanging the remaining Trojan device elements in set T0 with the elements of the original device set A in area N1, after the elements of set A are added to set T0, T0 is called the device set to be placed. The device set to be placed T0 contains all the logic devices for which valid placement positions need to be found: S331) Layout sub-area l in L i , i=1,2,...,c5 are sorted in descending order according to the layout margin width first and the number of original devices in the layout sub-region second, that is, the elements with larger layout margin width are in front; when the layout margin width is the same, the elements with more original devices in the layout sub-region are in front, and the priority queue is obtained Record priority queue Q L Each element l in i Width coordinate Original Device Set A i ;in Respectively represent l i The horizontal and vertical coordinate values ​​of the set A i The size of f is set to i ; S332) If the sequential implantation is completed, there is a set of remaining hardware Trojan devices T0 of size c6, c6≤c3 that have not been successfully implanted in area N1, then the elements in the set T0 are sorted in descending order of width to obtain an ordered queue S333) If Is empty, jump to step S335); if Not empty, take The first element of the squadron is t0, the coordinates of t0 are Width is Take Q L The first element of the team is l0, the original device set on l0 is A0, and the width is The coordinates are Sort the elements in set A0 in increasing order by width to get an ordered queue where a j″ Represents the elements in the ordered queue Q0 with the sequence number j″ sorted from small to large, j″=1,2,...,f0; then sort the elements in the set A0 in ascending order according to the horizontal coordinate value to obtain the ordered queue where a j”’ Indicates the element with the order number j'' in the ordered queue Q'0, where j''=1, 2, ..., f0; if in, Represents the sum of the widths of all elements in set A0; Jump to step S334); if formula (4) is not satisfied, it means that after adjusting the layout position of the original device in area l0, there is enough layout space for t0 to be implanted. Therefore, t0 is dequeued, and according to the principle of proximity, the original device on l0 is moved to the side boundary of l0 that is closer to it, and the element coordinates in Q′0 are updated in sequence: In formula (5), in order to show all cases, it is assumed that a′1 and a′2 are closer to the left boundary of l0, and and Closer to the right boundary of l0, so when the coordinates are updated, a′1 and a′2 are at the left boundary of l0, that is, the horizontal coordinate value For reference, coordinate values ​​are updated. After the coordinates of a′1 and a′2 are updated, the two devices are connected on l0, that is, one side of the boundary coincides. Similarly, and Take the right boundary of l0, that is, the horizontal coordinate value Update the coordinate value. After the update is completed and Likewise connected; Because the elements in Q'0, Q0, and A0 are one-to-one corresponding, when the coordinates of the elements in Q'0 are updated, the coordinate information of the elements in Q0 and A0 are also updated synchronously. After the coordinates of the elements in Q'0 are updated, according to the principle of proximity, the components close to the left boundary of l0 are moved close to the left boundary, and the components close to the right boundary of l0 are moved close to the right boundary. Then the layout space margin in l0 is integrated together to obtain the sorted layout area. The coordinates of the sorted layout area are recorded as (x0, y0). Then let After t0 is implanted, t0 becomes the layout device on l0, so l0 is added to the original device set A0, set A0 is updated, and the original device set information of l0 is updated synchronously according to the updated set A0. The first element of the team, repeat step S333); S334) If Is empty, jump to step S335); if If it is not empty, then take the current The first element of the team is t0, take Q L The first element l0 initializes the empty device queue R and sets m = 1, where m is used to represent the element number in Q0; S3341) If m=f0, jump to step S335); if m<f0, set m=m+1. At this time, if: in, Refers to the sum of the widths of the mth to f0th elements in Q0; When equation (6) is not satisfied, let R = {a1, a2, ..., a m-1 }, then jump to step d2); S3342) If satisfied Among them, r0 is the first element of queue R, is the width of r0; Then remove the first element r0 from R and repeat step S3342); if formula (7) is not satisfied, the following three cases can be discussed: ①If satisfied The total width of the devices in the device queue R that needs to be removed from l0 is equal to the width of the Trojan device t0, where ∑ R w represents the width and width of the elements in the queue R; At this time, if R is a single-element set, it means that when the remaining Trojan device set, that is, t0 of the device set to be laid out T0, is implanted into l0, another device to be laid out is generated. This device to be laid out is a single element in R. The size of the set T0 and the total width of all its elements remain unchanged. This layout is invalid, and queue Q is selected. L The next element in replaces the current l0, and repeats step S334). If the current traversal has reached Q L At the end of the queue, jump to step S335); if R is a multi-element set, then t0 is dequeued, all elements in queue R are removed from set A0, and t0 is added to set A0. According to the principle of proximity, the components close to the left boundary of l0 are moved close to the left boundary, and the components close to the right boundary of l0 are moved close to the right boundary. The current layout space margin is integrated into l0, that is, the currently sorted layout area. The coordinates of the currently sorted layout area are recorded as (x′0, y′0), and then the current layout space margin is updated. Complete the t0 implantation and finally add the elements in queue R to the set T0; add all the elements in queue R to the queue In and current Sort the elements in ascending order by width, and then jump to step S333); ②If satisfied This means that the total width of the devices in the device set R that needs to be moved out of l0 is less than the width of the Trojan device t0. At this time, t0 is dequeued, all elements in the queue R are removed from the set A0, and t0 is added to the set A0. According to the principle of proximity, the devices close to the left boundary of l0 are moved close to the left boundary, and the devices close to the right boundary of l0 are moved close to the right boundary. The current layout space margin is integrated into l0, that is, the currently sorted layout area. The coordinates of the currently sorted layout area are recorded as (x′0, y′0), and then the current layout space margin is updated at the same time. Complete the t0 implantation and finally add the elements in queue R to the set T0; add all the elements in queue R to the queue In and current Sort the elements in ascending order by width, and then jump to step S333); ③If satisfied This means that the total width of the devices in the device set R that needs to be moved out of l0 is greater than the width of the Trojan device t0. At this time, if any element in the queue R is moved out of l0, the total number of devices to be placed and the width of the placed devices will increase, which is contrary to the original intention of the row-by-row implantation method to gradually reduce the width of the devices to be placed and the number of placed devices. Therefore, it is necessary to select queue Q L The next element in replaces the current l0, jumps to step S334), if the current traversal has reached Q L At the end of the queue, jump to step S335); S335) If If it is empty, the hardware Trojan is implanted successfully, and the layout position search of all devices to be laid out on the given chip layout area N1 is completed. According to the updated coordinate information of each device in the current set A and set T, the coordinate update script is output. The coordinate update script is run in the EDA tool to update the chip layout. After completing the subsequent physical design process, the chip layout after the hardware Trojan is hidden can be obtained, that is, the chip Trojan test set based on vulnerability analysis is generated; if If it is not empty, it means that the region N1 cannot complete the implantation of the hardware Trojan device set T, and jump to step S4); S4) Increase implantation points When jumping to step S4), it means that the selected q vulnerable points cannot provide enough layout space for hardware Trojan implantation, so set q=q+1, and then jump to step S3) to retry hardware Trojan implantation until a chip Trojan test set based on vulnerability analysis can be generated.

2. The chip Trojan test set generation method based on vulnerability analysis according to claim 1 is characterized in that: After step S4), the method further includes using the RTL code of the AES series circuit provided by the Trust-Hub website as a test set to test the chip Trojan test set generation method based on vulnerability analysis.

Images