A Process Variation Measurement Method for Hardware Trojan Detection

Abstract

The present invention provides a process variation measurement method for hardware Trojan detection, including: Step 1, select a timing path; Step 2, for the selected timing path, obtain a test stimulus; Step 3, obtain the minimum clock period for the path to work properly, and the minimum clock period corresponds to the maximum delay of the path; Step 4, according to the maximum delay of the path, combined with the process library information, obtain the process variation of the path through Monte Carlo analysis and simulation; Step 5, repeat Steps 1-4 to obtain the process variations of all paths of the chip, and the equivalent process variation distribution is a normal distribution, so as to obtain the process variation distribution of the entire chip. The solution of the present invention utilizes the timing paths inherent in the functions of the chip, and can achieve the measurement of process variations without adding too much test logic, reducing the chip area and cost overhead.

Description

Technical Field

[0001] The present invention relates to the field of process detection, and particularly to a process deviation measurement method for hardware Trojan detection. Background Art

[0002] The impact of process deviation is one of the core problems faced in hardware Trojan detection. Process deviation includes intra-die deviation and inter-die deviation. Intra-die deviation refers to the differences in some parameters at different internal positions of each chip in the same batch caused by the limitations of manufacturing equipment and technology; inter-die deviation refers to the differences in some parameters between different batches of chips or between chips. The measurement of process deviation is generally achieved by implanting a ring oscillator inside the chip and measuring the frequency of the ring oscillator to measure the process deviation. Refer to the reference "Xiang Y, Li L, Zhou W, et al. Process Deviation Calibration for Hardware Trojan Detection [C]. 2019 3rd International Conference on Electronic Information Technology and Computer Engineering (EITCE), Xiamen, China, 2019: 1695-1699." The disadvantage of this method is that it requires implanting a ring oscillator and corresponding auxiliary test circuits inside the chip, which will occupy a large chip area overhead. This is not desired for in-die testing. Summary of the Invention

[0003] Aiming at the problems existing in the prior art, a process deviation measurement method for hardware Trojan detection is provided. This method utilizes the inherent timing paths in the chip function and can achieve the measurement of process deviation without adding too much test logic, reducing the chip area and cost overhead compared with the existing solutions.

[0004] The technical solution adopted by the present invention is as follows: A process deviation measurement method for hardware Trojan detection, comprising:

[0005] Step 1: Select a timing path;

[0006] Step 2: Obtain a test stimulus for the selected timing path;

[0007] Step 3: Obtain the minimum clock period for the path to work properly, and the minimum clock period corresponds to the maximum delay of the path;

[0008] Step 4: According to the maximum delay of the path, combined with the process library information, obtain the process deviation of the path through Monte Carlo analysis and simulation;

[0009] Step 5: Repeat Steps 1-4 to obtain the process deviations of all paths of the chip. The equivalent process deviation distribution is a normal distribution, thereby obtaining the process deviation distribution of the entire chip.

[0010] Furthermore, in the entire process deviation measurement, the tested timing paths cover the entire chip.

[0011] Furthermore, the specific process of Step 2 is as follows: Select the normal working clock cycle, and determine the input excitation and the corresponding moment information that cause the output register of this path to flip through the control of the clock signal and the scan register.

[0012] Furthermore, in Step 2, the input excitation that causes the output register to flip is obtained through preliminary simulation, and the corresponding moment information is determined through chip testing.

[0013] Furthermore, Step 3 is specifically as follows: Decrease the clock cycle in steps, and detect the clock cycle when the tested timing path first fails to work properly, thereby obtaining the minimum clock cycle that can work properly.

[0014] Furthermore, in Step 3, different clock cycles are generated by configuring the PLL. Under the condition of applying the same excitation, data acquisition and judgment are realized by stopping the clock, switching to the test mode, and then collecting data, thereby determining the minimum clock cycle.

[0015] Compared with the prior art, the beneficial effects of adopting the above technical solution are as follows: The solution proposed by the present invention can realize process deviation measurement without adding too much test logic, and reduces the chip area and cost overhead compared with the existing process deviation measurement scheme. Brief Description of the Drawings

[0016] Figure 1 It is a flowchart of the process deviation measurement method proposed by the present invention.

[0017] Figure 2 It is a typical timing path model.

[0018] Figure 3 It is the normalized path delay of the process deviation distribution. Detailed Embodiment

[0019] The present invention will be further described below with reference to the drawings.

[0020] As Figure 1 shown, a process deviation measurement method for hardware Trojan detection includes:

[0021] Step 1: Select a timing path;

[0022] Step 2: Obtain test stimuli for the selected timing path;

[0023] Step 3: Obtain the minimum clock period for the path to work properly. The minimum clock period corresponds to the maximum delay of the path;

[0024] Step 4: According to the maximum delay of the path, combined with the process library information, obtain the process deviation of the path through Monte Carlo analysis and simulation;

[0025] Step 5: Repeat Steps 1 - 4 to obtain the process deviations of all paths in the chip. The equivalent process deviation distribution is a normal distribution, so as to obtain the process deviation distribution of the entire chip.

[0026] In this embodiment, the sequential circuit works according to the clock period under the control of the periodic clock. A timing path refers to the path of signal transmission between two - stage registers. As Figure 2 shown is a classic timing path transmission model, which can be composed of two - stage registers plus combinational logic. The principle of the minimum clock period generated by the timing path is that due to the existence of delays, the clock period cannot be infinitely reduced.

[0027] Figure 2 In, the data starts from A and goes to B. For the circuit to calculate correctly, it is required that after the first rising edge of the clock, the output Q1 at the output terminal of Reg1 generates a corresponding output, passes through the combinational logic in the figure to reach the input terminal D2 of Reg2, and at the arrival of the second clock edge, Reg2 samples the result of the combinational logic calculation, and then the output at the output terminal of Reg2 is output to B. The delays experienced from the Q1 terminal to the D2 terminal include the wire delays on both sides of the combinational logic, the delays of the internal devices in the combinational logic, and the internal wire delays in the combinational logic. Denote these delays with T data for representation.

[0028] Now make two explanations for this process:

[0029] 1. For a register, there is a certain delay from the arrival of the valid clock edge to the data being ready at the Q terminal of the register. This delay is denoted as T co .

[0030] 2. For a register, to ensure its normal operation, the data must be stable in advance for a period of time before the arrival of the valid clock edge. This period of time is called the setup time T su of the register.

[0031] According to circuit theory, to enable the circuit to work properly, using T clk to represent the clock period, the timing should satisfy the following relationship:

[0032] T clk –T co –T su –Tdata = slack >= 0

[0033] In the formula, slack is called the time margin. For a circuit, when the clock period decreases, it may cause slack < 0, which means the circuit cannot work properly. Therefore, to enable the circuit to work properly, the clock period cannot be infinitely decreased. However, there is a clock period corresponding to slack = 0, at which the circuit can just work properly and at the fastest working speed. This is the minimum working period of the circuit.

[0034] Specifically, in step 1, in the measurement of the entire process deviation, generally, it is required that the timing path selected for process deviation measurement covers the entire chip and has a sufficient number of timing paths to meet the subsequent modeling needs.

[0035] The specific process of step 2 is as follows: Select a normal working clock period, and determine the input excitation and the corresponding time information that cause the output register of this path to flip through the control of the clock signal and the scan register.

[0036] In a preferred embodiment, the input excitation that causes the output register to flip is obtained through preliminary simulation, and the corresponding time information is determined through chip testing. The specific time information can assist the subsequent testing.

[0037] The specific content of step 3 is as follows: Decrease the clock period in steps, and detect the clock period when the tested timing path cannot work properly for the first time, so as to obtain the minimum clock period that can work properly. The minimum clock period corresponds to the maximum delay of the path. The maximum delay refers to the maximum delay of the circuit path in the chip, and this maximum delay determines the highest working frequency of the internal circuit of the chip.

[0038] In practical applications, mainly configure the PLL to generate different clock periods. Under the condition of applying the same excitation, realize data acquisition and judgment by stopping the clock, switching to the test mode, and then collecting data, so as to determine the minimum clock period.

[0039] Step 3 can be further divided into the following sub-steps:

[0040] S31. Configure the clock frequency;

[0041] S32. Apply the excitation;

[0042] S33. Stop the clock;

[0043] S34. Switch the working mode;

[0044] S35. Collect data and make a judgment.

[0045] In step 5, according to the test data, the equivalent process deviation distribution is a normal distribution, and the process deviation distribution of the entire chip is obtained.

[0046] Figure 3 The normalized path delay reflecting the process deviation distribution in the inventive routine is given. The abscissa in the figure represents the normalized path delay, which is divided into different intervals, and the ordinate represents the probability density of the timing paths falling into that interval. It can be seen from the figure that the normalized path delay is normally distributed, with an expectation μ = 28.592 and a standard deviation σ = 0.339. The standard deviation is the arithmetic square root of the variance, and it is born to describe the data fluctuation. It is known from statistics that the probability that a random variable ξ following a normal distribution ξ(μ,σ 2 ) falls into the interval (μ - 3σ, μ + 3σ) is 99.74%. The above formula means that this interval covers 99.74% of the possibilities, that is, the influence of the on-chip process deviation on the path delay is mainly within this interval. The on-chip process deviation is defined as 3σ / μ, which is approximately 3.56%. The detection of the on-chip process deviation is completed.

[0047] It should be noted that this solution measures the process deviation through the timing information of the timing paths distributed at different positions in the chip. The implementation of the present invention is a systematic project and requires some tools and underlying process library files to cooperate. The present invention can complete the measurement of the chip process deviation by using the timing paths with inherent functions in the chip, saving the chip area and cost. The measurement of the process deviation is of great significance for the correction of the process deviation, the improvement of the hardware Trojan detection technology, and the analysis of the side-channel information.

[0048] The present invention is not limited to the foregoing specific embodiments. The present invention extends to any new feature or any new combination disclosed in this specification, as well as any new method or process step or any new combination disclosed. If those skilled in the art make non-substantive changes or improvements without departing from the spirit of the present invention, they should fall within the scope protected by the claims of the present invention.

[0049] All the features disclosed in this specification, or all the steps in the disclosed methods or processes, except for mutually exclusive features and / or steps, can be combined in any way.

[0050] Any feature disclosed in this specification, unless specifically described, can be replaced by other equivalent or similar-purpose alternative features. That is, unless specifically described, each feature is only an example of a series of equivalent or similar features.

Claims

1. A process deviation measurement method for hardware Trojan detection, characterized in that, Including: Step 1: Select a timing path; Step 2: For the selected timing path, obtain a test stimulus; Step 3: Obtain the minimum clock period for the path to work properly, and the minimum clock period corresponds to the maximum delay of the path; Step 4: According to the maximum delay of the path, combined with the process library information, obtain the process deviation of the path through Monte Carlo analysis and simulation; Step 5: Repeat Steps 1 - 4 to obtain the process deviations of all paths of the chip. The equivalent process deviation distribution is a normal distribution, so as to obtain the process deviation distribution of the entire chip; The specific process of Step 2 is as follows: Select a normal operating clock period, and determine the input stimulus that causes the output register of the path to flip and the corresponding time information through the control of the clock signal and the scan register; The specific content of Step 3 is as follows: Decrease the clock period in steps, and detect the clock period when the tested timing path first fails to work properly, so as to obtain the minimum clock period that can work properly.

2. The process deviation measurement method for hardware Trojan detection according to claim 1, wherein During the entire process deviation measurement, the tested timing paths cover the entire chip.

3. The process deviation measurement method for hardware Trojan detection according to claim 1, wherein In Step 2, the input stimulus that causes the output register to flip is obtained through pre - simulation, and the corresponding time information is determined through chip testing.

4. The process deviation measurement method for hardware Trojan detection according to claim 1, characterized in that In Step 3, different clock periods are generated by configuring the PLL. Under the condition of applying the same stimulus, data acquisition and judgment are realized in the form of stopping the clock, switching to the test mode, and then collecting data, so as to determine the minimum clock period.

Images