A method, system, device, and medium for generating a hardware Trojan.

Abstract

This invention provides a method, system, device, and medium for generating a hardware Trojan. The method mainly includes the following steps: performing gate-level simulation on the netlist of the target circuit to obtain the input waveforms of each standard cell input node; calling the device reliability model to predict the degradation of devices in the target circuit based on the input waveforms, and obtaining the device reliability degradation parameters; constructing an aging standard cell timing library based on the reliability degradation parameters; performing timing simulation based on the aging standard cell timing library to filter and obtain critical paths; determining path information and delay information based on the critical paths, determining timing constraint files, and constructing a hardware Trojan circuit based on the timing constraint files. The technical solution of this application is simple and efficient, highly concealed, more complete, and more versatile, and can be widely applied in the field of hardware security technology.

Description

Technical Field

[0001] This invention relates to the field of hardware security technology, and in particular to a method, system, device and medium for generating a hardware Trojan. Background Technology

[0002] The globalization of the integrated circuit supply chain has significantly reduced the design cost of integrated circuits, but at the same time, it has greatly increased the security risks of circuit design. Hardware Trojans refer to intentionally and maliciously modifying circuit designs, causing unexpected behavior during operation, increasing the risk of circuit information leakage and functional modification or failure. Deployed in competitors' hardware devices, they can achieve reconnaissance and sabotage purposes. Hardware-based Trojan circuit implantation can originate from any link in the integrated circuit industry chain, primarily involving third-party integrated circuit intellectual property (IP) suppliers, design or manufacturing foundries, electronic design automation (EDA) tools or designers, system integration, packaging, and testing personnel, etc.

[0003] The existing hardware Trojan designs mainly have the following problems:

[0004] High implementation cost: The design of hardware Trojans depends on the attacker's target and available resources, namely, studying the circuit to be parasitized, either on the layout or in the design, and finding implantable points and detectable trigger signals based on the original circuit design. Therefore, finding suitable Trojan implantation points and corresponding trigger signals involves extremely high complexity, posing a great challenge to the implementation of hardware Trojans.

[0005] Limited concealment: With the development of hardware Trojan prevention technology, there are corresponding methods to detect the existence of Trojans during design, manufacturing, testing, and operation through intrusive reverse engineering, non-intrusive reverse engineering, bypass analysis, machine learning analysis, etc. Especially after the use of encrypted circuits, it is impossible to implant other modules into the circuit without password authorization, making hardware Trojans easier to expose.

[0006] Incomplete design: To evade detection by hardware Trojans, the designed hardware Trojan circuit cannot be triggered during normal operation or testing. This necessitates a unique or extreme triggering mechanism for the hardware Trojan. Consequently, it's possible that the signal will not occur during circuit operation for a certain period, rendering the Trojan ineffective and resulting in wasted design work.

[0007] Lack of versatility: Hardware Trojan designs must be customized based on the original circuit. Sequential Trojans cannot be placed in purely combinatory circuits, and synchronous sequential Trojans cannot be placed in asynchronous circuits. Furthermore, Trojans that rely on sensor signals cannot be placed on non-sensor circuits. Therefore, Trojan circuit designs require appropriate adjustments based on the circuit design and lack versatility.

[0008] Time-consuming: Generally, as mentioned above, hardware Trojans require customized design based on the original circuit design to find the implantation point and trigger point, which leads to a long design time. When the hardware Trojan is deployed throughout the entire circuit rather than in a localized area, connecting signal lines that meet timing requirements also becomes a difficult and time-consuming task. Summary of the Invention

[0009] In view of this, in order to at least partially solve one of the above-mentioned technical problems, the purpose of this invention is to provide a method for generating a hardware Trojan that is simple, efficient, highly concealed, highly complete, and highly versatile, as well as a system, device, and storage medium capable of implementing the method.

[0010] On the one hand, the technical solution of this application provides a method for generating a hardware Trojan, including the following steps:

[0011] Perform gate-level simulation on the netlist of the target circuit to obtain the input waveforms of each standard cell input node;

[0012] The device reliability model is invoked, and the degradation prediction of the devices in the target circuit is performed based on the input waveform to obtain the device reliability degradation parameters.

[0013] A time series library of aging standard units is constructed based on the aforementioned reliability degradation parameters;

[0014] Timing simulation was performed based on the aging standard unit timing library to identify the critical path.

[0015] Based on the critical path, path information and delay information are determined, a timing constraint file is determined, and a hardware Trojan circuit is constructed based on the timing constraint file.

[0016] In one feasible embodiment of the present application, the step of performing gate-level simulation on the netlist of the target circuit to obtain the input waveforms of each standard cell input node includes:

[0017] Obtain the description file of the target circuit, and form a test file based on the description file;

[0018] The test file is used as a simulation stimulus to perform logic simulation and obtain the input waveform.

[0019] In one feasible embodiment of the present application, the step of calling the device reliability model and predicting the degradation of the device in the target circuit based on the input waveform to obtain the device reliability degradation parameters includes:

[0020] Electrical parameters are extracted based on the input waveform;

[0021] Based on the preset transient step time and the electrical parameters, the model parameters are obtained through the reliability model output;

[0022] The reliability degradation parameters are obtained by performing electrical characteristic simulations based on the model parameters.

[0023] In one feasible embodiment of the present application, the step of constructing the aging standard cell timing library based on the reliability degradation parameters includes:

[0024] Update the device's model file based on the aforementioned reliability degradation parameters;

[0025] Based on the model file, the propagation delay and signal flip delay of the standard unit after aging are obtained by using a featureization tool.

[0026] The aging standard unit timing library is constructed based on the propagation delay and the signal flip delay.

[0027] In one feasible embodiment of the present application, the step of performing timing simulation based on the aging standard cell timing library to screen out the critical path includes:

[0028] Candidate timing paths are obtained by timing analysis based on the netlist of the target circuit and the timing library of the aging standard cells.

[0029] The gate-level cells in the netlist of the target circuit are obtained by parsing the candidate timing paths;

[0030] The timing delay of the candidate timing path is obtained by superimposing the delay values ​​of the gate-level units and the interconnect delay values ​​according to the aging standard unit timing library.

[0031] The critical path is obtained by filtering the timing delays.

[0032] In one feasible embodiment of the present application, the step of determining path information and delay information based on the critical path, determining a timing constraint file, and constructing a hardware Trojan circuit based on the timing constraint file includes:

[0033] The timing margin is obtained based on the delay information of the critical path, and the timing constraint file is updated based on the timing margin.

[0034] In one feasible embodiment of the present application, the step of determining path information and delay information based on the critical path, determining a timing constraint file, and constructing a hardware Trojan circuit based on the timing constraint file further includes:

[0035] Based on the settings in the timing constraint file, the netlist of the target circuit is logically synthesized to obtain a gate-level netlist;

[0036] The target circuit layout is obtained by performing layout planning based on the gate-level netlist.

[0037] On the other hand, the technical solution of this application also provides a hardware Trojan generation system, the system including:

[0038] The gate-level simulation module is used to perform gate-level simulation of the netlist of the target circuit and obtain the input waveforms of each standard cell input node.

[0039] The degradation prediction module is used to call the device reliability model, perform degradation prediction on the devices in the target circuit based on the input waveform, and obtain the device reliability degradation parameters.

[0040] The timing library module is used to construct an aging standard cell timing library based on the reliability degradation parameters.

[0041] The timing simulation module is used to perform timing simulation based on the aging standard cell timing library and filter out the critical path.

[0042] The circuit layout module is used to determine path information and delay information based on the critical path, determine the timing constraint file, and construct a hardware Trojan circuit based on the timing constraint file.

[0043] On the other hand, the technical solution of this application also provides a hardware Trojan generation device, which includes:

[0044] At least one processor;

[0045] At least one memory for storing at least one program;

[0046] When the at least one program is executed by the at least one processor, the at least one processor performs a method for generating a hardware Trojan as described in any one of the first aspects.

[0047] On the other hand, the present application also provides a storage medium storing a processor-executable program, which, when executed by a processor, is used to perform a method for generating a hardware Trojan as described in any one of the first aspects.

[0048] The advantages and beneficial effects of the present invention will be set forth in part in the following description, and the rest will become apparent from the specific embodiments thereof:

[0049] The hardware Trojan design method based on aging in this application can be applied to any logic circuit. Since it only modifies and replaces the timing constraint file, it greatly improves efficiency and reduces time costs compared to traditional hardware Trojan designs. Furthermore, the solution fully utilizes the unavoidable aging phenomenon of circuits, and the hardware Trojan designed based on this characteristic of aging principle is undoubtedly highly concealed. The hardware Trojan design based on aging in this solution can largely ensure that the Trojan takes effect after the set working time, causing the circuit function to fail, and has a higher degree of completion. In addition, the solution has strong versatility and can be applied to the specific implementation of any circuit, whether it is pure combinational logic, sequential logic, or logic circuit with specific functions. The method proposed in this application can be used without changing the existing design process. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 A schematic diagram of an abstract model of a traditional hardware Trojan;

[0052] Figure 2 This is a flowchart illustrating the steps of a method for generating a hardware Trojan provided in the technical solution of this application.

[0053] Figure 3 This is a schematic diagram illustrating the design principle of the aging-based hardware Trojan in the technical solution of this application.

[0054] Figure 4 This is a flowchart illustrating the steps of another method for generating a hardware Trojan provided in this application. Detailed Implementation

[0055] The embodiments of the present invention are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention. The step numbers in the following embodiments are set only for ease of explanation, and there is no limitation on the order between the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0056] Based on different Trojan triggering mechanisms, existing hardware Trojan designs mainly fall into two categories: combinatorial hardware Trojan designs and timing-based hardware Trojan designs. Combinatorial hardware Trojans are implemented using combinational circuits, with circuit signals as trigger conditions, and the Trojan's functionality is achieved through certain logic. Timing-based Trojans are implemented using sequential circuits, which can be synchronous, asynchronous, or a combination of both. These circuits generally use timing as the trigger condition, such as a time bomb, which uses a timing module and a functional module to form the hardware Trojan. Both types of circuits share the characteristic of using a trigger module plus an attack module structure, with an abstract model such as... Figure 1 As shown, the trigger module monitors signals and waits for trigger conditions, while the attack module executes operations to complete the Trojan setup.

[0057] In related technical solutions, digital integrated circuit design methodologies can be divided into two main categories: full-custom and semi-custom. Full-custom design starts from the bottom up, designing circuits from the lowest transistor level, which is costly and time-consuming. Semi-custom integrated circuit design can be further divided into cell-based semi-custom design and array-based semi-custom design. Cell-based semi-custom design includes standard cells and macrocells, while array-based semi-custom design includes pre-diffused (gate array) and pre-routed (FPGA) arrays. Among semi-custom design methodologies, standard cell-based semi-custom digital integrated circuit design is the most widely used.

[0058] The design process for semi-custom digital integrated circuits based on standard cells is as follows: it mainly consists of three parts: top-level design, structural design, and physical design. The structural design is the part relevant to the hardware Trojan design in this application; the remaining parts are consistent with existing design processes.

[0059] Based on the foregoing technical background and principle description, this application proposes a method for generating a hardware Trojan, such as... Figure 2 As shown, the method may include steps S100-S500:

[0060] S100. Perform gate-level simulation on the netlist of the target circuit to obtain the input waveforms of each standard cell input node;

[0061] Specifically, in the embodiments, the method first performs reliability degradation prediction based on signal waveform, that is, performs gate-level simulation on the netlist corresponding to the circuit that needs to be implanted with hardware Trojan, and obtains the waveforms of the input nodes of each standard unit.

[0062] In some more specific implementation scenarios, the method performs gate-level simulation of the netlist of the target circuit to obtain the input waveforms S100 of each standard cell input node, and may further include steps S110-S120:

[0063] S110. Obtain the description file of the target circuit and form a test file based on the description file;

[0064] S120. Use the test file as a simulation stimulus to perform logic simulation and obtain the input waveform.

[0065] Specifically, in this embodiment, the starting point for the circuit design of the hardware Trojan is a normal behavior description file, such as a Verilog or Verilog HDL file, in .v format. A Verilog simulator, such as Synopsys' VCS, can be used to perform logic simulation on this file. In this embodiment, during the logic simulation, a testbench file needs to be written for the aforementioned input behavior description file. This file provides stimuli for the circuit logic simulation. Then, the Verilog simulator will compile and run the testbench based on the testbench file. After the logic simulation is completed, the input waveforms of each port node of the standard cell can be obtained.

[0066] S200: Call the device reliability model, perform degradation prediction on the devices in the target circuit based on the input waveform, and obtain the device reliability degradation parameters;

[0067] Specifically, in the embodiment, a circuit simulator such as SPICE can be used, which calls a device reliability model, such as Synopsys' PrimeSim, which has bias voltage instability and hot carrier degradation reliability models. The waveform of the standard cell input node obtained in step S100 is input, and aging simulation is performed on the cell circuits in the standard cell library. The time point of the aging simulation is determined by the time point when the hardware trojan set by the attacker takes effect, denoted as t. fail The reliability model integrated in the simulator calculates the degradation of key parameters such as threshold voltage of each device in the standard unit based on the electrical signals of the circuit. After electrical simulation, the threshold voltage drift can be obtained as the aging parameter of the device.

[0068] In some more specific implementation scenarios, the step S200, which involves calling a device reliability model to predict the degradation of devices in the target circuit based on the input waveform and obtaining the device reliability degradation parameters, can further include steps S210-S230:

[0069] S210. Extract electrical parameters from the input waveform; wherein, electrical parameters may include, but are not limited to, stress voltage value, stress time, etc.

[0070] S220. Based on the preset transient step time and electrical parameters, the model parameters are obtained through the reliability model output.

[0071] S230. Perform electrical characteristic simulation based on model parameters to obtain reliability degradation parameters.

[0072] The device reliability model is a simplified model used to describe device aging phenomena. Integrating the reliability model into SPICE-level circuit simulation tools enables circuit aging prediction. Specifically, in this embodiment, the SPICE circuit simulator is commonly used for electrical simulation of devices or circuits. When a reliability model is included, the device model parameters used by the circuit simulator will interact with the reliability model. In this embodiment, the SPICE simulator can call the reliability model describing aging. The main reliability degradation includes bias voltage instability and hot carrier degradation. For example, Synopsys' PrimeSim supports calling these two types of reliability models. Within each transient step, the SPICE simulator calls the models of the involved devices according to the circuit structure to perform electrical simulation of the entire circuit, and inputs reliability-related electrical parameters such as stress voltage values ​​and stress time into the reliability model. The reliability model uses these parameters to perform device aging analysis and calculations to update the device model parameters, such as the device's threshold voltage. The SPICE simulator then performs electrical characteristic simulation of the device based on the updated model parameters, repeating this process until the set transient simulation time point ends. After the simulation is completed, the device's performance over a set time period t can be obtained. fail Model parameters after aging, such as threshold voltage drift.

[0073] S300: Construct an aging standard cell timing library based on reliability degradation parameters;

[0074] In practice, more specifically, step S300 may include steps S310-S330:

[0075] S310. Update the device model file according to the reliability degradation parameters; wherein, in the embodiment, the model file used to express the set of parameter values ​​used in the device model can be a SPICE model card;

[0076] S320. Based on the model file, the propagation delay and signal inversion delay of the standard cell after aging are obtained through the featureization tool.

[0077] S330. Based on the propagation delay and signal reversal delay, an aging standard unit timing library is constructed.

[0078] Specifically, in this embodiment, the device threshold voltage drift obtained in step S200 is updated to the device's SPICE model card. The standard cell library is then re-characterized using a library characterization tool to obtain the propagation delay and signal inversion delay of each standard cell after aging. The SPICE model card is a file describing the set of numerical values ​​corresponding to the parameters used in the device model. Then, based on the standard cell library timing template, a corresponding aging standard cell timing library is generated, completing the construction of the aging standard cell library.

[0079] S400: Perform timing simulation based on the aging standard cell timing library to select the critical path;

[0080] In the digital integrated circuit design process, static timing analysis, after considering the timing situation after aging, yields the delay of each path. The path with the longest delay is the critical path. For example... Figure 3 As shown, the delays of paths 1, 2, and n are described. It can be noted that before a certain point in time, path 1 has the longest delay, making it the critical path dominating the delay. However, after a certain point in time, path 2 has the longest delay, and at this point, path 2 becomes the critical path affecting the normal functioning of the circuit.

[0081] In this embodiment, step S400 mainly performs timing analysis after aging, that is, based on the aging standard cell timing library generated in step S300, timing simulation is performed on the circuit netlist that needs to be implanted with hardware Trojan, and the critical path is selected according to the signal path delay information obtained from the timing simulation.

[0082] In some more specific implementation scenarios, the step S400, which involves performing timing simulations based on the aging standard cell timing library to select the critical path, can include more specific steps S410-S440:

[0083] S410. Based on the netlist of the target circuit and the timing library of aging standard cells, perform timing analysis to obtain candidate timing paths;

[0084] S420. Obtain the gate-level cells in the netlist of the target circuit based on the candidate timing path analysis;

[0085] S430. Based on the aging standard cell timing library, the delay values ​​of gate-level cells and interconnect delay values ​​are superimposed to obtain the timing delay of candidate timing paths;

[0086] S440. Filter the timing delay to obtain the critical path.

[0087] Specifically, in this embodiment, timing simulation is performed on the netlist of the target circuit described in step S100, i.e., the process of analyzing whether the circuit timing meets the requirements. The tool used is a timing analysis tool such as PrimeTime. First, the netlist and the aging standard cell timing library constructed in step S300 are imported into the static timing analysis tool. The timing analysis tool first divides all timing paths contained in the netlist based on the input / output ports and flip-flops of the netlist. For each timing path, all gate-level cells in the netlist are parsed out. Simultaneously, the timing analysis tool sums the delay values ​​of all cells and interconnect delay values ​​of this timing path based on the delay values ​​of each standard cell defined in the aging standard cell timing library constructed in step S300, thereby obtaining the timing delay of this path. After the timing analysis is completed, the top 20% of paths with the largest delays are selected using the timing analysis tool's functions; these paths are the required critical paths.

[0088] S500: Determine path information and delay information based on the critical path, determine the timing constraint file, and construct the hardware Trojan circuit based on the timing constraint file.

[0089] In this embodiment, based on the selected critical paths, their corresponding paths and their delay information are determined. The determined paths and their corresponding delays are defined as the timing constraints of the critical paths, i.e., the timing margins of the critical paths after aging. The timing constraint file is then updated. These timing constraints ensure that the circuit operates normally before the hardware Trojan takes effect.

[0090] In some more specific implementation scenarios, the step S500, which involves determining path information and delay information based on the critical path, determining a timing constraint file, and constructing a hardware Trojan circuit based on the timing constraint file, may include more specific steps such as S510.

[0091] S510. Obtain the timing margin based on the delay information of the critical path, and update the timing constraint file based on the timing margin.

[0092] In the embodiment, during logic synthesis, the timing constraints in the provided constraint file must meet the timing requirements of the circuit within a specific time period. This timing constraint can also be called timing margin. Providing a certain timing margin for the circuit ensures its continued normal operation after long-term use. Therefore, the selection of timing margin depends on the critical path. The critical path is the path with the largest delay; using the delay of the critical path to formulate timing constraints can satisfy the timing requirements of all paths in the circuit. However, in actual circuit operation, the aging differences of each path will cause delay variations on different signal paths, and non-critical paths in the logic circuit may evolve into critical paths. For example... Figure 3 As shown, if the original critical path changes after a certain point in time, this point in time can be called the timing transition point. For the circuit to function correctly, the timing margin at this point should be the sum of the delay of the critical path before the timing transition point and the delay of the critical path after the timing transition point relative to the timing transition point. Figure 3 The intersection of curves Path1 and Path2 is the timing transition point, which ultimately ensures the circuit's lifespan. Figure 3 (Taking 10 years as an example) A stable and reliable timing margin is the timing margin 1 plus the aging timing margin after the timing transition point.

[0093] The key to aging-based hardware Trojan design lies in incorporating a timing margin set by the attacker into the design. Circuit designs based on this margin can effectively control the lifespan of the circuit. Circuits designed using this principle will not malfunction before their expected lifespan. However, as operating time increases, exceeding the set timing transition point will cause the circuit to malfunction due to timing errors. Furthermore, circuit failures caused by aging are difficult to trace using later hardware Trojan detection methods. Therefore, the core of aging-based hardware Trojan implantation lies in the effective utilization of circuit aging, providing insufficient aging timing margins to cause the circuit design to fail within the time range set by the attacker. Figure 3 As shown, if only the timing margin before the timing transition point is used as the timing constraint requirement for circuit design, the circuit will face the risk of failure after the timing transition point. Step S510 of the implementation scheme of the present invention can be divided into three steps: determining the circuit delay aging according to the circuit design, formulating the timing margin of the hardware Trojan circuit according to the attacker's needs, and using the formulated timing margin for the design of the Trojan circuit, such as the construction of the IP core.

[0094] Specifically, in the embodiment, S510 determines a new timing margin based on the critical path screening results of step S400, forming a timing constraint file with hardware Trojan attack capabilities. The accuracy of timing analysis and prediction of circuit lifetime depends on the timing library and timing constraint file of the standard cell library. If a standard cell library timing library without aging is used, the simulation results based on this timing library reflect the delay characteristics of each path under initial conditions. Due to the device reliability issues accompanying circuit operation, the degradation of device electrical characteristics after a certain period of use will cause the circuit delay to increase. Therefore, in normal circuit design, in order to consider the problem of increased delay caused by aging, sufficient margin is reserved for timing values ​​in the constraint file in the subsequent logic synthesis step, that is, making the timing requirements of the circuit more stringent. The hardware Trojan design based on aging formulates a timing margin with a certain anti-aging capability, unlike the strict timing constraints under traditional design methods, so that the circuit has the ability to have a certain service life (depending on the formulation of the new timing margin in step S510) before the problem of circuit failure occurs. Based on this principle, the delay of the critical path generated in step S400 is... Figure 3 The diagram illustrates the insufficient timing margin.

[0095] Hardware Trojan installers set a time limit t for circuit failure. fail This time value is the same as t in step S200. fail Same. After steps S100-S400, aging to t will be achieved. fail The path delay values ​​for each time period: Δt1, Δt1, Δt1, ..., Δt n Then, the delay values ​​of these n critical paths are compared to determine the top 20% critical paths: P1, P2, P3, ..., Pn, with time t... fail The path with the maximum delay at time Δt i To constrain the timing margin of the timing constraint file, this timing value is used to replace the maximum allowed delay in the original timing constraint file (commonly in SDC format). This generates a timing constraint file with hardware trojan characteristics.

[0096] In some more specific implementation scenarios, the step S500, which involves determining path information and delay information based on the critical path, determining the timing constraint file, and constructing the hardware Trojan circuit based on the timing constraint file, may also include more specific steps S520-S530:

[0097] S520. Based on the settings in the timing constraint file, perform logic synthesis on the netlist of the target circuit to obtain the gate-level netlist.

[0098] S530: Layout planning is performed based on the gate-level netlist to obtain the target circuit layout.

[0099] In this embodiment, the structural design portion based on digital integrated circuit design requires timing constraints as input for logic synthesis. The designed circuit will also operate normally within its expected lifespan, adhering to these timing constraints. This invention uses the critical path delay after aging to determine the timing margin at a specified attack time point. This timing margin is then used as a timing constraint to replace the original constraint file as the constraint condition for logic synthesis. The result after logic synthesis is the gate-level netlist of the hardware Trojan. Subsequent simulation and physical design then yield the final layout of the hardware Trojan, thus realizing the design of the hardware Trojan circuit.

[0100] More specifically, after updating the timing constraint file in the implementation example, logic synthesis of the netlist is required. This step uses logic synthesis tools such as Design Compiler. The specific steps involve inputting the netlist into the logic synthesis tool, then inputting the updated constraint file. The synthesis tool uses the settings in the timing constraint file to perform logic synthesis on the netlist, optimizing the circuit area and power consumption. The gate-level netlist generated after logic synthesis meets the requirements of the timing constraint file. At this point, the circuit design enters the physical design phase. The physical design phase is the process of implementing the circuit netlist into a layout. First, layout planning is performed using a layout planning tool such as IC Compiler to divide the netlist for easier subsequent processes. Then, placement and routing are performed using an automatic placement and routing tool to determine the location of circuit units or modules and optimize connections based on the previously divided netlist. After this step, the layout can be generated. Afterwards, the layout undergoes design rule verification and layout-to-schematic comparison. The final step is parasitic parameter extraction, where parasitic parameters of the layout are obtained, and timing simulation is performed again. After passing this step, the layout can be used for manufacturing.

[0101] like Figure 4 As shown in the accompanying drawings, the implementation process of the technical solution of this application will be described in more complete and detailed manner as follows:

[0102] First, the implementation requires the establishment of a standard cell library for aging. Circuit simulation tools and reliability models can be used to perform aging simulation on the cell circuits in the original standard cell library to obtain the SPICE model parameter values ​​of the devices in the cell circuit after aging at a specific time. Based on this, the library is re-characterized using library characterization tools to obtain the aging standard cell timing library.

[0103] Then, the embodiment further analyzes the timing based on the aging standard cell library, using the aging standard cell timing library as the input to the timing analysis tool, to analyze the path delay of the circuit and obtain the delay information of the critical path at different time points. It further determines the timing margin application containing hardware Trojan capabilities, determines the critical path delay of the target circuit based on the failure time point set by the attacker, and uses this critical path delay as a new timing margin to form a timing constraint file with hardware Trojan functionality. The subsequent circuit design process is based on the updated constraint file.

[0104] In summary, the embodiments of the technical solution of this application are centered on the principle of circuit aging. By establishing a standard cell timing library for aging, the timing analysis of the circuit path is performed using the standard cell library during synthesis to obtain the critical path under the working years set by the attacker. Based on this, new timing constraints are determined. The circuit designed based on the updated timing constraint file will fail due to timing errors on the critical path after the set working years, thereby achieving the purpose of hardware Trojan design.

[0105] On the other hand, the technical solution of this application also provides a hardware Trojan generation system, which includes:

[0106] The gate-level simulation module is used to perform gate-level simulation of the netlist of the target circuit and obtain the input waveforms of each standard cell input node.

[0107] The degradation prediction module is used to call the device reliability model, perform degradation prediction on the devices in the target circuit based on the input waveform, and obtain the device reliability degradation parameters.

[0108] The timing library module is used to build an aging standard cell timing library based on reliability degradation parameters;

[0109] The timing simulation module is used to perform timing simulation based on the aging standard cell timing library and filter out the critical path.

[0110] The circuit layout module is used to determine path information and delay information based on the critical path, determine the timing constraint file, and construct the hardware Trojan circuit based on the timing constraint file.

[0111] On the other hand, the technical solution of this application also provides a hardware Trojan generation device; which includes:

[0112] At least one processor; at least one memory for storing at least one program; when the at least one program is executed by the at least one processor, the at least one processor performs a method for generating a hardware Trojan as described in the first aspect.

[0113] This invention also provides a storage medium storing a corresponding executable program, which is executed by a processor to implement a hardware Trojan generation method as described in the first aspect.

[0114] From the above specific implementation process, it can be concluded that the technical solution provided by the present invention has the following advantages or strengths compared with the prior art:

[0115] 1. Simple and efficient implementation: The technical solution of this application does not require the analysis of the functions of each module of the original circuit to find the area where a Trojan can be implanted. At the same time, it does not require finding the corresponding trigger signal according to the circuit. The hardware Trojan design method based on aging proposed in this invention can be applied to any logic circuit. Since it only changes and replaces the timing constraint file, it has a great improvement in efficiency compared with the traditional hardware Trojan design and reduces time costs.

[0116] 2. High concealment: Compared with traditional hardware Trojans, the design proposed in this application makes full use of the unavoidable aging phenomenon of circuits. The hardware Trojan designed based on this characteristic of aging principle is undoubtedly highly concealed.

[0117] 3. Higher Completeness: Generally, hardware Trojans only activate after a specific trigger signal, and the trigger conditions are often set to be quite extreme to evade detection. If the trigger conditions are not met, the Trojan, even if present, cannot attack the circuit, resulting in a significant waste of resources. However, the aging-based hardware Trojan design in this application largely ensures that the Trojan activates after its set operating time, causing circuit malfunction.

[0118] 4. High versatility: The hardware Trojan design method based on aging can be applied to any specific implementation of any circuit, whether it is pure combinational logic, sequential logic, or logic circuit with specific functions. The method proposed in this application can be used without changing the existing design process.

[0119] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is altered and sub-operations described as part of a larger operation are executed independently.

[0120] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0121] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0122] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0123] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0124] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A method for generating a hardware Trojan, characterized in that, Includes the following steps: Perform gate-level simulation on the netlist of the target circuit to obtain the input waveforms of each standard cell input node; The device reliability model is invoked, and the degradation prediction of the devices in the target circuit is performed based on the input waveform to obtain the device reliability degradation parameters. A time series library of aging standard units is constructed based on the aforementioned reliability degradation parameters; Timing simulation was performed based on the aging standard unit timing library to identify the critical path. Based on the critical path, path information and delay information are determined, a timing constraint file is determined, and a hardware Trojan circuit is constructed based on the timing constraint file.

2. The method for generating a hardware Trojan according to claim 1, characterized in that, The step of performing gate-level simulation of the netlist of the target circuit to obtain the input waveforms of each standard cell input node includes: Obtain the description file of the target circuit, and form a test file based on the description file; The test file is used as a simulation stimulus to perform logic simulation and obtain the input waveform.

3. The method for generating a hardware Trojan according to claim 1, characterized in that, The step of calling the device reliability model and predicting the degradation of devices in the target circuit based on the input waveform to obtain the device reliability degradation parameters includes: Electrical parameters are extracted based on the input waveform; Based on the preset transient step time and the electrical parameters, the model parameters are obtained through the reliability model output; The reliability degradation parameters are obtained by performing electrical characteristic simulations based on the model parameters.

4. The method for generating a hardware Trojan according to claim 1, characterized in that, The step of constructing the aging standard cell timing library based on the reliability degradation parameters includes: Update the device's model file based on the aforementioned reliability degradation parameters; Based on the model file, the propagation delay and signal flip delay of the standard unit after aging are obtained by using a featureization tool. The aging standard unit timing library is constructed based on the propagation delay and the signal flip delay.

5. The method for generating a hardware Trojan according to claim 1, characterized in that, The step of performing timing simulation based on the aging standard cell timing library to screen out the critical path includes: Candidate timing paths are obtained by timing analysis based on the netlist of the target circuit and the timing library of the aging standard cells. The gate-level cells in the netlist of the target circuit are obtained by parsing the candidate timing paths; The timing delay of the candidate timing path is obtained by superimposing the delay values ​​of the gate-level units and the interconnect delay values ​​according to the aging standard unit timing library. The critical path is obtained by filtering the timing delays.

6. The method for generating a hardware Trojan according to claim 1, characterized in that, The step of determining path information and delay information based on the critical path, determining a timing constraint file, and constructing a hardware Trojan circuit based on the timing constraint file includes: The timing margin is obtained based on the delay information of the critical path, and the timing constraint file is updated based on the timing margin.

7. A method for generating a hardware Trojan according to any one of claims 1-6, characterized in that, The step of determining path information and delay information based on the critical path, determining the timing constraint file, and constructing the hardware Trojan circuit based on the timing constraint file further includes: Based on the settings in the timing constraint file, the netlist of the target circuit is logically synthesized to obtain a gate-level netlist; The target circuit layout is obtained by performing layout planning based on the gate-level netlist.

8. A hardware Trojan generation system, characterized in that, include: The gate-level simulation module is used to perform gate-level simulation of the netlist of the target circuit and obtain the input waveforms of each standard cell input node. The degradation prediction module is used to call the device reliability model, perform degradation prediction on the devices in the target circuit based on the input waveform, and obtain the device reliability degradation parameters. The timing library module is used to construct an aging standard cell timing library based on the reliability degradation parameters. The timing simulation module is used to perform timing simulation based on the aging standard cell timing library and filter out the critical path. The circuit layout module is used to determine path information and delay information based on the critical path, determine the timing constraint file, and construct a hardware Trojan circuit based on the timing constraint file.

9. A device for generating a hardware Trojan, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs a method for generating a hardware Trojan as described in any one of claims 1-7.

10. A storage medium storing a processor-executable program, characterized in that, The processor-executable program, when executed by the processor, is used to run a method for generating a hardware Trojan as described in any one of claims 1-7.

Images