A semiconductor chip hardware Trojan real-time detection method and system based on back infrared thermal imaging

Abstract

This invention provides a real-time detection method and system for semiconductor chip hardware Trojans based on back-side infrared thermal imaging, relating to the field of integrated circuit security detection technology. The method includes: acquiring an infrared image sequence from the back of the chip and converting it into a temperature field image; obtaining a reference temperature field image and calculating a differential image; performing parallel processing on the differential image using at least two image analysis algorithms to obtain multiple real-time similarity indices; and determining abnormal thermal activity based on changes in each similarity index through a composite decision logic. The system includes an imaging module, a data processing and control module, and a human-computer interaction module. This invention utilizes the infrared transparency of silicon to directly image the transistor plane from the back side. Through multi-algorithm fusion analysis and composite decision-making, it achieves high sensitivity, high real-time performance, and strong anti-interference detection of low-power, short-lived Trojan activities, making it particularly suitable for the security detection of advanced packaged chips such as three-dimensional integrated circuits.

Description

Technical Field

[0001] This invention relates to the field of integrated circuit security testing technology, and in particular to a method and system for real-time detection of hardware Trojans on semiconductor chips based on back infrared thermal imaging. Background Technology

[0002] With the globalization of semiconductor chip design and manufacturing, hardware Trojans have become a serious security threat. Hardware Trojans are hidden circuits maliciously implanted in integrated circuits, which can lead to information leaks, functional malfunctions, and other problems. Traditional destructive reverse engineering detection methods are costly and inefficient; logic testing methods are insufficient to cover all triggering conditions.

[0003] Non-invasive detection methods based on side-channel analysis have become a research hotspot, inferring anomalies by monitoring changes in physical parameters such as power consumption, current, and electromagnetic radiation during chip operation. Among these, thermal signals (temperature distribution), as a side channel directly reflecting transistor power consumption, offer advantages such as intuitiveness and image quality. Infrared thermal imaging technology has already been used for chip surface temperature measurement and fault analysis.

[0004] However, existing trojan detection technologies based on infrared thermal imaging have the following prominent problems: First, most methods rely on imaging the front of the chip, which is not suitable for chips that are only accessible from the back after packaging, especially three-dimensional integrated circuits (3DIC); Second, existing detection algorithms are not sensitive to trojan activity with low power consumption and weak thermal signals, and are prone to false alarms or missed alarms; Third, there is a lack of robust methods to effectively identify transient trojan activity in the background thermal noise environment generated by the normal operation of the chip; Fourth, the comprehensive optimization of the detection system's real-time performance, accuracy, and sensitivity is insufficient.

[0005] Therefore, there is an urgent need to develop a hardware Trojan thermal detection method and system that can effectively image from the back of a chip and has high sensitivity, strong anti-interference ability and real-time performance. Summary of the Invention

[0006] Purpose of the invention: To address the shortcomings of the existing technology, this invention proposes a real-time detection method for hardware Trojans on semiconductor chips based on back-side infrared thermal imaging. Furthermore, it proposes a system for implementing this prediction method. This method utilizes the infrared transparency of silicon substrates to directly image the transistor plane from the back of the chip. By integrating multiple image processing algorithms for parallel analysis and composite decision-making, it achieves high-performance detection of weak and transient Trojan thermal activity, which is particularly suitable for advanced packaged chips such as 3DIC.

[0007] To achieve the above objectives, a first aspect of the present invention proposes a real-time detection method for hardware Trojans on semiconductor chips based on back-side infrared thermal imaging, comprising the following steps:

[0008] Step 1: Image Acquisition and Preprocessing

[0009] A continuous infrared image sequence is acquired from the back of the chip under test and converted into a temperature field image sequence to obtain a reference temperature field image under normal conditions.

[0010] Step 2: Calculation of the difference image:

[0011] For each frame of real-time temperature field image, calculate its difference image with the reference temperature field image;

[0012] Step 3: Parallel Analysis of Multiple Algorithms

[0013] The difference image is processed using at least two different image analysis algorithms, and at least two real-time similarity indices are obtained through parallel computation.

[0014] Step 4: Determining Abnormal Activity

[0015] Based on the changes in the at least two real-time similarity indicators, a composite decision-making logic is used to determine whether abnormal hot activity has occurred.

[0016] This invention solves the problem of front-facing imaging being impractical by performing infrared imaging from the back of the chip, making it particularly suitable for 3DIC chips. By calculating differential images, static thermal background is effectively eliminated. By employing at least two algorithms in parallel analysis and establishing a composite decision logic, the advantages of different algorithms in signal sensitivity, response speed, and noise resistance are comprehensively utilized, significantly improving the reliability and accuracy of weak signal detection and effectively reducing false alarms and false negatives.

[0017] The aforementioned method for real-time detection of hardware Trojans on semiconductor chips based on back-side infrared thermal imaging is characterized in that, in step one, when converting the infrared image into a temperature field image, the emissivity setting value used is lower than the typical emissivity of the chip substrate material in the infrared band. By intentionally employing a lower emissivity setting value, this invention can enhance the grayscale contrast changes caused by localized weak heating in the infrared image without altering the actual physical temperature. This is equivalent to preprocessing and enhancing the original thermal signal, which is particularly beneficial for improving the detection performance of subsequent contrast-sensitive algorithms such as binarization comparison methods.

[0018] The aforementioned method for real-time detection of semiconductor chip hardware Trojans based on back-side infrared thermal imaging is characterized in that at least two different image analysis algorithms in step three are selected from the following combinations: Structural Similarity Index (SSIM) method, histogram comparison method, binarization comparison method, and two-dimensional correlation coefficient method. This invention preferably combines these algorithms because they are complementary in performance: the SSIM method has a fast response speed and can quickly capture overall changes in image structure; the histogram comparison method is extremely sensitive to global changes in image grayscale distribution, particularly adept at detecting weak, distributed thermal changes, and has strong resistance to local noise; the binarization comparison method is simple and direct, and has a clear response to high-contrast signals; the two-dimensional correlation coefficient method excels at matching peak positions. The optimal algorithm combination can be flexibly selected according to different detection requirements.

[0019] The aforementioned method for real-time detection of hardware Trojans on semiconductor chips based on back-side infrared thermal imaging is characterized by the mandatory inclusion of the histogram comparison method in step three. This invention emphasizes the necessity of including the histogram comparison method because it exhibits irreplaceable advantages in Trojan activity detection scenarios characterized by low power consumption, weak signals, and potential masking by background noise. It makes judgments by comparing changes in the statistical distribution of the entire temperature field, is insensitive to local random thermal noise, but effectively captures even weak global temperature distribution shifts caused by Trojan activity. This is crucial for reducing false alarms and improving the detection rate of concealed Trojans.

[0020] The aforementioned method for real-time detection of semiconductor chip hardware Trojans based on back-side infrared thermal imaging is characterized by an additional step between step two and step three: spatial filtering of the differential image to suppress noise. Preferably, the spatial filtering is median filtering. This invention introduces a median filtering step after the differential image calculation, which can effectively suppress random thermal noise such as "salt and pepper" noise commonly found in infrared images. These noise points may form isolated bright or dark spots in the differential image, easily misjudged as valid signals by algorithms such as binarization. Using median filtering can smooth out these isolated noise points while preserving image edges well, significantly reducing false alarms caused by them.

[0021] The aforementioned method for real-time detection of semiconductor chip hardware Trojans based on back-side infrared thermal imaging is characterized by the following composite decision logic in step four: when the change amplitude of at least two different real-time similarity indicators exceeds their respective preset thresholds within a short time window, it is determined that abnormal thermal activity has occurred. This invention employs an AND logic-based composite decision mechanism, requiring multiple independent pieces of evidence (detection results from different algorithms) to simultaneously support anomaly detection, which greatly improves the reliability of the determination. A single algorithm may produce false triggers due to noise, background fluctuations, etc., but the probability of multiple algorithms simultaneously triggering false alarms based on different principles is extremely low. This design ensures a high detection rate while maximally suppressing false alarms.

[0022] The aforementioned real-time detection method for semiconductor chip hardware Trojans based on back-side infrared thermal imaging is characterized by assigning a higher judgment weight to the similarity index calculated by the histogram comparison method in the composite decision logic. This is due to the superior performance of the histogram comparison method in weak signals and noise resistance. In the composite decision-making process, it can be set such that: when the histogram comparison index exceeds its threshold, even if another index does not fully meet the threshold, it can still be judged as abnormal as long as it reaches a low confidence level; conversely, if the histogram comparison index is not triggered, even if other indicators are triggered, it should be judged cautiously or considered suspicious and requiring further observation. This weight design further optimizes the system's decision-making performance in complex noisy environments.

[0023] In addition, the present invention also provides a real-time hardware Trojan detection system for implementing the above method, characterized in that the system includes:

[0024] An imaging module is used to acquire infrared radiation data from the back of the chip;

[0025] The data processing and control module is configured to execute the steps of the above method;

[0026] The human-computer interaction module is used to display the detection results and system status.

[0027] The imaging module includes an infrared thermal imager, whose optical configuration enables it to perform thermal imaging of the active area of ​​the chip through the chip's substrate material.

[0028] This invention achieves non-invasive temperature measurement from the back through an imaging module, high-speed real-time analysis through a data processing and control module, and provides intuitive operation and result display through a human-computer interaction module, thus forming a complete and efficient online hardware Trojan detection solution.

[0029] Compared with the prior art, the present invention has the following advantages:

[0030] 1. This invention utilizes the physical property of silicon being transparent to infrared light and innovatively adopts a back-side infrared imaging method to directly observe the temperature field of the transistor plane. This solves the technical problem of the inaccessibility of front-side imaging for advanced packaged chips such as 3DIC, and greatly expands the application scope of infrared thermal imaging detection technology.

[0031] 2. This invention employs a multi-algorithm parallel analysis and composite decision-making mechanism to overcome the performance limitations of a single algorithm. In particular, the forced inclusion of histogram comparison method, with its higher weight, enables the system to exhibit extremely high detection sensitivity and background noise resistance for low-power, weak-thermal-signal Trojan activities, achieving a qualitative improvement in detection performance.

[0032] 3. This invention effectively suppresses various noise interferences and optimizes the input signal quality through multiple preprocessing methods such as differential imaging, median filtering, and low emissivity setting, laying a solid foundation for subsequent high-precision analysis.

[0033] 4. The detection method of the present invention has an optimized process, supports high-frequency image acquisition and real-time processing, and can respond quickly to short-duration Trojan pulse activity, meeting the needs of real-time security monitoring.

[0034] 5. The detection system provided by this invention has a high degree of integration, good automation, relatively simple operation, intuitive and reliable detection results, and is easy to integrate into existing chip testing or security monitoring platforms. It has good practicality and promotional value. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the detection system in Embodiment 1 of the present invention.

[0036] Figure 2 This is a schematic diagram of a computing framework used for data acquisition and analysis. Detailed Implementation

[0037] In the following description, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention can be practiced without one or more of these details. In other instances, certain technical features well-known in the art have not been described in order to avoid obscuring the invention.

[0038] Example 1

[0039] This embodiment describes the construction and implementation of a basic hardware Trojan detection system.

[0040] Step 1: System Setup

[0041] like Figure 1 As shown, the system mainly includes:

[0042] (1) Imaging module: A high-precision infrared thermal imager is used, and the lens of the thermal imager is aimed at the bare silicon back of the 3DIC chip under test.

[0043] (2) Data processing and control module: A high-performance industrial computer running custom-developed analysis software. This software controls the thermal imager to acquire data and integrates a real-time analysis program using the SSIM algorithm and histogram comparison method.

[0044] (3) Human-computer interaction module: computer monitor, used to display real-time temperature cloud map, similarity change curve and alarm information.

[0045] Step Two, Testing Process:

[0046] (1) Initialization: Install the 3DIC chip on the test socket and ensure that the back is clean; start the system and continuously acquire 100 frames of infrared images without applying any abnormal stimulation, and calculate the average temperature field as the reference temperature field image I_ref.

[0047] (2) Real-time detection starts: The system enters the loop detection state.

[0048] (3) Image acquisition and preprocessing: The thermal imager continuously acquires images I_t at 100 Hz. The analysis software converts I_t into a temperature field and calculates the difference image D_t = I_t - I_ref.

[0049] (4) Parallel analysis of multiple algorithms: The following calculations are performed simultaneously on D_t:

[0050] a. Calculate the SSIM index of D_t and the zero matrix reference image to obtain the similarity index S_SSIM(t);

[0051] b. Calculate the normalized gray-level histogram H_t of D_t, calculate the average pairwise distance D_Hist(t) between it and the initial zero image histogram H_0, and normalize it to obtain the similarity index S_Hist(t)=1-normalize(D_Hist(t)).

[0052] (5) Composite decision and alarm: Calculate the rate of change of S_SSIM(t) and S_Hist(t) in real time within the most recent 0.1 second time window; set thresholds Th_SSIM and Th_Hist; when the rate of change of S_SSIM(t) exceeds Th_SSIM and the rate of change of S_Hist(t) exceeds Th_Hist, it is determined that abnormal thermal activity has been detected, triggering an audible and visual alarm and recording the data.

[0053] Example 2

[0054] This embodiment, based on Embodiment 1, demonstrates the system's detection performance for weak thermal pulse signals.

[0055] In this embodiment, a 3DIC thermal testing chip is used, with a programmable resistor embedded in the top chip to simulate the heat generated by a Trojan horse.

[0056] Step 1 is the same as Step 1 in Example 1.

[0057] Step 2, Background noise simulation: Apply a constant current of 10mA to the bottom chip resistor of the test chip through an external power supply to generate a stable background thermal field.

[0058] Step 3: Simulate Trojan activity: Apply a 5mA single current pulse with a duration of 1 second to the top chip resistor through an external power supply to simulate a low-power Trojan trigger.

[0059] Step 4: Execution of the detection process: Same as step 2 in Example 1, the system continues to run and record data.

[0060] The test results show that although the average temperature rise is very weak, both S_SSIM(t) and S_Hist(t) rise rapidly after the pulse begins and exceed the set threshold, successfully triggering an alarm. After the pulse ends, the indicators gradually decrease. This embodiment demonstrates that the method of the present invention has excellent detection capability for weak and transient thermal signals as low as 12.5mW.

[0061] Example 3

[0062] This embodiment focuses on illustrating the role of median filtering in suppressing noise and reducing false alarms.

[0063] Based on the steps of Example 2, this embodiment adds a median filtering step in the "image acquisition and preprocessing" stage after calculating the difference image D_t.

[0064] The specific implementation steps are as follows: After obtaining D_t, immediately apply a 3x3 pixel median filter to it to obtain the filtered image D_t_filtered. Subsequent SSIM and histogram analysis are both based on D_t_filtered.

[0065] To compare the results, we recorded the detection process in both cases—without filtering and with filtering—in a single test. It is clear that the unfiltered image contains a large number of random, isolated white and black dots ("salt and pepper" noise), while these noise dots are effectively suppressed in the filtered image, resulting in a smoother image and a clearer true thermal distribution contour.

[0066] This embodiment verifies that median filtering, as an effective preprocessing method, can significantly improve the reliability of the system under complex thermal environments.

[0067] Example 4

[0068] This example demonstrates how to adapt different detection needs by adjusting algorithm combinations and decision weights.

[0069] In this embodiment, we configure the system for two typical scenarios:

[0070] Scenario A (Pursuing extremely high detection speed, with certain expectations for signal strength): In the algorithm configuration of the data processing and control module, the "SSIM method + binarization comparison method" is selected as a parallel algorithm combination. In the composite decision logic, the thresholds of both algorithms are set to medium levels, and an alarm is only triggered when both are activated simultaneously. This configuration responds extremely quickly to strong and rapid thermal changes.

[0071] Scenario B (Pursuing detection capabilities for extremely weak signals, allowing for a slightly slower response): In the algorithm configuration, force the selection of "Histogram Comparison Method + SSIM Method". In the composite decision logic, significantly lower the trigger threshold for the histogram comparison method while raising the trigger threshold for the SSIM method. A rule is set: if the histogram comparison method index exceeds its (lower) threshold, and the SSIM method index shows a positive change (even if it does not reach its higher threshold), it is judged as an anomaly. This configuration greatly enhances the detection capability for weak, diffuse thermal signals, suitable for screening highly concealed Trojans.

[0072] This embodiment illustrates that the method of the present invention has good flexibility and configurability, and can adapt to diverse practical application scenarios.

[0073] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A real-time detection method for semiconductor chip hardware Trojans based on back-side infrared thermal imaging, characterized in that, Includes the following steps: Step 1: Acquire a continuous infrared image sequence from the back of the chip under test and convert it into a temperature field image sequence to obtain a reference temperature field image under normal conditions. Step 2: For each frame of real-time temperature field image, calculate the difference image between it and the reference temperature field image; Step 3: Process the difference image using at least two different image analysis algorithms and calculate at least two real-time similarity indices in parallel; Step 4: Based on the changes in the real-time similarity index, determine whether abnormal hot activity has occurred through composite decision logic.

2. The method for real-time detection of semiconductor chip hardware Trojans based on back-side infrared thermal imaging according to claim 1, characterized in that, In step one, when converting the infrared image into a temperature field image, the emissivity setting used is lower than the typical emissivity of the chip substrate material in the infrared band.

3. The method for real-time detection of semiconductor chip hardware Trojans based on back-side infrared thermal imaging according to claim 1, characterized in that, The at least two different image analysis algorithms mentioned in step three are selected from the following combinations: structural similarity index method, histogram comparison method, binarization comparison method, and two-dimensional correlation coefficient method.

4. The method for real-time detection of semiconductor chip hardware Trojans based on back-side infrared thermal imaging according to claim 3, characterized in that, Step three must include the histogram comparison method.

5. The method for real-time detection of semiconductor chip hardware Trojans based on back-side infrared thermal imaging according to claim 1, characterized in that, Between step two and step three, there is also a step of spatial filtering the differential image to suppress noise.

6. The method for real-time detection of semiconductor chip hardware Trojans based on back-side infrared thermal imaging according to claim 5, characterized in that, The spatial filtering is median filtering.

7. The method for real-time detection of semiconductor chip hardware Trojans based on back-side infrared thermal imaging according to claim 1, characterized in that, The composite decision-making logic described in step four is as follows: when the change amplitude of at least two different real-time similarity indicators exceeds their respective preset thresholds within a short time window, it is determined that abnormal thermal activity has occurred.

8. The method for real-time detection of semiconductor chip hardware Trojans based on back-side infrared thermal imaging according to claim 7, characterized in that, In the composite decision logic, the similarity index calculated by the histogram comparison method is given a higher judgment weight.

9. A real-time detection system for hardware Trojans on semiconductor chips, characterized in that, include: An imaging module is used to acquire infrared radiation data from the back of the chip; The data processing and control module is configured to perform the steps of the method according to any one of claims 1 to 8; The human-computer interaction module is used to display the detection results and system status.

10. The real-time detection system for semiconductor chip hardware Trojans according to claim 9, characterized in that, The imaging module includes an infrared thermal imager, whose optical configuration enables it to perform thermal imaging of the active area of ​​the chip through the chip's substrate material.

Images