Automated Hardware Trojan Detection via Abstract Syntax Tree Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting hardware Trojans in electronic circuits are either incomplete, resource-intensive, or only effective during runtime, failing to provide a comprehensive check in the development phase and resulting in costly system rebuilds when malicious structures are detected.
Innovation Solution
A method that generates an abstract syntax tree from a system model, compares partial structures with reference malicious structures, extracts characteristic features, determines valid ranges, and converts these into a state machine validation language to check for malicious behavior, allowing for a comprehensive and automated detection of structural and behavioral malfunctions in electronic circuits during the development phase.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If model checking is used to convert the system model into a state machine and check for safety rules, then security properties can be evaluated, but only the state machine representation of sequential behavior is supported leaving large areas of the electronic circuit unchecked
Solution Approach 1:
The detection process is segmented into multiple independent modules: abstract syntax tree generation, pattern matching against malicious structure database, characteristic feature extraction, property determination, and state machine validation. Each module handles a specific aspect of detection, allowing comprehensive circuit analysis while maintaining manageable complexity through modular architecture.
Solution Approach 2:
The invention transitions from traditional state machine-only checking to a multi-dimensional approach by incorporating abstract syntax tree analysis, pattern matching in multiple representation formats, and validation across different property dimensions (structural, behavioral, temporal). This multi-dimensional detection framework overcomes the limitation of single-dimensional state machine checking.
2Reliability
If runtime verification is used to monitor circuit compliance with safety regulations, then malicious behavior can be detected, but detection only occurs in live operation requiring expensive system rebuilds
Solution Approach 1:
The system performs preliminary detection actions during the development and synthesis phases by analyzing the abstract syntax tree and validating properties before the circuit is deployed. This preliminary validation identifies potential malicious structures early, preventing the need for expensive runtime detection and subsequent system rebuilds.
Solution Approach 2:
The invention introduces an intermediary validation layer between circuit design and deployment using abstract syntax trees as an intermediate representation. This intermediary structure enables comprehensive analysis of both structural and behavioral properties before the circuit reaches runtime, bridging the gap between design-time verification and runtime operation.
3Loss of time
If structural check is used to analyze input and output signals for harmful structures, then circuits can be checked in the development stage, but a large part of the circuit is ignored and comprehensive detection is not guaranteed
Solution Approach 1:
The detection system is designed with universal applicability by implementing multiple detection mechanisms that work together: pattern matching for structural anomalies, abstract syntax tree analysis for comprehensive code examination, characteristic feature extraction for behavioral analysis, and state machine validation for temporal property verification. This multi-functional approach ensures complete circuit coverage while maintaining development-stage detection capability.
4Reliability
If a comprehensive check of the entire electronic circuit is performed, then all potential malicious structures can be detected, but the detection effort becomes very high
Solution Approach 1:
The system implements a tiered detection approach where the most critical and high-probability malicious structures are detected through mandatory pattern matching and abstract syntax tree analysis, while less critical aspects are validated through optional state machine checks. This partial action strategy achieves comprehensive detection of serious threats while maintaining high productivity by avoiding exhaustive analysis of all circuit aspects with equal depth.
Data Source
Figure 1
Figure 2a~3
Figure 4~5
AI summary
The present invention relates to a method and a device (1) for the automated detection of fault structures (M) in an electronic circuit whose system model (S) has been modeled in a hardware description language, comprising: generating (2) an abstract syntax tree (AST) from the system model (S); pattern comparison (3) of at least one substructure of the abstract syntax tree (AST) with at least one reference fault structure (Ri) and, in case of a match, marking the substructure as a potential fault structure (Pi); determining (5) characteristic features (Cij) of the potential fault structure (Pi), associated properties (Fij) and a permissibility range (Aij) of each property (Fij); translating the property (Fij) and the permissibility range (Aij) into a test language for a state machine (Z);and checking a state machine (Z) obtained by transforming the system model (S) or the abstract syntax tree (AST) for different states and/or state transitions, whereby a fault structure (M) is detected if in a state and/or state transition one of the properties (Fij) leaves the feasibility range (Aij).