Search papers, labs, and topics across Lattice.
This paper explores the vulnerabilities of standard cell libraries in semiconductor manufacturing, proposing a novel threat model where these libraries are treated as untrusted components. By synthesizing circuits with tampered libraries, the authors demonstrate how malicious foundries can replace inactive Hardware Trojan (HT) cells with active ones, effectively masking their presence from designers. The study showcases the stealthiness of this attack vector through experiments on benchmark circuits, revealing significant implications for hardware security in digital designs.
Standard cell libraries, often assumed to be secure, can be weaponized to stealthily insert Hardware Trojans, posing a critical risk to hardware integrity.
Vulnerabilities inherent to the fabless semiconductor manufacturing model have significantly increased the risk of malicious Hardware Trojan (HT) insertion, posing severe threats to hardware security. Several HT mitigation and detection strategies have been developed, and existing works explore the insertion of HTs in the space between standard cells in an integrated circuit. However, there is a lack of research into the vulnerabilities posed by the building blocks of most digital designs on the market today, the standard cells. This work investigates a novel threat model in which standard cells are considered untrusted. Our proposed threat model provides the design house with a tampered standard cell library. The intended netlist is synthesized and implemented using the tampered library. During fabrication, a nefarious foundry replaces the library's deactivated HT cells with activated counterparts. Using open-source and industry-standard Electronic Design Automation (EDA) tools, existing standard cell libraries, Saed32nm and Sky130nm, are converted into malicious libraries capable of masking the presence of arbitrary HTs from IC designers. The malicious library is then applied and characterized in multiple standard benchmark designs. To demonstrate the efficacy and stealthiness of this standard cell-based attack vector, three benchmark circuits, an AES-128 encryption core, an Ethernet controller, and a WISHBONE DMA engine, were synthesized using both clean and Trojan-infected libraries across Synopsys 32nm and SkyWater 130nm technologies. Design-level features, including total cell count, total area, dynamic power consumption, and static power, were extracted from these synthesized circuits to serve as inputs for binary classification
