[Paper Review] An Automated Framework for Board-level Trojan Benchmarking

Tamzidul Hoque, Shuo Yang+3 more|arXiv (Cornell University)|Mar 27, 2020

Physical Unclonable Functions (PUFs) and Hardware Security4 citations

TL;DR

This paper presents the first automated framework for generating board-level hardware Trojan benchmarks by classifying Trojans based on insertion phase, activation mechanism, payload impact, and physical characteristics. It introduces a toolflow that automatically inserts diverse, customizable Trojans into open-source PCB netlists, producing 150 benchmark designs for unbiased evaluation of trust verification techniques, validated via fabricated prototypes showing minimal side-channel leakage (up to 3.5% current increase).

ABSTRACT

Economic and operational advantages have led the supply chain of printed circuit boards (PCBs) to incorporate various untrusted entities. Any of the untrusted entities are capable of introducing malicious alterations to facilitate a functional failure or leakage of secret information during field operation. While researchers have been investigating the threat of malicious modification within the scale of individual microelectronic components, the possibility of a board-level malicious manipulation has essentially been unexplored. In the absence of standard benchmarking solutions, prospective countermeasures for PCB trust assurance are likely to utilize homegrown representation of the attacks that undermines their evaluation and does not provide scope for comparison with other techniques. In this paper, we have developed the first-ever benchmarking solution to facilitate an unbiased and comparable evaluation of countermeasures applicable to PCB trust assurance. Based on a taxonomy tailored for PCB-level alterations, we have developed high-level Trojan models. From these models, we have generated a custom pool of board-level Trojan designs of varied complexity and functionality. We have also developed a tool-flow for automatically inserting these Trojans into various PCB designs and generate the Trojan benchmarks (i.e., PCB designs with Trojan). The tool-based Trojan insertion facilitate a comprehensive evaluation against large number of diverse Trojan implementations and application of data mining for trust verification. Finally, with experimental measurements from a fabricated PCB, we analyze the stealthiness of the Trojan designs.

Motivation & Objective

• Address the lack of standardized, publicly available benchmarks for evaluating PCB-level hardware Trojan countermeasures.
• Overcome the limitations of hand-crafted Trojan models that hinder reproducibility and cross-technique comparison.
• Enable large-scale, systematic evaluation of trust verification techniques using diverse, automatically generated Trojan instances.
• Develop a taxonomy tailored for PCB-level Trojans, distinguishing them from IC-level threats due to post-fabrication component insertion.
• Facilitate data-driven approaches like machine learning by providing a large, representative dataset of Trojan-infected PCBs.

Proposed method

• Develop a comprehensive taxonomy of PCB-level Trojans based on insertion phase, abstraction level, activation mechanism, payload impact, location, and physical characteristics.
• Design 5 trigger templates (e.g., 4-input AND, 8-input mixed logic) and 3 payload templates (XOR, MUX) for varied Trojan functionality.
• Implement a toolflow that takes a PCB netlist, Trojan templates, and configuration inputs to automatically insert Trojans into target designs.
• Represent PCBs as graph structures ($G_{PCB}$) to enable programmatic modification and insertion of Trojan components at specified nodes.
• Convert modified graph back to netlist format using KiCAD, enabling layout generation and design rule checking.
• Verify Trojan insertion via connectivity checks and DRC validation using KiCAD tools to ensure correctness and manufacturability.

Experimental results

Research questions

• RQ1 How can a comprehensive and extensible taxonomy of board-level hardware Trojans be defined to capture the unique threat surface of PCB supply chains?
• RQ2 To what extent can automated Trojan insertion into real PCB designs be achieved while preserving functional correctness and physical feasibility?
• RQ3 What is the side-channel footprint of diverse board-level Trojans, and how stealthy are they under typical operational conditions?
• RQ4 Can a large-scale, publicly available benchmark suite of Trojan-infected PCBs enable more reliable and comparable evaluation of trust verification techniques?
• RQ5 How do different Trojan configurations (trigger and payload combinations) affect detectability through current consumption and signal leakage?

Key findings

• The framework successfully generated 150 unique Trojan-infected PCB benchmarks by combining 5 triggers and 3 payloads across 10 open-source PCB designs.
• The fabricated PCB platform demonstrated that Trojan activation causes only a minimal increase in current consumption—up to 3.5%—making detection via power analysis highly challenging.
• Connectivity and design rule checks confirmed the correctness and manufacturability of all inserted Trojans, validating the reliability of the toolflow.
• The side-channel analysis revealed that even functional changes like signal corruption or leakage via MUXs are difficult to detect without prior knowledge.
• The toolflow enables scalable, repeatable, and reproducible benchmark generation, supporting future research in automated trust verification.
• The public availability of the benchmark suite (via [19]) supports standardized evaluation and comparison of emerging countermeasures in PCB trust assurance.