A hardware Trojan (HT) detection method is presented that is based on measuring and detecting small systematic changes in path delays introduced by capacitive loading effects or series inserted gates of HTs. The path delays are measured using a high resolution on-chip embedded test structure called a time-to-digital converter (TDC) that provides approx. 25 ps of timing resolution. A calibration method for the TDC as well as a chip-averaging technique are demonstrated to nearly eliminate chip-to-chip and within-die process variation effects on the measured path delays across chips. This approach significantly improves the correlation between Trojan-free chips and a simulation-based golden model. Path delay tests are applied to multiple copies of a 90nm custom ASIC chip having two copies of an AES macro. The AES macros are exact replicas except for the insertion of several additional gates in the second hardware copy, which are designed to model HTs. Simple statistical detection methods are used to isolate and detect systematic changes introduced by these additional gates. We present hardware results which demonstrate that our proposed chip-averaging and calibration techniques in combination with a single nominal simulation model can be used to detect small delay anomalies introduced by the inserted gates of hardware Trojans.

Variations in path delays are increasing with scaling, and are increasingly affected by neighborhood interactions. To fully characterize within-die variations, delays must be measured in the context of actual core-logic macros using embedded test structures (ETSs). In this brief, we propose an ETS called regional delay behavior (REBEL) that is designed to measure path delays in a minimally invasive fashion. REBEL provides capabilities similar to an off-chip logic analyzer. We implemented REBEL in a 90-nm test chip and present results on within-die path delay variations in a floating point unit. We also analyze the impact on delay when the chips are subjected to industrial-level temperature and voltage variations.

A physical unclonable function (PUF) is an embedded integrated circuit (IC) structure that is designed to leverage naturally occurring variations to produce a random bitstring. In this paper, we evaluate a PUF which leverages resistance variations which occur in transmission gates (TGs) of ICs. We also investigate a novel on-chip technique for converting the voltage drops produced by TGs into a digital code, i.e., a voltage-to-digital converter (VDC). The analysis is carried out on data measured from chips subjected to temperature variations over the range of -40°C to +85°C and voltage variations of +/- 10% of the nominal supply voltage. The TG PUF and VDC produce high quality bitstrings that perform exceptionally well under statistical metrics including stability, randomness and uniqueness.

Variations in delay caused by within-die and die-to-die process variations and SOI history effect increase timing margins and reduce performance. In order to develop mitigation techniques to reduce the detrimental effects of delay variations, particularly those that occur within-die, new methods of measuring delay variations within actual products are needed. The data provided by such techniques can also be used for validating models, i.e., can assist with model-to-hardware correlation. In this paper, we propose a flush delay technique for measuring both regional delay variations and SOI history effect and validate the method using a test structure fabricated in a 65 nm SOI process.

As feature printability becomes more challenging in advanced technology nodes, measuring and characterizing process variation effects on delay and power is becoming increasingly important. In this paper, we present two embedded test structures (ETS) for carrying out path delay measurement in actual product designs. Of the two structures proposed here, one is designed to be incorporated into a customer's scan structures, augmenting selected functional units with the ability to perform accurate path delay measurements. We refer to this ETS as REBEL (regional delay behavior). It is designed to leverage the existing scan chain as a means of reducing area overhead and performance impact. For cases in which very high resolution of delay measurements is required, a second standalone structure is proposed which we refer to as TDC for time-to-digital converter. Beyond characterizing process variations, these ETSs can also be used for design debug, detection of hardware Trojans and small delay defects and as physical unclonable functions.

New validation methods are needed for ensuring integrated circuit (IC) Trust, and in particular for detecting hardware Trojans. In this paper, we investigate the signal-to-noise ratio (SNR) requirements for detecting Trojans by conducting ring oscillator (RO) experiments on a set of V2Pro FPGAs. The ROs enable a high degree of control over the switching activity in the FPGAs while simultaneously permitting subtle delay and transient power supply anomalies to be introduced through simple modifications to the RO logic structure. Power and delay analyses are first carried out across a set of FPGAs using RO configurations that emulate Trojan-free conditions. These experiments are designed to determine the magnitude of process and environmental (PE) variations, and are used to establish statistical limits on the noise floor for the subsequent emulated Trojan experiments. The emulated Trojan experiments introduce anomalies in power and delay in subtle ways as additional loads and series inserted gates. The data from both experiments is used to determine the detection sensitivity of several statistical methods to the transient anomalies introduced by these types of design modifications. A calibration technique is proposed that improves sensitivity to small transient anomalies significantly. Finally, we describe testing techniques that enable high resolution measurements of power and delay to support the proposed calibration and statistics-based detection methods.