# Hardware Trojan Insertion in Finalized Layouts: From Methodology to a Silicon Demonstration

arXiv: https://arxiv.org/abs/2112.02972 · HTML: https://mlsanity.com/paper/2112.02972/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Dec 2021.

## Built on by (most cited first, 1 of 1)

- [TroLLoc: Logic Locking and Layout Hardening for IC Security Closure against Hardware Trojans](https://mlsanity.com/paper/2405.05590/) (2024)

## Abstract (arXiv)

Owning a high-end semiconductor foundry is a luxury very few companies can afford. Thus, fabless design companies outsource integrated circuit fabrication to third parties. Within foundries, rogue elements may gain access to the customer's layout and perform malicious acts, including the insertion of a hardware trojan (HT). Many works focus on the structure/effects of a HT, while very few have demonstrated the viability of their HTs in silicon. Even fewer disclose how HTs are inserted or the time required for this activity. Our work details, for the first time, how effortlessly a HT can be inserted into a finalized layout by presenting an insertion framework based on the engineering change order flow. For validation, we have built an ASIC prototype in 65nm CMOS technology comprising of four trojaned cryptocores. A side-channel HT is inserted in each core with the intent of leaking the cryptokey over a power channel. Moreover, we have determined that the entire attack can be mounted in a little over one hour. We also show that the attack was successful for all tested samples. Finally, our measurements demonstrate the robustness of our SCT against skews in the manufacturing process.