conference paper published Qazi Arbab Ahmed author 727640000-0002-1837-2254 Tobias Wiersema author 3118 Marco Platzner author 398 78 department Design, Automation and Test in Europe Conference (DATE'21) SFB 901 - Subproject B4 project SFB 901 - Project Area B project SFB 901 project The battle of developing hardware Trojans and corresponding countermeasures has taken adversaries towards ingenious ways of compromising hardware designs by circumventing even advanced testing and verification methods. Besides conventional methods of inserting Trojans into a design by a malicious entity, the design flow for field-programmable gate arrays (FPGAs) can also be surreptitiously compromised to assist the attacker to perform a successful malfunctioning or information leakage attack. The advanced stealthy malicious look-up-table (LUT) attack activates a Trojan only when generating the FPGA bitstream and can thus not be detected by register transfer and gate level testing and verification. However, also this attack was recently revealed by a bitstream-level proof-carrying hardware (PCH) approach. In this paper, we present a novel attack that leverages malicious routing of the inserted Trojan circuit to acquire a dormant state even in the generated and transmitted bitstream. The Trojan's payload is connected to primary inputs/outputs of the FPGA via a programmable interconnect point (PIP). The Trojan is detached from inputs/outputs during place-and-route and re-connected only when the FPGA is being programmed, thus activating the Trojan circuit without any need for a trigger logic. Since the Trojan is injected in a post-synthesis step and remains unconnected in the bitstream, the presented attack can currently neither be prevented by conventional testing and verification methods nor by recent bitstream-level verification techniques. https://ris.uni-paderborn.de/download/20681/44752/1812.pdf application/pdf 2021 Design, Automation and Test in Europe Conference (DATE)2021Alpexpo | Grenoble, France eng 10.23919/DATE51398.2021.9474026 Ahmed, Qazi Arbab, Tobias Wiersema, and Marco Platzner. “Malicious Routing: Circumventing Bitstream-Level Verification for FPGAs.” In <i>2021 Design, Automation &#38; Test in Europe Conference &#38; Exhibition (DATE)</i>. Alpexpo | Grenoble, France: 2021 Design, Automation and Test in Europe Conference (DATE), 2021. <a href="https://doi.org/10.23919/DATE51398.2021.9474026">https://doi.org/10.23919/DATE51398.2021.9474026</a>. Q.A. Ahmed, T. Wiersema, M. Platzner, in: 2021 Design, Automation &#38; Test in Europe Conference &#38; Exhibition (DATE), 2021 Design, Automation and Test in Europe Conference (DATE), Alpexpo | Grenoble, France, 2021. Ahmed, Q. A., Wiersema, T., &#38; Platzner, M. (2021). Malicious Routing: Circumventing Bitstream-level Verification for FPGAs. <i>2021 Design, Automation &#38; Test in Europe Conference &#38; Exhibition (DATE)</i>. Design, Automation and Test in Europe Conference (DATE’21), Alpexpo | Grenoble, France. <a href="https://doi.org/10.23919/DATE51398.2021.9474026">https://doi.org/10.23919/DATE51398.2021.9474026</a> Q. A. Ahmed, T. Wiersema, and M. Platzner, “Malicious Routing: Circumventing Bitstream-level Verification for FPGAs,” presented at the Design, Automation and Test in Europe Conference (DATE’21), Alpexpo | Grenoble, France, 2021, doi: <a href="https://doi.org/10.23919/DATE51398.2021.9474026">10.23919/DATE51398.2021.9474026</a>. Ahmed QA, Wiersema T, Platzner M. Malicious Routing: Circumventing Bitstream-level Verification for FPGAs. In: <i>2021 Design, Automation &#38; Test in Europe Conference &#38; Exhibition (DATE)</i>. 2021 Design, Automation and Test in Europe Conference (DATE); 2021. doi:<a href="https://doi.org/10.23919/DATE51398.2021.9474026">10.23919/DATE51398.2021.9474026</a> @inproceedings{Ahmed_Wiersema_Platzner_2021, place={Alpexpo | Grenoble, France}, title={Malicious Routing: Circumventing Bitstream-level Verification for FPGAs}, DOI={<a href="https://doi.org/10.23919/DATE51398.2021.9474026">10.23919/DATE51398.2021.9474026</a>}, booktitle={2021 Design, Automation &#38; Test in Europe Conference &#38; Exhibition (DATE)}, publisher={2021 Design, Automation and Test in Europe Conference (DATE)}, author={Ahmed, Qazi Arbab and Wiersema, Tobias and Platzner, Marco}, year={2021} } Ahmed, Qazi Arbab, et al. “Malicious Routing: Circumventing Bitstream-Level Verification for FPGAs.” <i>2021 Design, Automation &#38; Test in Europe Conference &#38; Exhibition (DATE)</i>, 2021 Design, Automation and Test in Europe Conference (DATE), 2021, doi:<a href="https://doi.org/10.23919/DATE51398.2021.9474026">10.23919/DATE51398.2021.9474026</a>. 206812020-12-07T14:03:00Z2023-05-11T09:16:34Z