SymbA: Symbolic Execution at C-level for Hardware Trojan Activation

Due to the global supply of semiconductor intellectual property (IP) cores, modern system-on-chip (SoC) designs are vulnerable to malicious functionality, referred to as hardware Trojans. Hardware Trojans are inserted to bypass the security mechanisms in a SOC or cause confidentiality, integrity, and availability violations. There is an increased emphasis on finding effective solutions to generate tests to activate Trojans in hardware designs (if any) in third party IPs. However, state-of-the-art approaches suffer from ineffectiveness in detection and scalability. In this paper, we propose SymbA that utilizes symbolic execution at C/C++ level to activate malicious functionality hidden in RTL designs. SymbA is based on mapping of RTL design to C level and leveraging the existing powerful software-level symbolic execution engine to generate tests. SymbA maps back the generated tests to RTL and checks if the hidden Trojans have been activated. In this paper, we use KLEE Symbolic Execution Engine and show the efficiency of SymbA by applying it to a number of Trust-Hub benchmarks. SymbA improves the existing state-of-the-art techniques significantly with regard to performance, coverage and memory usage.