Design of an RF-Triggered Hardware Trojan with a Layout-Matched Golden Model via HT-First Place-and-Route

Abstract

Hardware Trojans (HTs) are malicious circuits that remain dormant under normal operation and activate only when a specific trigger condition is met, making them difficult to detect through conventional testing. This paper presents the design and silicon-level fabrication of an RF-triggered HT integrated into an AES-128 ASIC under a realistic foundry-level supply-chain threat model. The proposed design consists of two key components: (1) an on-chip loop antenna with T-matching network embedded in the M6 metal layer, targeting 5.8 GHz CW excitation, and (2) an HT-first Place & Route (P&R) strategy that preserves the placement and routing of the non-HT logic between the HT-inserted chip and the golden model (GM), so that the two variants are structurally as similar as possible for a controlled comparison. Upon receiving the 5.8 GHz trigger signal, the HT asserts a persistent reset forcing the AES-128 output to zero, causing denial of service (DoS). Both the HT-inserted chip and GM were fabricated simultaneously in a 180-nm process and packaged in identical QFP-64 packages, enabling controlled comparison under identical conditions.