Hardware Trojans in fdSOI

With shortening turn-around times and increasing complexity for digital circuits, design reuse, third party IP and today even physical chiplets has increased. Malicious actors have more options to introduce hardware backdoors to packaged systems, which will leak data if triggered. In this work, we show two novel approaches to introduce such backdoors, that are possible due to the specifics of fully depleted silicon on insulator (fdSOI) technology. The first method relies on modifying the doping profile of an antenna cell to introduce a covert short between the back gate and logic signals. The second method constructs specific illegal states which are latched when the clock is running with the trigger frequency. Basic test structures have been designed such that they are DRC and STA clean. LVS does not reveal the hidden structure, while measurements in silicon confirm their operation.