  Side-channel analysis has been proven effective at detecting hardware Trojans
in integrated circuits (ICs). However, most detection techniques rely on large
external probes and antennas for data collection and require a long measurement
time to detect Trojans. Such limitations make these techniques impractical for
run-time deployment and ineffective in detecting small Trojans with subtle
side-channel signatures. To overcome these challenges, we propose a
Programmable Sensor Array (PSA) for run-time hardware Trojan detection,
localization, and identification. PSA is a tampering-resilient integrated
on-chip magnetic field sensor array that can be re-programmed to change the
sensors' shape, size, and location. Using PSA, EM side-channel measurement
results collected from sensors at different locations on an IC can be analyzed
to localize and identify the Trojan. The PSA has better performance than
conventional external magnetic probes and state-of-the-art on-chip single-coil
magnetic field sensors. We fabricated an AES-128 test chip with four AES
Hardware Trojans. They were successfully detected, located, and identified with
the proposed on-chip PSA within 10 milliseconds using our proposed cross-domain
analysis.
