4.2.2 Features and Critical Points of the ProASIC3 Chip
Security Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
4.2.3 Brief Overview of the Method of Experimental
Detection of a Hardware Trojan in the A3P250Actel
Microcircuit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
4.2.4 Analysis of the Results of the Control Experiment
for Identification of a Hardware Trojan in the
Special-Purpose Microcircuit ProASIC3 . . . . . . . . . . . . . 304
4.2.5 Hardware Trojans in Commercial Processors . . . . . . . . . 310
4.3 Classification of Hardware Trojans in Chips . . . . . . . . . . . . . . . . 317
4.3.1 Problem Description . . . . . . . . . . . . . . . . . . . . . . . . . . . 317
4.3.2 General Classification of Hardware Trojans . . . . . . . . . . 318
4.4 Methods of Implementation of Hardware Trojans into
Microcircuits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
4.4.1 Introduction to the Problem . . . . . . . . . . . . . . . . . . . . . 325
4.4.2 Hierarchical Levels of Introducing Trojans into
Microcircuits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330
4.5 Mechanisms for Activating Introduced Hardware Trojans . . . . . . 331
4.6 Methods of Detecting Hardware Trojans in High-Duty
Microcircuits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
4.6.1 Introduction to the Problem . . . . . . . . . . . . . . . . . . . . . 337
4.6.2 Basic Methods for Detecting Hardware Trojans . . . . . . . 340
4.7 Case Study of the Development and Implementation
of a Hardware Trojan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
4.7.1 Justification and Motivation . . . . . . . . . . . . . . . . . . . . . 351
4.7.2 Hierarchical Classification of Attackers . . . . . . . . . . . . . 354
4.8 Peculiarities of the Introduction of Hardware Trojans
in Passive Radio Frequency Identification Tags . . . . . . . . . . . . . 373
4.8.1 Introduction to the Problem . . . . . . . . . . . . . . . . . . . . . 373
4.8.2 EPC C1G2 RF Tags and Hardware Trojans . . . . . . . . . . 374
4.8.3 Triggering Mechanisms of Hardware Trojans
in EPC C1G2 Radio Frequency Tags . . . . . . . . . . . . . . 376
4.8.4 Experimental Results . . . . . . . . . . . . . . . . . . . . . . . . . . 381
4.9 Hardware Trojans in Wireless Cryptographic ICs . . . . . . . . . . . . 384
4.9.1 Organization Features of Information Leakage from
Wireless Cryptographically Protected Microcircuits . . . . 384
4.9.2 Basic Methods of Trojan Detection . . . . . . . . . . . . . . . . 392
4.10 Techniques for Hardware Trojan Design . . . . . . . . . . . . . . . . . . 397
4.10.1 Design of Sequential Hardware Trojans . . . . . . . . . . . . . 398
4.10.2 Examples of Designing Hardware Trojans Using
Additional Gates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409
4.10.3 Case Study of Gate-Level Trojan Implementation
to Bypass RON Protected Design . . . . . . . . . . . . . . . . . 411
Contents
xvii