322
4 Hardware Trojans in Microcircuits
and installation of chips on boards. Linkage of the system may allow the Trojans
to run [135].
The next question, which is important for our classification: on which level of
abstraction is the Trojan launched?
Functional diagram in Fig. 4.27 partially answers this question and shows the
entire synthesis process. Red blocks on the sides demonstrate only separate examples
of Trojans against the dark background of the screen.
(1) At the system level, various functional modules, wiring diagrams, and data
transfer protocols are defined. At this level, any hardware Trojans can be
launched by separate modules in any target hardware [136]
(2) A typical software design environment includes standard tools for synthesis,
simulation, verification, and validation. Now, it is absolutely clear to us that
introduction of a Trojan can be performed by any instrumental means of automated engineering and any scripts. Software Trojans embedded in these instrumental means of automated engineering can also disguise consequences of
actions of any unauthorized hardware Trojans.
(3) At the register transfer level, each functional module is described by using a
standard language of registers and signals. A Trojan can be easily designed at
the level of register transfers, which is confirmed by the results discussed later
in this book.
(4) At the gate level, the structure is represented as interconnection of logic gates.
This level allows the “hacker” to carefully control all aspects of the introduced
Trojan, including its size and location.
(5) Logic gates are built with the help of library transistors. If a Trojan is implemented at this level, its developer gains control over such characteristics of
the circuit as power and timed mode of operation. Separate transistors can be
inserted and removed to change functions of the circuit [130]. The size of the
transistor can be modified, thus changing parameters of the circuit [130].
(6) At the topology level, location and connection of all circuit components are
described. This is also a possible level of design for Trojan introduction. Trojans
can be installed by means of changing the wiring layout, distance between circuit
elements, and redistribution of metal and polysilicon connections between
layers.
Another important question: how is a Trojan activated?
As shown below, the design of certain Trojans makes them constantly active. Others
remain in sleeping mode until activated. To take a Trojan off into an active mode, it
is necessary to trigger a specific event—internal or external. When a trigger activates
a Trojan, the latter can either remain active at all times or go back to sleep after a
certain set period of time.
Let us consider both variants.
(1) An internal event takes place inside the target device. This event may depend on
time or on physical conditions. The hardware counter in the device can trigger
4 Hardware Trojans in Microcircuits
and installation of chips on boards. Linkage of the system may allow the Trojans
to run [135].
The next question, which is important for our classification: on which level of
abstraction is the Trojan launched?
Functional diagram in Fig. 4.27 partially answers this question and shows the
entire synthesis process. Red blocks on the sides demonstrate only separate examples
of Trojans against the dark background of the screen.
(1) At the system level, various functional modules, wiring diagrams, and data
transfer protocols are defined. At this level, any hardware Trojans can be
launched by separate modules in any target hardware [136]
(2) A typical software design environment includes standard tools for synthesis,
simulation, verification, and validation. Now, it is absolutely clear to us that
introduction of a Trojan can be performed by any instrumental means of automated engineering and any scripts. Software Trojans embedded in these instrumental means of automated engineering can also disguise consequences of
actions of any unauthorized hardware Trojans.
(3) At the register transfer level, each functional module is described by using a
standard language of registers and signals. A Trojan can be easily designed at
the level of register transfers, which is confirmed by the results discussed later
in this book.
(4) At the gate level, the structure is represented as interconnection of logic gates.
This level allows the “hacker” to carefully control all aspects of the introduced
Trojan, including its size and location.
(5) Logic gates are built with the help of library transistors. If a Trojan is implemented at this level, its developer gains control over such characteristics of
the circuit as power and timed mode of operation. Separate transistors can be
inserted and removed to change functions of the circuit [130]. The size of the
transistor can be modified, thus changing parameters of the circuit [130].
(6) At the topology level, location and connection of all circuit components are
described. This is also a possible level of design for Trojan introduction. Trojans
can be installed by means of changing the wiring layout, distance between circuit
elements, and redistribution of metal and polysilicon connections between
layers.
Another important question: how is a Trojan activated?
As shown below, the design of certain Trojans makes them constantly active. Others
remain in sleeping mode until activated. To take a Trojan off into an active mode, it
is necessary to trigger a specific event—internal or external. When a trigger activates
a Trojan, the latter can either remain active at all times or go back to sleep after a
certain set period of time.
Let us consider both variants.
(1) An internal event takes place inside the target device. This event may depend on
time or on physical conditions. The hardware counter in the device can trigger