328
4 Hardware Trojans in Microcircuits
Changing the functionality of a system can be basically used to support wider
attacks. It is obvious that the possibilities of causing damage to security increase
significantly when using both hardware and software attacks [141]. As an example,
in [140], unauthorized changes made in the central processor that support software
attacks are presented. As a result of such an attack, memory access granting and
program modification contribute to the broadening of powers unauthorized by the
developer allowing for a subsequent access to the system through a backdoor and a
password theft attack.
Numerous specification-changing types of hardware Trojans have that common
feature of distorting the main parametric characteristics of an application-specific IC
or its specification that is not related to its functionality. Such parametric characteristics include a clock system or temporal characteristic values, as well as the amount
of power consumption of the IC. The effect is usually achieved by directly changing
the internal physical properties—the topology of interconnections and the geometry
of transistor configurations. Unlike hardware Trojans, which affect the functionality,
this class of Trojans is characterized by changes in the topology of buses and transistors, and their destructive actions can lead to complete system failures by a certain
external signal [140].
Theoretically, it can be assumed that, in addition to the modifications being considered, such a hardware Trojan may also be included in microcircuit design so that the
specification change has a trigger or activation mechanism. Various types of effects
on ICs are characteristic of this class being considered, including limiting the computational capabilities of the system by introducing unauthorized changes in generator
circuits to the system frequency, modifying computing units, or input/output cells,
in which the functions performed by these nodes do not change, but their electrical
characteristics and dynamic characteristics deteriorate. A change in the layout of
gates (circuit layout), functionally equivalent, but having higher parasitic components of the passive elements, causes performance deterioration at high load activity
and manifests itself in the occurrence of temporary errors (malfunctions). In [141] in
Ch. 6 of the encyclopedia, there are examples of circuits with jumpers in the form of
a resistor, the result of which is short-circuiting jumper-type Trojans under certain
operating modes, and with the introduction of a capacitor, which leads to an increase
in the delay time due to an increase in capacitive load.
The next, not less numerous class of Trojans, covers various hardware modifications aimed at organizing hidden transmission of confidential data from the information system to the attacker. Such transmission is carried out without direct participation of the system and, of course, behind the back of the system user. Transmission
mechanisms can involve existing internal and external channels of the system, as well
as side (special) channels. For example, in our work [137], an example is given when
information leakage can occur via radio frequency, optical, or thermal side channels.
Secret information can also be extracted by analyzing the amount of IC power
consumption, its specific noise characteristics, as well as any other functional
and physical characteristics. Standard RS232 and JTAG interfaces, unfortunately,
can also be used as unauthorized channels of information leakage. For example,
such an original hardware Trojan that makes it easy to determine any encryption
4 Hardware Trojans in Microcircuits
Changing the functionality of a system can be basically used to support wider
attacks. It is obvious that the possibilities of causing damage to security increase
significantly when using both hardware and software attacks [141]. As an example,
in [140], unauthorized changes made in the central processor that support software
attacks are presented. As a result of such an attack, memory access granting and
program modification contribute to the broadening of powers unauthorized by the
developer allowing for a subsequent access to the system through a backdoor and a
password theft attack.
Numerous specification-changing types of hardware Trojans have that common
feature of distorting the main parametric characteristics of an application-specific IC
or its specification that is not related to its functionality. Such parametric characteristics include a clock system or temporal characteristic values, as well as the amount
of power consumption of the IC. The effect is usually achieved by directly changing
the internal physical properties—the topology of interconnections and the geometry
of transistor configurations. Unlike hardware Trojans, which affect the functionality,
this class of Trojans is characterized by changes in the topology of buses and transistors, and their destructive actions can lead to complete system failures by a certain
external signal [140].
Theoretically, it can be assumed that, in addition to the modifications being considered, such a hardware Trojan may also be included in microcircuit design so that the
specification change has a trigger or activation mechanism. Various types of effects
on ICs are characteristic of this class being considered, including limiting the computational capabilities of the system by introducing unauthorized changes in generator
circuits to the system frequency, modifying computing units, or input/output cells,
in which the functions performed by these nodes do not change, but their electrical
characteristics and dynamic characteristics deteriorate. A change in the layout of
gates (circuit layout), functionally equivalent, but having higher parasitic components of the passive elements, causes performance deterioration at high load activity
and manifests itself in the occurrence of temporary errors (malfunctions). In [141] in
Ch. 6 of the encyclopedia, there are examples of circuits with jumpers in the form of
a resistor, the result of which is short-circuiting jumper-type Trojans under certain
operating modes, and with the introduction of a capacitor, which leads to an increase
in the delay time due to an increase in capacitive load.
The next, not less numerous class of Trojans, covers various hardware modifications aimed at organizing hidden transmission of confidential data from the information system to the attacker. Such transmission is carried out without direct participation of the system and, of course, behind the back of the system user. Transmission
mechanisms can involve existing internal and external channels of the system, as well
as side (special) channels. For example, in our work [137], an example is given when
information leakage can occur via radio frequency, optical, or thermal side channels.
Secret information can also be extracted by analyzing the amount of IC power
consumption, its specific noise characteristics, as well as any other functional
and physical characteristics. Standard RS232 and JTAG interfaces, unfortunately,
can also be used as unauthorized channels of information leakage. For example,
such an original hardware Trojan that makes it easy to determine any encryption