4.5 Mechanisms for Activating Introduced Hardware Trojans
333
Payload
ER*
Trigger
Combination Trojan
k-bit comparator
Fig. 4.31 Principle of building a combination logic-based Trojan
the physical parameters of a microcircuit, such as the ambient temperature and the
amount of energy consumed, mechanical accelerations, vibration, etc.
For external activation of a Trojan, an “external” effect on a microcircuit is
necessary. This impact can be standard user input or some kind of combined microcircuit output. Triggers for standard user input can be command keys, switches,
keyboard, or keywords/phrases in a solid input stream. Any system components that
somehow interact with the target device (electronic system) in which this “infected”
microcircuit is located can also trigger the activation trigger of the Trojan from the
outside.
Hardware Trojans with internal activation.
Methods of activation of Trojans based on combinational logic. Internal activation
of Trojans is based on some specific states, upon reaching which the hardware Trojan
is activated in the target device. In most cases, it is built on standard sequential or
combinational logic circuits.
Figure 4.31 shows a typical example of such a device.
Such a hardware Trojan with activation based on combinational logic circuits
“comes alive” (is triggered) when a so-called trigger state is reached, when certain
values (vectors) set by the attacker are detected (formed) at certain nodes of the
internal IC electrical circuit. This type of activation mechanism can only be implemented using combinational logic (based on the use of a standard combinational
trigger). In [147], the authors give an example of a so-called single-ended cheat
code—a specific address on a bus that instantly activates a hardware Trojan. In practice, such a combination activation may require a larger set of certain simultaneous
states on some nodes, for example, on the internal registers of a microcircuit combined
with a predetermined certain specific word on the data bus and a specific word on
the address bus. A specific example is given in [143], in which certain combined sets
were used at IC inputs to activate a hardware Trojan. In particular, it can be a specific
input set (Trojan launch code) that combines data, control commands, addresses, and
even individual self-test commands.
333
Payload
ER*
Trigger
Combination Trojan
k-bit comparator
Fig. 4.31 Principle of building a combination logic-based Trojan
the physical parameters of a microcircuit, such as the ambient temperature and the
amount of energy consumed, mechanical accelerations, vibration, etc.
For external activation of a Trojan, an “external” effect on a microcircuit is
necessary. This impact can be standard user input or some kind of combined microcircuit output. Triggers for standard user input can be command keys, switches,
keyboard, or keywords/phrases in a solid input stream. Any system components that
somehow interact with the target device (electronic system) in which this “infected”
microcircuit is located can also trigger the activation trigger of the Trojan from the
outside.
Hardware Trojans with internal activation.
Methods of activation of Trojans based on combinational logic. Internal activation
of Trojans is based on some specific states, upon reaching which the hardware Trojan
is activated in the target device. In most cases, it is built on standard sequential or
combinational logic circuits.
Figure 4.31 shows a typical example of such a device.
Such a hardware Trojan with activation based on combinational logic circuits
“comes alive” (is triggered) when a so-called trigger state is reached, when certain
values (vectors) set by the attacker are detected (formed) at certain nodes of the
internal IC electrical circuit. This type of activation mechanism can only be implemented using combinational logic (based on the use of a standard combinational
trigger). In [147], the authors give an example of a so-called single-ended cheat
code—a specific address on a bus that instantly activates a hardware Trojan. In practice, such a combination activation may require a larger set of certain simultaneous
states on some nodes, for example, on the internal registers of a microcircuit combined
with a predetermined certain specific word on the data bus and a specific word on
the address bus. A specific example is given in [143], in which certain combined sets
were used at IC inputs to activate a hardware Trojan. In particular, it can be a specific
input set (Trojan launch code) that combines data, control commands, addresses, and
even individual self-test commands.