4.5 Mechanisms for Activating Introduced Hardware Trojans
335
mechanism. Moreover, in [148], a specific example of such a circuit consisting only
of an electrical capacitor charged through a resistor is given. The charge magnitude
and the voltage across the capacitor are determined by the activity of the surrounding
logic, which, in turn, can highly likely reflect the activity of the entire microcircuit.
The hardware Trojan is triggered when a certain voltage threshold is reached on the
capacitor, which is very simple to implement in practice.
Such an activation trigger can be both digital and analog. Experts note that analog
activation is preferable to use in order to increase the “secrecy” and “detection
complexity” of a Trojan. An attacker can also easily use several individual sequential
type triggers to activate various Trojans in an IC.
Activation of Trojans based on the use of sequential logic elements can provide
both content and time events. In [144], such triggers were studied, when a Trojan
is activated only with certain content data and only at a certain time. For a simple
activation trigger, it was shown that testing time during which such a Trojan can
reasonably likely be activated is at least 1035 years: herein the probability of detecting
such a combination of certain numeric codes entered from the keyboard for a certain
time interval was discussed. Only this one particular example shows the complexity
of the problem to detect a Trojan.
The authors of [144], “having taken the place of an attacker,” also proposed
the “temperature trigger” model. The principle of its operation is as follows. The
activity of certain sections of an IC on a crystal actually highly likely modulates
the frequency of a ring oscillator made on inverters. In turn, the frequency of a
standard ring oscillator, built on the elements used in the microcircuit, determines
the heat release, which affects the delay in some other similar ring oscillator. When a
certain value of the switching latency of the ring oscillator is reached, the hardware
Trojan is activated. It is obvious that similar mechanisms can be built on the use of a
signal to activate electromagnetic or radio frequency interference, the frequency or
power consumption of a logical circuit, as well as the time characteristic of power
consumption of certain sections of an IC.
Hardware Trojans with external activation
External activation mechanisms imply some kind of interaction between the introduced hardware Trojan and the external environment, which is different from the
information or control system in which the Trojan is introduced. The advantage
of using “external” triggers for an attacker is that activation is initiated by a source
located outside the system and therefore not dependent on it [145]. In the same work,
examples of radio frequency receivers and special antennas for receiving an external
signal introduced directly into an “infected” device are given.
Thus, sensors that are physically built into a microcircuit, that can continuously
monitor physical parameters, are discussed in work [143]: temperature, electrical
voltage, electromagnetic interference, humidity, and even altitude. Cybersecurity
experts often refer to activation mechanisms with similar sensors on a microcircuit
as “side-channel triggers,” by analogy with information technologies in electronic
devices without direct influence on them [127].
335
mechanism. Moreover, in [148], a specific example of such a circuit consisting only
of an electrical capacitor charged through a resistor is given. The charge magnitude
and the voltage across the capacitor are determined by the activity of the surrounding
logic, which, in turn, can highly likely reflect the activity of the entire microcircuit.
The hardware Trojan is triggered when a certain voltage threshold is reached on the
capacitor, which is very simple to implement in practice.
Such an activation trigger can be both digital and analog. Experts note that analog
activation is preferable to use in order to increase the “secrecy” and “detection
complexity” of a Trojan. An attacker can also easily use several individual sequential
type triggers to activate various Trojans in an IC.
Activation of Trojans based on the use of sequential logic elements can provide
both content and time events. In [144], such triggers were studied, when a Trojan
is activated only with certain content data and only at a certain time. For a simple
activation trigger, it was shown that testing time during which such a Trojan can
reasonably likely be activated is at least 1035 years: herein the probability of detecting
such a combination of certain numeric codes entered from the keyboard for a certain
time interval was discussed. Only this one particular example shows the complexity
of the problem to detect a Trojan.
The authors of [144], “having taken the place of an attacker,” also proposed
the “temperature trigger” model. The principle of its operation is as follows. The
activity of certain sections of an IC on a crystal actually highly likely modulates
the frequency of a ring oscillator made on inverters. In turn, the frequency of a
standard ring oscillator, built on the elements used in the microcircuit, determines
the heat release, which affects the delay in some other similar ring oscillator. When a
certain value of the switching latency of the ring oscillator is reached, the hardware
Trojan is activated. It is obvious that similar mechanisms can be built on the use of a
signal to activate electromagnetic or radio frequency interference, the frequency or
power consumption of a logical circuit, as well as the time characteristic of power
consumption of certain sections of an IC.
Hardware Trojans with external activation
External activation mechanisms imply some kind of interaction between the introduced hardware Trojan and the external environment, which is different from the
information or control system in which the Trojan is introduced. The advantage
of using “external” triggers for an attacker is that activation is initiated by a source
located outside the system and therefore not dependent on it [145]. In the same work,
examples of radio frequency receivers and special antennas for receiving an external
signal introduced directly into an “infected” device are given.
Thus, sensors that are physically built into a microcircuit, that can continuously
monitor physical parameters, are discussed in work [143]: temperature, electrical
voltage, electromagnetic interference, humidity, and even altitude. Cybersecurity
experts often refer to activation mechanisms with similar sensors on a microcircuit
as “side-channel triggers,” by analogy with information technologies in electronic
devices without direct influence on them [127].