378
4 Hardware Trojans in Microcircuits
Tag
b)
Reader
а)
Reader
Fig. 4.48 Explanations for Trojan activation methods: triggering activated by a single command
and a finite state machine (a); rare sequence of single commands (b)
tag will accept the BlockErase command exactly at the time when an FSM
is in the Reply state. However, such triggering can be easily detected by
monitoring the system in real time. The triggering will be included in the
finite state machine of the construct shown in Fig. 4.47, and the sequence
of commands is shown in Fig. 4.48.
(2) Command cycle activation to form the required state of a finite state
machine
This method is very similar to the previous one, but, in this case, the triggering of the
HT will occur after the tag has received a multiple unusual command in the current
state of the finite state machine. For example, like the previous method, if a tag
receives the BlockErase command 50 times while the finite state machine is in the
Reply state, then the triggering mechanism will be activated. This type of triggering
a Trojan is more difficult to detect during operation tests. Moreover, this method
requires the use of more logical elements, since it is necessary to set the counter
accordingly. Therefore, although this method is better than the previous one, it is
still not as reliable as required. As in the previous triggering mechanism, the Trojan
is triggered with the sequence of commands shown in Fig. 4.48b repeated 50 times.
(3) Activation of a Rare Sequence of Commands
The next option is based on the use of a finite state machine. The main advantage
of a finite state machine is that triggering a Trojan can be as sophisticated as the
developer wishes. Therefore, the developer can choose a very rare state sequence in
a finite state machine to trigger an HT. In this case, the triggering is more difficult
to activate, here a counter can be used, which counts the number of times when a
rare sequence chosen by an attacker takes place. Therefore, it is more difficult for an
analyst to turn on an HT and, as a result, to detect it. Moreover, as is well known,
4 Hardware Trojans in Microcircuits
Tag
b)
Reader
а)
Reader
Fig. 4.48 Explanations for Trojan activation methods: triggering activated by a single command
and a finite state machine (a); rare sequence of single commands (b)
tag will accept the BlockErase command exactly at the time when an FSM
is in the Reply state. However, such triggering can be easily detected by
monitoring the system in real time. The triggering will be included in the
finite state machine of the construct shown in Fig. 4.47, and the sequence
of commands is shown in Fig. 4.48.
(2) Command cycle activation to form the required state of a finite state
machine
This method is very similar to the previous one, but, in this case, the triggering of the
HT will occur after the tag has received a multiple unusual command in the current
state of the finite state machine. For example, like the previous method, if a tag
receives the BlockErase command 50 times while the finite state machine is in the
Reply state, then the triggering mechanism will be activated. This type of triggering
a Trojan is more difficult to detect during operation tests. Moreover, this method
requires the use of more logical elements, since it is necessary to set the counter
accordingly. Therefore, although this method is better than the previous one, it is
still not as reliable as required. As in the previous triggering mechanism, the Trojan
is triggered with the sequence of commands shown in Fig. 4.48b repeated 50 times.
(3) Activation of a Rare Sequence of Commands
The next option is based on the use of a finite state machine. The main advantage
of a finite state machine is that triggering a Trojan can be as sophisticated as the
developer wishes. Therefore, the developer can choose a very rare state sequence in
a finite state machine to trigger an HT. In this case, the triggering is more difficult
to activate, here a counter can be used, which counts the number of times when a
rare sequence chosen by an attacker takes place. Therefore, it is more difficult for an
analyst to turn on an HT and, as a result, to detect it. Moreover, as is well known,