418
4 Hardware Trojans in Microcircuits
power consumption or so-called transitional power [22] and even leakage power
[272], temperatures [273], and electromagnetic radiation [274, 275]. The abovementioned “hunters” have analyzed other various side effects (for example, extra
path delay, power consumption, changes in ambient temperature, or electromagnetic radiation) caused by additional protective circuits and/or activity of an inserted
Trojan.
It should be noted that the majority of the detection techniques assume that
“golden ICs” (Trojan-free ICs) are available. In addition, while side-channel analysis methods, which are known from available sources of literature, may succeed in
detecting Trojans to some degree (different from zero), the difficulty lies in achieving
high coverage of every gate (or all IC nets) and in extracting the tiny, (abnormal)
digital signals of hardware Trojans in the presence of process and environmental
variations. Bearing in mind the obvious fact that as the feature size of ICs shrinks
and the quantity of such transistors in the IC grows, the small side-channel signals
can avoid detection. Recently, famous Trojan hunter Zhou et al. [275] proposed a
new method of backside imaging to produce a pattern based on filler cells placed
in the IC layout. These Trojan hunters supposed that fill cells are more reflective
than other functional cells. Although this technique does not require golden IC, the
comparison between the simulated image and measured optical image still has a
number of disadvantages due to natural variations in the manufacturing process. It is
worth noting that the time required to obtain a fully detailed image of the chips and
the resolution level of obtained images are still challenges.
4.11.3 Presilicon Trojan Detection Techniques
In [259], the main practical methods for detecting Trojans in microchips, which
developers who are well aware of this danger (unlike Russian developers), is actually
(in practice) used not only in designing standard microchips, but also in designing
system-on-chip (SoC). Although modern IC design engineers have already learned
to strictly observe the “rules of the game” established by the relevant “IC customers,”
they necessarily follow the so-called “rulebook” to validate third-party (purchased)
IP (3PIP) cores and their final designs. Existing presilicon detection techniques can be
broadly classified into simple groups: functional validation, code/structural analysis,
and formal verification.
Functional validation
The principal idea of functional validation is the same as the functional tests described
earlier. The similar functional validation is conducted with physico-mathematical
simulation, while all functional tests of IC analysis are performed through a complex
set of test devices that supply original test vectors (patterns) of special input signals
providing effective control of the output signal levels. Therefore, all existing techniques for functional tests are also applicable to such functional validation of Trojans.
4 Hardware Trojans in Microcircuits
power consumption or so-called transitional power [22] and even leakage power
[272], temperatures [273], and electromagnetic radiation [274, 275]. The abovementioned “hunters” have analyzed other various side effects (for example, extra
path delay, power consumption, changes in ambient temperature, or electromagnetic radiation) caused by additional protective circuits and/or activity of an inserted
Trojan.
It should be noted that the majority of the detection techniques assume that
“golden ICs” (Trojan-free ICs) are available. In addition, while side-channel analysis methods, which are known from available sources of literature, may succeed in
detecting Trojans to some degree (different from zero), the difficulty lies in achieving
high coverage of every gate (or all IC nets) and in extracting the tiny, (abnormal)
digital signals of hardware Trojans in the presence of process and environmental
variations. Bearing in mind the obvious fact that as the feature size of ICs shrinks
and the quantity of such transistors in the IC grows, the small side-channel signals
can avoid detection. Recently, famous Trojan hunter Zhou et al. [275] proposed a
new method of backside imaging to produce a pattern based on filler cells placed
in the IC layout. These Trojan hunters supposed that fill cells are more reflective
than other functional cells. Although this technique does not require golden IC, the
comparison between the simulated image and measured optical image still has a
number of disadvantages due to natural variations in the manufacturing process. It is
worth noting that the time required to obtain a fully detailed image of the chips and
the resolution level of obtained images are still challenges.
4.11.3 Presilicon Trojan Detection Techniques
In [259], the main practical methods for detecting Trojans in microchips, which
developers who are well aware of this danger (unlike Russian developers), is actually
(in practice) used not only in designing standard microchips, but also in designing
system-on-chip (SoC). Although modern IC design engineers have already learned
to strictly observe the “rules of the game” established by the relevant “IC customers,”
they necessarily follow the so-called “rulebook” to validate third-party (purchased)
IP (3PIP) cores and their final designs. Existing presilicon detection techniques can be
broadly classified into simple groups: functional validation, code/structural analysis,
and formal verification.
Functional validation
The principal idea of functional validation is the same as the functional tests described
earlier. The similar functional validation is conducted with physico-mathematical
simulation, while all functional tests of IC analysis are performed through a complex
set of test devices that supply original test vectors (patterns) of special input signals
providing effective control of the output signal levels. Therefore, all existing techniques for functional tests are also applicable to such functional validation of Trojans.