454
5 Methods of Detecting Hardware Trojans in Microcircuits
In this case, a right-minded researcher can obtain all the necessary technical details
and know-how either from the cited original source or by referring directly to the
authors of these works.
Therefore, it only contains a brief overview of Trojan identification methods
known from literature. Separate sections of the chapter are dedicated to more detailed
examination of the features of the hardware Trojan detection method based on the
analysis of the electromagnetic radiation spectrum of microcircuit elements, as well
as features of identification of sequential hardware Trojans using the TeSR method.
The end of the chapter contains specific examples of the methods for identification
of hardware Trojans taken from the experience of Belarusian Trojan hunters. This
part contains a detailed and consistent description of the methods of the research
process as well as specifications and features of the used analytical equipment and
special software.
5.1 Brief Review of Basic Techniques for Detection
of Hardware Trojans in Critical Microchips
5.1.1 Introduction to the Problem
Since, as stated in the foreword, chapters of this book can be read not in the given
order but based on the sphere of interest of the reader, it would be logical to begin
this chapter with a brief repetition of introduction to this problem with the help
of additional literary sources. Papers [1–52], some of which have been mentioned
above, are dedicated to the analysis of the process of evolution of hardware Trojans
and counteracting measures.
As noted above, malicious elements can be introduced into the system hardware
by using various methods. For example, an attacker developer can introduce a special
unspecified function into the design of a basic microcircuit by adding just a few lines
to the source original description code of the hardware [45]. In addition, intruders
can modify the synthesis tool so that the synthesized hardware changes in a certain
way [41]. Another method is resource-intensive and expensive, but it also cannot be
excluded: the microcircuit manufacturer can reproduce the design so that it includes
a shadow schematics at the physical level.
It is obvious that the examination of evolution of hardware Trojan detection
methods shall be performed in conjunction with the process of evolution of Trojans
themselves, since the identification methods designed for the first hardware Trojans
cannot be applied to later, more sophisticated designs in most cases; however, there
is a number of features that are common to all generations of such malware. For
example, to accomplish their tasks, hardware Trojans should undergo functional
tests, while remaining unnoticed, and they still include two basic mechanisms: a
trigger and payload.
5 Methods of Detecting Hardware Trojans in Microcircuits
In this case, a right-minded researcher can obtain all the necessary technical details
and know-how either from the cited original source or by referring directly to the
authors of these works.
Therefore, it only contains a brief overview of Trojan identification methods
known from literature. Separate sections of the chapter are dedicated to more detailed
examination of the features of the hardware Trojan detection method based on the
analysis of the electromagnetic radiation spectrum of microcircuit elements, as well
as features of identification of sequential hardware Trojans using the TeSR method.
The end of the chapter contains specific examples of the methods for identification
of hardware Trojans taken from the experience of Belarusian Trojan hunters. This
part contains a detailed and consistent description of the methods of the research
process as well as specifications and features of the used analytical equipment and
special software.
5.1 Brief Review of Basic Techniques for Detection
of Hardware Trojans in Critical Microchips
5.1.1 Introduction to the Problem
Since, as stated in the foreword, chapters of this book can be read not in the given
order but based on the sphere of interest of the reader, it would be logical to begin
this chapter with a brief repetition of introduction to this problem with the help
of additional literary sources. Papers [1–52], some of which have been mentioned
above, are dedicated to the analysis of the process of evolution of hardware Trojans
and counteracting measures.
As noted above, malicious elements can be introduced into the system hardware
by using various methods. For example, an attacker developer can introduce a special
unspecified function into the design of a basic microcircuit by adding just a few lines
to the source original description code of the hardware [45]. In addition, intruders
can modify the synthesis tool so that the synthesized hardware changes in a certain
way [41]. Another method is resource-intensive and expensive, but it also cannot be
excluded: the microcircuit manufacturer can reproduce the design so that it includes
a shadow schematics at the physical level.
It is obvious that the examination of evolution of hardware Trojan detection
methods shall be performed in conjunction with the process of evolution of Trojans
themselves, since the identification methods designed for the first hardware Trojans
cannot be applied to later, more sophisticated designs in most cases; however, there
is a number of features that are common to all generations of such malware. For
example, to accomplish their tasks, hardware Trojans should undergo functional
tests, while remaining unnoticed, and they still include two basic mechanisms: a
trigger and payload.