5.2 Methods of Detecting Hardware Trojans in Microcircuits Based …
467
categories based on many parameters including, for example, the phase of its introduction, operating procedure, location, size, etc., which leads to thousands of possible
variants. Regardless of these categories, the common and main characteristic for all
such Trojans is their transparency, i.e., the circuit modified by the intruder must be
extremely difficult to detect.
As demonstrated above, HT usually consists of two different parts: trigger and
payload. HT trigger is responsible for activation of the malicious function at a specific
point of time. In a way, it acts like a constantly active sensitive circuit, which waits for
a specific event (internal or external) to happen. HT payload contains a permanently
operating scheme for implementation of this malicious function; as opposed to the
trigger, it remains passive most of the time.
As a rule, all experimenters logically want to detect the HT before its payload
is activated; therefore, they are aimed at detecting this HT trigger as quickly as
possible. There are two large groups of known methods of HT detection. The first
group includes destructive methods, as well as so-called reverse engineering of the
circuit [10]. However, this approach is not only extremely difficult and expensive, but
also lengthy and often unreliable in terms of results. Most methods in this category
ensure high probability of detection of hardware Trojans; however, they can only be
applied to separate specimen as opposed to entire batches, since these methods are
mostly destructive.
The second category includes nondestructive methods. In terms of classification,
further subdivision can be suggested depending on the type of testing: logical or
physical. Logical testing applies test patterns and is aimed at organizing such effective
external effect on the start-up mechanism in order to identify the HT presence through
registering the triggering of its payload [12, 13]. Reliability of this approach is also
clearly limited not only due to HT masking, but also due to a huge space search of
these activation events. Moreover, it will require not only activating the trigger, but
also noticing the effect of the activated payload, which is not easy to do.
Physical analysis methods, on the other hand, use another approach. General
ideas are covered in [13] (“Hardware Trojan detection“ chapter), where the authors
prove that any malicious introductions or modifications of the circuit design (such as
HT) have to be reflected in a change in its physical properties (creation of so-called
side channels) like leakage currents, consumption current in standby mode, dynamic
characteristics of consumption power, temporary delays in data transmission chains
or separate important characteristics of the electromagnetic field, which always
occurs during operation of a microcircuit. The main advantage of side-channel-based
approaches consists in the fact that HT presence can be tested without the need to
“touch” its trigger. However, the main requirement here is the presence of a so-called
golden circuit or a golden model, i.e., some reference IC or computation model that
clearly contains no hardware Trojans and is used as a reference for all subsequent
studies.
In [1], the authors suggest a physical analysis-based HT detection methodology
of the second category. Specifically, the authors of [1] wanted to detect the HT in
the circuit, using only characteristic features of its electromagnetic (EM) radiation,
467
categories based on many parameters including, for example, the phase of its introduction, operating procedure, location, size, etc., which leads to thousands of possible
variants. Regardless of these categories, the common and main characteristic for all
such Trojans is their transparency, i.e., the circuit modified by the intruder must be
extremely difficult to detect.
As demonstrated above, HT usually consists of two different parts: trigger and
payload. HT trigger is responsible for activation of the malicious function at a specific
point of time. In a way, it acts like a constantly active sensitive circuit, which waits for
a specific event (internal or external) to happen. HT payload contains a permanently
operating scheme for implementation of this malicious function; as opposed to the
trigger, it remains passive most of the time.
As a rule, all experimenters logically want to detect the HT before its payload
is activated; therefore, they are aimed at detecting this HT trigger as quickly as
possible. There are two large groups of known methods of HT detection. The first
group includes destructive methods, as well as so-called reverse engineering of the
circuit [10]. However, this approach is not only extremely difficult and expensive, but
also lengthy and often unreliable in terms of results. Most methods in this category
ensure high probability of detection of hardware Trojans; however, they can only be
applied to separate specimen as opposed to entire batches, since these methods are
mostly destructive.
The second category includes nondestructive methods. In terms of classification,
further subdivision can be suggested depending on the type of testing: logical or
physical. Logical testing applies test patterns and is aimed at organizing such effective
external effect on the start-up mechanism in order to identify the HT presence through
registering the triggering of its payload [12, 13]. Reliability of this approach is also
clearly limited not only due to HT masking, but also due to a huge space search of
these activation events. Moreover, it will require not only activating the trigger, but
also noticing the effect of the activated payload, which is not easy to do.
Physical analysis methods, on the other hand, use another approach. General
ideas are covered in [13] (“Hardware Trojan detection“ chapter), where the authors
prove that any malicious introductions or modifications of the circuit design (such as
HT) have to be reflected in a change in its physical properties (creation of so-called
side channels) like leakage currents, consumption current in standby mode, dynamic
characteristics of consumption power, temporary delays in data transmission chains
or separate important characteristics of the electromagnetic field, which always
occurs during operation of a microcircuit. The main advantage of side-channel-based
approaches consists in the fact that HT presence can be tested without the need to
“touch” its trigger. However, the main requirement here is the presence of a so-called
golden circuit or a golden model, i.e., some reference IC or computation model that
clearly contains no hardware Trojans and is used as a reference for all subsequent
studies.
In [1], the authors suggest a physical analysis-based HT detection methodology
of the second category. Specifically, the authors of [1] wanted to detect the HT in
the circuit, using only characteristic features of its electromagnetic (EM) radiation,