468
5 Methods of Detecting Hardware Trojans in Microcircuits
classic statistical analysis, and comparison with reference characteristic features of
the IC.
An interesting method of detecting HT using electromagnetic (EM) radiation
is described in [15]. The author successfully identifies the HT, using standard lab
EM equipment (comprising close field magnetic probes ETC Lindgren 7405 with a
diameter of 1 cm and a 100 kHz – 3 GHz preamp). However, it should be noted that
the conditions for successful HT detection here are extremely favorable, since the
exact time of HT activation is known in advance as well as the design features of this
HT. This cannot be absent from a typical scenario of HT detection.
There are also certain other known methods aimed at increasing the sensitivity
of HT detection methodology using side channels. For example, in [7], the authors
suggest an original method of metering noise modeling to increase sensitivity of the
HT detection. In [16], the problem of HT detection is formulated as the problem
of identification of a foreign signature; here, HT is detected by comparing each
signature to estimated values of other signatures. This method is agnostic with regard
to specific used side channels (dynamic power, electromagnetic radiation, etc.). Its
advantage consists in the fact that it is somewhat resistant to parameter spreads of
the manufacturing process, scalable and only requires a reference netlist instead
of a reference IC. The authors performed experiments with HSPICe modeling of
post-layout designs, while technical process deviations were modeled using Monte
Carlo methods.
In other cases, suggested approaches were based on the analysis of spatial distribution of signals in order to allow for a more local analysis by using a special
added circuit like power supply ports [17], separate pathways and power sources
[18] or specially designed vectors of input effects similar to the ones used in [13,
19]. Alternatively, sectionalization of the chip can be performed on the temporal
level as suggested in [20] in order to account for the problem of process variability
(process spread of parameters, first of all threshold voltages). This method uses the
current signature of the chip on two different time windows in order to “completely
exclude the effect of the process noise.” The authors claim that their method ensures
extremely high sensitivity in detecting HT of various sizes and emphasizes that it
doesn’t require the reference for IC comparison. The results described in this work
have been proven by HSPICE modeling and experiments with FPGA.
Most disadvantages of previously suggested HT detection methods using side
channels are summed up in [20]. The main provisions of this work can be formulated
as follows:
(a) “Methods from previous works are not reliable with regard to variability of
the technical process and measurement environment (measurement noise) and
therefore unable to perform reliable detection of extremely small hardware
Trojans“ and
(b) Almost all previous works lack substantial experimental studies, and therefore
their feasibility is not clearly evident.
The authors analyze the experiments performed by someone based on the literature
and determine two main flaws of these experiments: (a) non-realistic and excessively
5 Methods of Detecting Hardware Trojans in Microcircuits
classic statistical analysis, and comparison with reference characteristic features of
the IC.
An interesting method of detecting HT using electromagnetic (EM) radiation
is described in [15]. The author successfully identifies the HT, using standard lab
EM equipment (comprising close field magnetic probes ETC Lindgren 7405 with a
diameter of 1 cm and a 100 kHz – 3 GHz preamp). However, it should be noted that
the conditions for successful HT detection here are extremely favorable, since the
exact time of HT activation is known in advance as well as the design features of this
HT. This cannot be absent from a typical scenario of HT detection.
There are also certain other known methods aimed at increasing the sensitivity
of HT detection methodology using side channels. For example, in [7], the authors
suggest an original method of metering noise modeling to increase sensitivity of the
HT detection. In [16], the problem of HT detection is formulated as the problem
of identification of a foreign signature; here, HT is detected by comparing each
signature to estimated values of other signatures. This method is agnostic with regard
to specific used side channels (dynamic power, electromagnetic radiation, etc.). Its
advantage consists in the fact that it is somewhat resistant to parameter spreads of
the manufacturing process, scalable and only requires a reference netlist instead
of a reference IC. The authors performed experiments with HSPICe modeling of
post-layout designs, while technical process deviations were modeled using Monte
Carlo methods.
In other cases, suggested approaches were based on the analysis of spatial distribution of signals in order to allow for a more local analysis by using a special
added circuit like power supply ports [17], separate pathways and power sources
[18] or specially designed vectors of input effects similar to the ones used in [13,
19]. Alternatively, sectionalization of the chip can be performed on the temporal
level as suggested in [20] in order to account for the problem of process variability
(process spread of parameters, first of all threshold voltages). This method uses the
current signature of the chip on two different time windows in order to “completely
exclude the effect of the process noise.” The authors claim that their method ensures
extremely high sensitivity in detecting HT of various sizes and emphasizes that it
doesn’t require the reference for IC comparison. The results described in this work
have been proven by HSPICE modeling and experiments with FPGA.
Most disadvantages of previously suggested HT detection methods using side
channels are summed up in [20]. The main provisions of this work can be formulated
as follows:
(a) “Methods from previous works are not reliable with regard to variability of
the technical process and measurement environment (measurement noise) and
therefore unable to perform reliable detection of extremely small hardware
Trojans“ and
(b) Almost all previous works lack substantial experimental studies, and therefore
their feasibility is not clearly evident.
The authors analyze the experiments performed by someone based on the literature
and determine two main flaws of these experiments: (a) non-realistic and excessively