5.2 Methods of Detecting Hardware Trojans in Microcircuits Based …
469
large HTs were used; (b) HTs are inserted at the gate level or even at the RTL level
(high-level representation for the circuit). Such experiments may not reflect a realistic
situation, where the untrusted foundry introduces small HTs at a low level after
arrangement and tracing in order to hide this fact. This observation, which describes
the situation with sufficient precision, demonstrates that the detection possibilities
described in earlier works must be used carefully in practice.
One of the rare instances of a realistic approach described on the basis of a realistic
scenario is given in [21]. In this paper, the authors examine a cryptographic ASIC
developed by the 180 nm UMC process technology and implementing an improved
encryption standard (AES) [22]. The HT here takes up a relatively small part of the IC:
only 0.5% of the total area of the chip. The first part of the analysis consists in plotting
power supply maps by calculating the average of all measured characteristics of the
supply current from each ASIC. After that, the authors calculate the difference from
these mean values (DoM) as the first approximation in the direction of distinguishing
ASICs with Trojans and without them. The second step consists in applying the
primary component analysis method (PCA) to average characteristics of each device
in order to ensure less excessive information. Output data from this step are supplied
to the classification device based on supporting vectors (SVM). This experiment
suggests that chips with and without hardware Trojans are available for learning of
such SVM classification device. Therefore, this method is limited to detecting only
known hardware Trojans.
In contrast, for obvious practical reasons, most academic papers dedicated to HT
detection based on side channels use only simpler FPGAs instead of more complex
ASICs as testing subjects.
5.2.2 Methods of Detecting Hardware Trojans Based
on the Analysis of Electromagnetic Radiation Spectra
The HT detection method [1] is based on using characteristic attributes of IC EM
radiations. Since almost all methods of physical HT detection require presence of
a golden reference (in this case, a golden reference circuit) but does not require
measuring specific characteristics of the HT before the method is able to detect them,
below we present not only the theoretical (calculated) possibility of HT detection,
but also convincing experimental proofs. The authors of [1] researched only small
hardware Trojans that are supposedly difficult to detect.
Below we will provide a detailed description of the HT detection methodology
suggested in [1], which is based on measurement and analysis of EM signals emitted
by the so-called DuT (measured microcircuit) in the course of its normal operation.
The methodology includes two different phases:
469
large HTs were used; (b) HTs are inserted at the gate level or even at the RTL level
(high-level representation for the circuit). Such experiments may not reflect a realistic
situation, where the untrusted foundry introduces small HTs at a low level after
arrangement and tracing in order to hide this fact. This observation, which describes
the situation with sufficient precision, demonstrates that the detection possibilities
described in earlier works must be used carefully in practice.
One of the rare instances of a realistic approach described on the basis of a realistic
scenario is given in [21]. In this paper, the authors examine a cryptographic ASIC
developed by the 180 nm UMC process technology and implementing an improved
encryption standard (AES) [22]. The HT here takes up a relatively small part of the IC:
only 0.5% of the total area of the chip. The first part of the analysis consists in plotting
power supply maps by calculating the average of all measured characteristics of the
supply current from each ASIC. After that, the authors calculate the difference from
these mean values (DoM) as the first approximation in the direction of distinguishing
ASICs with Trojans and without them. The second step consists in applying the
primary component analysis method (PCA) to average characteristics of each device
in order to ensure less excessive information. Output data from this step are supplied
to the classification device based on supporting vectors (SVM). This experiment
suggests that chips with and without hardware Trojans are available for learning of
such SVM classification device. Therefore, this method is limited to detecting only
known hardware Trojans.
In contrast, for obvious practical reasons, most academic papers dedicated to HT
detection based on side channels use only simpler FPGAs instead of more complex
ASICs as testing subjects.
5.2.2 Methods of Detecting Hardware Trojans Based
on the Analysis of Electromagnetic Radiation Spectra
The HT detection method [1] is based on using characteristic attributes of IC EM
radiations. Since almost all methods of physical HT detection require presence of
a golden reference (in this case, a golden reference circuit) but does not require
measuring specific characteristics of the HT before the method is able to detect them,
below we present not only the theoretical (calculated) possibility of HT detection,
but also convincing experimental proofs. The authors of [1] researched only small
hardware Trojans that are supposedly difficult to detect.
Below we will provide a detailed description of the HT detection methodology
suggested in [1], which is based on measurement and analysis of EM signals emitted
by the so-called DuT (measured microcircuit) in the course of its normal operation.
The methodology includes two different phases: