472
5 Methods of Detecting Hardware Trojans in Microcircuits
its EM radiation. However, in order to obtain a proper intensity of the signal emitted
by the microcircuit, the probe shall be located as close to the DuT as possible.
In these experiments, the researchers didn’t open the DuT package, but the tip
of the probe still slightly touched the package. Placing the probe closer to the chip
will ensure an even better signal; however, this can require package decapsulation,
which makes this method much less feasible. After that, the signal measured by the
probe is amplified, captured by the digital sampling oscilloscope, and transmitted to
the controlling PC for further analysis.
Reference circuit. In fact, the implementation of the 128-bit version of the AES
block cipher was used here. Since all cryptographic algorithms are placed inside most
applications directly related to the protection problem, they are undoubtedly attractive
for intruders. However, as will be clear from description of the HT installed by the
authors, this method is not limited by HT detection in cryptographic microcircuits.
The original program was written using the basic Verilog language. Input data
operands, namely, the 128-bit plaintext and 128-bit privacy key are transferred here
with the help of the control FPGA chip to the examined FPGA chip through eight
specialized interconnection pins, i.e., by 8-bit words, specifically—one word per
synchronization cycle. Golden reference circuit performs the necessary AES encryption after all the input data are accepted. After that, it sends the encrypted output data
text back to the control FPGA microcircuit, using eight specialized interconnection
pins determined in advance.
For performance of seemingly standard procedures of project synthesis, arrangement, and tracing, the authors of [1] used the seemingly standard and well-known
software means Xilinx ISE Design Suite 10.1. The golden reference circuit in the
described case used only 537 triggers and 3402 lookup tables (LUT) that jointly
correspond to 2071 processor sections, i.e., 42% use of the resource.
Infected microcircuits. In order to implement these fairly simple experiments, the
authors of [1] designed and manufactured several circuits deliberately infected with
HTs. All infected designs of microcircuits were modifications of the same golden
reference standard; the design of each Trojan was directly inserted in the implementation of AES-128. As a starting point, they took the native circuit description
(NCD), i.e., description of the circuit that ultimately results from the placement and
tracing process and performed its correction at a relatively low level using only the
software package Xilinx FPGA Editor. As any developer knows, this means make
it possible to perform manual modification of FPGA microcircuit elements, such as
circuits, chains, or even LUT equations.
Trojan implementation at this low level is a fairly demanding task; however, it
is ultimately reflected in minimal changes in the circuit netlist and has maximum
similarity to what can be actually done by a sufficiently qualified intruder at any chip
production facility. On the contrary, HT insertion in high-level Vferilog description
results in a completely different form of the NCD file due to specifics of synthesis,
building of correlations, placement, and tracing.
All Trojan circuits used in this work were externally triggered, i.e., the HT trigger
circuit was directly connected to eight lines of external input data from IOB in order
to detect a trigger sequence defined by the intruder in advance. It is obvious that
5 Methods of Detecting Hardware Trojans in Microcircuits
its EM radiation. However, in order to obtain a proper intensity of the signal emitted
by the microcircuit, the probe shall be located as close to the DuT as possible.
In these experiments, the researchers didn’t open the DuT package, but the tip
of the probe still slightly touched the package. Placing the probe closer to the chip
will ensure an even better signal; however, this can require package decapsulation,
which makes this method much less feasible. After that, the signal measured by the
probe is amplified, captured by the digital sampling oscilloscope, and transmitted to
the controlling PC for further analysis.
Reference circuit. In fact, the implementation of the 128-bit version of the AES
block cipher was used here. Since all cryptographic algorithms are placed inside most
applications directly related to the protection problem, they are undoubtedly attractive
for intruders. However, as will be clear from description of the HT installed by the
authors, this method is not limited by HT detection in cryptographic microcircuits.
The original program was written using the basic Verilog language. Input data
operands, namely, the 128-bit plaintext and 128-bit privacy key are transferred here
with the help of the control FPGA chip to the examined FPGA chip through eight
specialized interconnection pins, i.e., by 8-bit words, specifically—one word per
synchronization cycle. Golden reference circuit performs the necessary AES encryption after all the input data are accepted. After that, it sends the encrypted output data
text back to the control FPGA microcircuit, using eight specialized interconnection
pins determined in advance.
For performance of seemingly standard procedures of project synthesis, arrangement, and tracing, the authors of [1] used the seemingly standard and well-known
software means Xilinx ISE Design Suite 10.1. The golden reference circuit in the
described case used only 537 triggers and 3402 lookup tables (LUT) that jointly
correspond to 2071 processor sections, i.e., 42% use of the resource.
Infected microcircuits. In order to implement these fairly simple experiments, the
authors of [1] designed and manufactured several circuits deliberately infected with
HTs. All infected designs of microcircuits were modifications of the same golden
reference standard; the design of each Trojan was directly inserted in the implementation of AES-128. As a starting point, they took the native circuit description
(NCD), i.e., description of the circuit that ultimately results from the placement and
tracing process and performed its correction at a relatively low level using only the
software package Xilinx FPGA Editor. As any developer knows, this means make
it possible to perform manual modification of FPGA microcircuit elements, such as
circuits, chains, or even LUT equations.
Trojan implementation at this low level is a fairly demanding task; however, it
is ultimately reflected in minimal changes in the circuit netlist and has maximum
similarity to what can be actually done by a sufficiently qualified intruder at any chip
production facility. On the contrary, HT insertion in high-level Vferilog description
results in a completely different form of the NCD file due to specifics of synthesis,
building of correlations, placement, and tracing.
All Trojan circuits used in this work were externally triggered, i.e., the HT trigger
circuit was directly connected to eight lines of external input data from IOB in order
to detect a trigger sequence defined by the intruder in advance. It is obvious that