478
5 Methods of Detecting Hardware Trojans in Microcircuits
these HTs. Warm and hotspots in charts for HT (a) and HT (b) look very similar to the
analogous charts in Fig. 5.4. Continuing the previous analysis, we can suggest that
this method cannot detect the HT trigger circuit for these extremely small HTs, but
detects tracings of horizontal HT signals used to control HT (a) and HT (b) Trojans.
Thus, briefly summarizing the results of analysis of effectiveness of this method,
we can draw the following conclusions.
The authors of [1] have actually suggested a new method of HT detection based
on specific features of EM radiation distinguishing it from other forms of radiation of integrated circuits. The experts assessed this method in practical experiments
using the studies of the golden reference circuit and the HT implemented by the
authors on FPGA microcircuits. The experts researched its effectiveness with regard
to measurement noises and work environment temperatures. The authors of [1] actually demonstrated that this method is capable of detecting extremely small Trojans
located in six different points within the analyzed FPGA circuit. Analysis performed
by the experts also demonstrated that certain control tracings of introduced Trojans
are easier to detect than other ones.
5.3 Features of Identifying Sequential Hardware Trojans
Using the TeSR Method
5.3.1 Introduction to the Problem
Hardware Trojans, i.e., deliberately created microcircuit design changes unauthorized by the developer usually include elaborate schematic and architectural solutions, which help them avoid detection during both standard post-production testing
and application of various specialized approaches to their identification by Trojan
hunters. Traditional parametric and functional testing cannot ensure effective identification of hardware Trojans due to special masking measures taken by intruders
(including special services), as well as due to an excessive number of cases that can
actually be used by an intruder [53].
In the general case, circuits of hardware Trojans can be combinational or sequential [3] in nature. Activation of a combinational hardware Trojan usually depends
on rare events or rare logic values in one or several units of the internal chain, which
serve as trigger conditions. A sequential hardware Trojan acts like a time bomb and
reveals its malicious effect only after occurrence of a series of rare events taking
place after a lengthy period of microcircuit operation. Figure 5.6a shows a generalized model of a sequential hardware Trojan. Examples of such schemes usually
contain a k-bit asynchronous counter, as shown in Fig. 5.6b, and a final state machine
(FSM), which is triggered only by specific rare events (or a sequence of such events)
in internal units of the original circuit shown in Fig. 5.6c.
Let us recall that the condition for activating a hardware Trojan is called the trigger
condition, and the node activated during triggering of a hardware Trojan is called
5 Methods of Detecting Hardware Trojans in Microcircuits
these HTs. Warm and hotspots in charts for HT (a) and HT (b) look very similar to the
analogous charts in Fig. 5.4. Continuing the previous analysis, we can suggest that
this method cannot detect the HT trigger circuit for these extremely small HTs, but
detects tracings of horizontal HT signals used to control HT (a) and HT (b) Trojans.
Thus, briefly summarizing the results of analysis of effectiveness of this method,
we can draw the following conclusions.
The authors of [1] have actually suggested a new method of HT detection based
on specific features of EM radiation distinguishing it from other forms of radiation of integrated circuits. The experts assessed this method in practical experiments
using the studies of the golden reference circuit and the HT implemented by the
authors on FPGA microcircuits. The experts researched its effectiveness with regard
to measurement noises and work environment temperatures. The authors of [1] actually demonstrated that this method is capable of detecting extremely small Trojans
located in six different points within the analyzed FPGA circuit. Analysis performed
by the experts also demonstrated that certain control tracings of introduced Trojans
are easier to detect than other ones.
5.3 Features of Identifying Sequential Hardware Trojans
Using the TeSR Method
5.3.1 Introduction to the Problem
Hardware Trojans, i.e., deliberately created microcircuit design changes unauthorized by the developer usually include elaborate schematic and architectural solutions, which help them avoid detection during both standard post-production testing
and application of various specialized approaches to their identification by Trojan
hunters. Traditional parametric and functional testing cannot ensure effective identification of hardware Trojans due to special masking measures taken by intruders
(including special services), as well as due to an excessive number of cases that can
actually be used by an intruder [53].
In the general case, circuits of hardware Trojans can be combinational or sequential [3] in nature. Activation of a combinational hardware Trojan usually depends
on rare events or rare logic values in one or several units of the internal chain, which
serve as trigger conditions. A sequential hardware Trojan acts like a time bomb and
reveals its malicious effect only after occurrence of a series of rare events taking
place after a lengthy period of microcircuit operation. Figure 5.6a shows a generalized model of a sequential hardware Trojan. Examples of such schemes usually
contain a k-bit asynchronous counter, as shown in Fig. 5.6b, and a final state machine
(FSM), which is triggered only by specific rare events (or a sequence of such events)
in internal units of the original circuit shown in Fig. 5.6c.
Let us recall that the condition for activating a hardware Trojan is called the trigger
condition, and the node activated during triggering of a hardware Trojan is called