5.3 Features of Identifying Sequential Hardware Trojans Using the TeSR Method
481
5.3.2 Features of Accounting for Process Variation
in Microcircuit Parameters During Implementation of
Trojan Identification Methods
The work [1] contains the authors’ critical review of similar ways of identification
of hardware Trojans, the main results of which are presented below.
As noted above, two large groups of hardware Trojan identification methods are
usually identified in literature: (a) Logic Testing methods and (b) Side-Channel Analysis methods. Sequential hardware Trojans are extremely difficult to identify using
logic testing-based approaches [53], since the probability of a sequence of rare events
set by the intruder, which is necessary to perform all state transitions in the Hardware Trojans and ultimately activate the payload, is extremely low during the testing
period. Logic testing-based methods suggest comparing the results of testing the functional behavior of the tested object (CUT) with similar results of reactions from the
golden or reference circuit. As a rule, these methods are more effective for detecting
combinational hardware Trojans activated by rare events (values) on internal nodes
of the system [10]. Moreover, if the trigger mechanism of a hardware Trojan doesn’t
depend on main logic functions (operations) of a circuits (e.g., Fig. 5.7b), these logic
testing-based methods turn out to be completely ineffective.
On the other hand, since all side-channel analysis (SCA) methods are based on
observing effects from the influence of a hardware Trojan on physical parameters of
side channels, such as the consumed current value or delay time, such analysis can be
extremely effective for detection of “large” sequential hardware Trojans. Detection
of hardware Trojans with these methods doesn’t even require full activation of the
hardware Trojan and propagation of the malicious action to payloads. Nevertheless,
traditional approaches based on side-channel analysis are characterized by reduced
sensitivity to permanently increasing effect of process parameter spread—variations
of process parameters between chips and even inside them [54]. Regardless of the
fact that activity of a hardware Trojan circuit can be reflected in changes of the
Fig. 5.7 Comparison of problems and volume of works for different approaches to detection of
hardware Trojans
481
5.3.2 Features of Accounting for Process Variation
in Microcircuit Parameters During Implementation of
Trojan Identification Methods
The work [1] contains the authors’ critical review of similar ways of identification
of hardware Trojans, the main results of which are presented below.
As noted above, two large groups of hardware Trojan identification methods are
usually identified in literature: (a) Logic Testing methods and (b) Side-Channel Analysis methods. Sequential hardware Trojans are extremely difficult to identify using
logic testing-based approaches [53], since the probability of a sequence of rare events
set by the intruder, which is necessary to perform all state transitions in the Hardware Trojans and ultimately activate the payload, is extremely low during the testing
period. Logic testing-based methods suggest comparing the results of testing the functional behavior of the tested object (CUT) with similar results of reactions from the
golden or reference circuit. As a rule, these methods are more effective for detecting
combinational hardware Trojans activated by rare events (values) on internal nodes
of the system [10]. Moreover, if the trigger mechanism of a hardware Trojan doesn’t
depend on main logic functions (operations) of a circuits (e.g., Fig. 5.7b), these logic
testing-based methods turn out to be completely ineffective.
On the other hand, since all side-channel analysis (SCA) methods are based on
observing effects from the influence of a hardware Trojan on physical parameters of
side channels, such as the consumed current value or delay time, such analysis can be
extremely effective for detection of “large” sequential hardware Trojans. Detection
of hardware Trojans with these methods doesn’t even require full activation of the
hardware Trojan and propagation of the malicious action to payloads. Nevertheless,
traditional approaches based on side-channel analysis are characterized by reduced
sensitivity to permanently increasing effect of process parameter spread—variations
of process parameters between chips and even inside them [54]. Regardless of the
fact that activity of a hardware Trojan circuit can be reflected in changes of the
Fig. 5.7 Comparison of problems and volume of works for different approaches to detection of
hardware Trojans