482
5 Methods of Detecting Hardware Trojans in Microcircuits
supply current value, this influence is usually clogged by the process noise of the
chip production, which can lead to false positive/negative decisions [30]. Therefore,
the existing approaches are characterized by the trend toward using methods of
process calibration of comparing object measurement results to the known set of
reference ICs to obtain the reference tendency. At the same time, any deviation
from the characteristics and the reference (going beyond the preset threshold values)
indicates presence of a hardware Trojan in the circuit.
For example, the authors in [56] use a complex approach: in addition to standard
measurements of external ports, they use the calibration method and statistical analysis to reduce the impact of process and ambient temperature parameters. In [32],
statistical correlation between the multitude of side-channel parameters, such as
measured values of the dynamic supply current and maximum working frequency, is
used to define the integral curve of the reference trend, which minimizes the influence
of such process noise.
Interesting results of the experimental analysis aimed at studying the influence
of process spread between chips and inside every chip on precision of detecting
a hardware Trojan were obtained in [33, 34]. In [35], interesting development of
this method is discussed, as well as its application for studying multiple factors of
detection of hardware Trojans. It has been proven that formation of test vectors based
on separating the chip into separate zones [36, 38, 39, 55] increases the accuracy of
detection of hardware Trojans for large-scale circuits.
Other methods include calibrating the signal delay in the analyzed logic circuit
[12], calibrating the delay measured at the ring generator built into the circuit [40] and
the description of leakage currents and parameters of signal propagation delay for all
gates in the source structure considering the values of process parameter spread for
determining the presence of additional gates after manufacturing on the gate level
[43–45].
However, all existing methods based on the analysis of side channels cannot fully
exclude the influence of altering process and parameters of process on detection
of hardware Trojans, since they depend on measurements performed on many ICs,
which is required for comparison and making the right decision. Moreover, all the
above methods rely on availability of a set of golden reference ICs (as a rule, they
are obtained by means of destructive analysis of an unverified IC sample) or on the
available full set of golden sample documentation; moreover, complexity of such
projects can increase exponentially for large-scale projects.
In addition to the above, the methods of functional validation of the IC project
are used sometimes [46, 47], which require significant costs in terms of time, funds,
and human resources, but provide the last reliable means for detecting presence of a
hardware Trojan (this method is applied only in specific-purpose systems).
The method of temporal self-referencing [1] is most effective for identification of
the class of sequential hardware Trojans shown in the common model in Fig. 5.7a.
State transition conditions (C) are set based on the use of combination of rare state
values of the internal nodes (T p T, … T n ). Hardware Trojan causes a failure in
its payload in the state St T only only after it performs transition to the state S; S
… S N In a general case, we can theoretically suggest that the FSM of a hardware
5 Methods of Detecting Hardware Trojans in Microcircuits
supply current value, this influence is usually clogged by the process noise of the
chip production, which can lead to false positive/negative decisions [30]. Therefore,
the existing approaches are characterized by the trend toward using methods of
process calibration of comparing object measurement results to the known set of
reference ICs to obtain the reference tendency. At the same time, any deviation
from the characteristics and the reference (going beyond the preset threshold values)
indicates presence of a hardware Trojan in the circuit.
For example, the authors in [56] use a complex approach: in addition to standard
measurements of external ports, they use the calibration method and statistical analysis to reduce the impact of process and ambient temperature parameters. In [32],
statistical correlation between the multitude of side-channel parameters, such as
measured values of the dynamic supply current and maximum working frequency, is
used to define the integral curve of the reference trend, which minimizes the influence
of such process noise.
Interesting results of the experimental analysis aimed at studying the influence
of process spread between chips and inside every chip on precision of detecting
a hardware Trojan were obtained in [33, 34]. In [35], interesting development of
this method is discussed, as well as its application for studying multiple factors of
detection of hardware Trojans. It has been proven that formation of test vectors based
on separating the chip into separate zones [36, 38, 39, 55] increases the accuracy of
detection of hardware Trojans for large-scale circuits.
Other methods include calibrating the signal delay in the analyzed logic circuit
[12], calibrating the delay measured at the ring generator built into the circuit [40] and
the description of leakage currents and parameters of signal propagation delay for all
gates in the source structure considering the values of process parameter spread for
determining the presence of additional gates after manufacturing on the gate level
[43–45].
However, all existing methods based on the analysis of side channels cannot fully
exclude the influence of altering process and parameters of process on detection
of hardware Trojans, since they depend on measurements performed on many ICs,
which is required for comparison and making the right decision. Moreover, all the
above methods rely on availability of a set of golden reference ICs (as a rule, they
are obtained by means of destructive analysis of an unverified IC sample) or on the
available full set of golden sample documentation; moreover, complexity of such
projects can increase exponentially for large-scale projects.
In addition to the above, the methods of functional validation of the IC project
are used sometimes [46, 47], which require significant costs in terms of time, funds,
and human resources, but provide the last reliable means for detecting presence of a
hardware Trojan (this method is applied only in specific-purpose systems).
The method of temporal self-referencing [1] is most effective for identification of
the class of sequential hardware Trojans shown in the common model in Fig. 5.7a.
State transition conditions (C) are set based on the use of combination of rare state
values of the internal nodes (T p T, … T n ). Hardware Trojan causes a failure in
its payload in the state St T only only after it performs transition to the state S; S
… S N In a general case, we can theoretically suggest that the FSM of a hardware