5.3 Features of Identifying Sequential Hardware Trojans Using the TeSR Method
483
Fig. 5.8 Final variation of the threshold values of the transistor VT is due to the variation of VT
both within a single chip and between different chips (a). The effect of the process parameters on
the average transient current value can mask the effect of the hardware Trojan circuit
Trojan is often limited by using the state StT during testing; otherwise, the implant
would activate, negatively affect its payload, and be inevitably detected by using
standard approaches of functional testing [53]. This explains known facts of detecting
such combined hardware Trojans and even small sequential hardware Trojans, since
they usually employ a very small number of states. Using TESR, we can define
large distributed sequential hardware Trojans, which usually cause sufficient changes
of the main parameters of side channels, e.g., current leakage value outside the
limits of the process noise [30, 32, 56]. The main problems associated with noninvasive approaches to the analysis of side channels are shown in Fig. 5.8, which
also indicates their fields of application. The attack model considered in this section
involves using a trusted RTL structure, but considering the possibility of introducing a
hardware Trojan during any stage after IC development (including after RTL design
and verification stages), as well as various possible methods of verification and
various phases of technical IC design, the use of which can significantly impair the
implementation of malicious measures aimed at installing hardware Trojans even by
intruders having direct access to microcircuit design.
As we have noted above several times, it is necessary to clearly understand that
there is no ideal solution that would detect hardware Trojans of all possible sizes
and types. Despite the fact that TeSR method is well-suited for identifying attacks
of hardware Trojans of various forms and sizes, this method is especially important for detecting small sequential hardware Trojans, which usually easily bypass
logic testing circuits and all other existing methods based on side-channel analysis. Statistical methods based on logic testing [53], on the other hand, can only be
used as methods effectively supplementing TeSR, since they have an extremely high
coverage level for extremely small combinational hardware Trojans, which have no
significant effect on the main analyzed parameters of a side channel, but can be easily
triggered. The only limitation for the TeSR method we know of consists in temporary
changes (errors) due to noise during measurement.
483
Fig. 5.8 Final variation of the threshold values of the transistor VT is due to the variation of VT
both within a single chip and between different chips (a). The effect of the process parameters on
the average transient current value can mask the effect of the hardware Trojan circuit
Trojan is often limited by using the state StT during testing; otherwise, the implant
would activate, negatively affect its payload, and be inevitably detected by using
standard approaches of functional testing [53]. This explains known facts of detecting
such combined hardware Trojans and even small sequential hardware Trojans, since
they usually employ a very small number of states. Using TESR, we can define
large distributed sequential hardware Trojans, which usually cause sufficient changes
of the main parameters of side channels, e.g., current leakage value outside the
limits of the process noise [30, 32, 56]. The main problems associated with noninvasive approaches to the analysis of side channels are shown in Fig. 5.8, which
also indicates their fields of application. The attack model considered in this section
involves using a trusted RTL structure, but considering the possibility of introducing a
hardware Trojan during any stage after IC development (including after RTL design
and verification stages), as well as various possible methods of verification and
various phases of technical IC design, the use of which can significantly impair the
implementation of malicious measures aimed at installing hardware Trojans even by
intruders having direct access to microcircuit design.
As we have noted above several times, it is necessary to clearly understand that
there is no ideal solution that would detect hardware Trojans of all possible sizes
and types. Despite the fact that TeSR method is well-suited for identifying attacks
of hardware Trojans of various forms and sizes, this method is especially important for detecting small sequential hardware Trojans, which usually easily bypass
logic testing circuits and all other existing methods based on side-channel analysis. Statistical methods based on logic testing [53], on the other hand, can only be
used as methods effectively supplementing TeSR, since they have an extremely high
coverage level for extremely small combinational hardware Trojans, which have no
significant effect on the main analyzed parameters of a side channel, but can be easily
triggered. The only limitation for the TeSR method we know of consists in temporary
changes (errors) due to noise during measurement.