486
5 Methods of Detecting Hardware Trojans in Microcircuits
5.4 Specific Examples from the Experience of Belarusian
Trojan Hunters
As demonstrated in previous sections of this chapter, there are many methods of
identifying hardware Trojans known from open sources. Just as many methods have
been probably developed by technical subdivisions of special services that have been
actively working in this field lately.
As we can see, the choice of a certain method is determined by multiple objective
and subjective factors—target purpose of the circuit, its functional complexity, set
terms of the research, availability of the necessary hardware and software base to the
researcher, etc. The cost of such works also plays an important part in selecting the
analysis method. In certain cases, the cost of such research can exceed the cost of
developing and producing the examined circuit many times.
Therefore, reverse engineering is most commonly used as the main method. We
dedicated one of the chapters of our book “Software and Hardware Trojans—Implementation and Counteraction Methods,” Moscow: TEKHNOSFERA, 2018 to the
detailed analysis of all features of its application. ISBN 978-5-94836-524-4.
In this section, we suggest taking a brief look at the methods of implementation of
one of reverse-engineering stages and the precision equipment used in this process.
By the way, exclusively Belarusian high-tech precision technological equipment is
used in the test complex (manufactured by the state research and production complex
“Planar,” Minsk); this equipment is also used in the technological process of manufacturing microcircuits. In other words, instead of developing new special equipment,
standard equipment installed in operating production lines is used for analysis.
Thus, based on the information presented in Chaps. 4 and 5, we can conclude the
following.
• Any hardware Trojan suggests presence of additional active elements in the circuit
(N-type or P-type transistors or bipolar transistors).
• Availability of such additional active elements suggests: additional gate regions,
source/drain, active region, and insulation between additional elements.
As a side note: the engineer can sometimes intentionally introduce a certain
number of actually disabled transistors, trying to complicate reverse engineering for
the competitors.
Since additional active elements shall not exclude the active elements, they will
most likely be placed in free places containing insulation, unless other options are
possible.
• Additional connections shall appear in the first levels of metallization layers (1
Me, 2 Me). See Appendix 1.
• In the first level of contacts (contacts to the active structure) and contacts between
Me 1 and 2, it is also necessary to introduce additional contacts.
Manufacturers of critical ICs used in military and spacecraft applications are
tasked with ensuring security.
5 Methods of Detecting Hardware Trojans in Microcircuits
5.4 Specific Examples from the Experience of Belarusian
Trojan Hunters
As demonstrated in previous sections of this chapter, there are many methods of
identifying hardware Trojans known from open sources. Just as many methods have
been probably developed by technical subdivisions of special services that have been
actively working in this field lately.
As we can see, the choice of a certain method is determined by multiple objective
and subjective factors—target purpose of the circuit, its functional complexity, set
terms of the research, availability of the necessary hardware and software base to the
researcher, etc. The cost of such works also plays an important part in selecting the
analysis method. In certain cases, the cost of such research can exceed the cost of
developing and producing the examined circuit many times.
Therefore, reverse engineering is most commonly used as the main method. We
dedicated one of the chapters of our book “Software and Hardware Trojans—Implementation and Counteraction Methods,” Moscow: TEKHNOSFERA, 2018 to the
detailed analysis of all features of its application. ISBN 978-5-94836-524-4.
In this section, we suggest taking a brief look at the methods of implementation of
one of reverse-engineering stages and the precision equipment used in this process.
By the way, exclusively Belarusian high-tech precision technological equipment is
used in the test complex (manufactured by the state research and production complex
“Planar,” Minsk); this equipment is also used in the technological process of manufacturing microcircuits. In other words, instead of developing new special equipment,
standard equipment installed in operating production lines is used for analysis.
Thus, based on the information presented in Chaps. 4 and 5, we can conclude the
following.
• Any hardware Trojan suggests presence of additional active elements in the circuit
(N-type or P-type transistors or bipolar transistors).
• Availability of such additional active elements suggests: additional gate regions,
source/drain, active region, and insulation between additional elements.
As a side note: the engineer can sometimes intentionally introduce a certain
number of actually disabled transistors, trying to complicate reverse engineering for
the competitors.
Since additional active elements shall not exclude the active elements, they will
most likely be placed in free places containing insulation, unless other options are
possible.
• Additional connections shall appear in the first levels of metallization layers (1
Me, 2 Me). See Appendix 1.
• In the first level of contacts (contacts to the active structure) and contacts between
Me 1 and 2, it is also necessary to introduce additional contacts.
Manufacturers of critical ICs used in military and spacecraft applications are
tasked with ensuring security.