650
7 Countermeasures Against Hardware Trojans
with provision of the final report. The suggested approach was tested on the standard
bus architecture known as Advanced Micro-controller Bus Architecture (AMBA)
produced by ARM. Such countermeasures are aimed at a specific architectural feature
and a specific class of hardware Trojans; they actually prevent Trojan intervention
into correct operation of SoC system bus.
A number of researchers also examined the issue of placing memory bus gatekeepers directly inside the processor architecture, simultaneously solving the tasks
of prevention of Trojan activation and data leakage.
The paper [8] suggests inserting the so-called shadow records in the memory
control instructions. The addresses of these shadow records are in fact encoded
versions of the original records. The core of the gatekeeper placed on the memory
bus verifies that all memory write operations are performed at the corresponding
encrypted addresses. Thus, such gatekepeer ensures implementation of only authorized records, thus preventing confidential information leakage through a hardware
Trojan. The scheme of such gatekeeper shall be fully verified. The authors have
developed a functional analog that performs instructions of a serial microprocessor
and contains the circuit of such gatekeeper that detects all shadow records. However,
this approach is based on the fact that data output usually suggest recording this data
into memory (to be send via network, for example); however, in practice it can also
happen with side channels, e.g., by analyzing the character of channels in the power
consumption level or temporary characteristics.
Double protection between the central processor and the data bus is suggested
in [9]. Here, two gatekeeping devices have independent keys and check each other
for correctness. Executed programs are encrypted simultaneously on two such gatekeepers with different keys; the data is decrypted on the way to the central processor
and encrypted once again on their way back into the memory. Such system suggests
absence of connection between gatekeepers. Hardware compiler is also a critical
part of the system, generating the binary code, BIOS commands and images of the
operating system directly before execution. Even though such double protection
eliminates the need for credibility of both gatekeepers, their possible cooperation
becomes a more important issue here. In order to study the examined approach,
the author used the standard simulator of computer architecture with open source
SimpleScalar.
As early as in 2003, the work [10] presented AEGIS architecture of a processor
that provided for safe use of untrusted connected peripherals, as well as launch of
an untrusted operating system. The main condition is that such processor must be
verified. Using basic encryption, it serves as the gatekeeper of data exchange between
itself and all unreliable peripheral devices. The main problem of such implementation
is the need to make sure that the IC of such processor is completely free from hardware
implants.
As we can see, the idea of using only trusted computing base (TCB) or socalled verified hardware means to counteract hardware Trojans is a condition of
implementing each of the listed countermeasures. The considered mechanisms for
protection of memory from hardware Trojans can be also distributed to other data
transmission channels and hardware modules within the IC.
7 Countermeasures Against Hardware Trojans
with provision of the final report. The suggested approach was tested on the standard
bus architecture known as Advanced Micro-controller Bus Architecture (AMBA)
produced by ARM. Such countermeasures are aimed at a specific architectural feature
and a specific class of hardware Trojans; they actually prevent Trojan intervention
into correct operation of SoC system bus.
A number of researchers also examined the issue of placing memory bus gatekeepers directly inside the processor architecture, simultaneously solving the tasks
of prevention of Trojan activation and data leakage.
The paper [8] suggests inserting the so-called shadow records in the memory
control instructions. The addresses of these shadow records are in fact encoded
versions of the original records. The core of the gatekeeper placed on the memory
bus verifies that all memory write operations are performed at the corresponding
encrypted addresses. Thus, such gatekepeer ensures implementation of only authorized records, thus preventing confidential information leakage through a hardware
Trojan. The scheme of such gatekeeper shall be fully verified. The authors have
developed a functional analog that performs instructions of a serial microprocessor
and contains the circuit of such gatekeeper that detects all shadow records. However,
this approach is based on the fact that data output usually suggest recording this data
into memory (to be send via network, for example); however, in practice it can also
happen with side channels, e.g., by analyzing the character of channels in the power
consumption level or temporary characteristics.
Double protection between the central processor and the data bus is suggested
in [9]. Here, two gatekeeping devices have independent keys and check each other
for correctness. Executed programs are encrypted simultaneously on two such gatekeepers with different keys; the data is decrypted on the way to the central processor
and encrypted once again on their way back into the memory. Such system suggests
absence of connection between gatekeepers. Hardware compiler is also a critical
part of the system, generating the binary code, BIOS commands and images of the
operating system directly before execution. Even though such double protection
eliminates the need for credibility of both gatekeepers, their possible cooperation
becomes a more important issue here. In order to study the examined approach,
the author used the standard simulator of computer architecture with open source
SimpleScalar.
As early as in 2003, the work [10] presented AEGIS architecture of a processor
that provided for safe use of untrusted connected peripherals, as well as launch of
an untrusted operating system. The main condition is that such processor must be
verified. Using basic encryption, it serves as the gatekeeper of data exchange between
itself and all unreliable peripheral devices. The main problem of such implementation
is the need to make sure that the IC of such processor is completely free from hardware
implants.
As we can see, the idea of using only trusted computing base (TCB) or socalled verified hardware means to counteract hardware Trojans is a condition of
implementing each of the listed countermeasures. The considered mechanisms for
protection of memory from hardware Trojans can be also distributed to other data
transmission channels and hardware modules within the IC.