7.1 Hardware and Software Methods …
653
• Platform target FPGAs containing embedded memory controllers and even entire
processor cores;
• Specialized ASIC microcircuits, which can contain small reconfigurable components for implementation of certain functions.
The main advantage of reconfigurable logic from the point of its safety consists
in the fact that its use makes it possible to separate IC design stages and its hardware
implementation stages. If the final design of a typical IC is transferred directly to semiconductor production, in case reconfigurable logic is used in it, any programmable
logic block or macroblock is inserted in the IC before it is launched into production; after production, it is programmed with a special configurable bit stream, thus
completing hardware implementation of the project. In practice, such separation
means that any project can actually be developed in a trusted environment almost
completely, excluding certain peripheral functions (options) added to the main logical
functions of the microcircuit.
This method ensures complete control over the project at the RTL level; however,
development and introduction of various versions of reconfigurable logic is exposed
to the same threats from hardware Trojans that are characteristic of standard specialized IC (ASIC). The intruders can perform the full range of attacks: Change functionality and specification, cause leakage of confidential information and perform
DoS attacks. For example, malicious changes in IC logic elements can lead to emergence of additional logic operations, which are potentially dangerous and may lead
to appearance of data leakage channels through various standard peripheral devices.
Therefore, a new task appeared already in 2005–2006: What is the best method
to implement a safe project knowing that its underlying reconfigurable logic can
theoretically be infected by a hardware Trojan embedded in the IC, and how to
protect the project after its implementation, i.e., protect the information data stream
from being distorted or infected by this Trojan. A three-stage approach to ensuring
such security of the FPGA bitstream was suggested in [17]; it includes a number of
specific solutions. First, integrity of configuration is verified by its reverse reading;
second, if incorrect configuration is detected, FPGA is partially modified; third, if the
system is compromised, the FPGA automatically uses the standard request-response
protocol to notify a third party.
The work [18] presents an overview of technological and methodological solutions
to protect FPGA bitstreams and the internal memory embedded in the IC from eventbased failures. The authors draw the following conclusions:
• If the stages of FPGA production and IC design on FPGA are separated in time
and space, or the project involves third-party IP blocks, the intruder can easily
introduce changes in any such project;
• randomly reconstructed data transmission streams are quite difficult to reverse
engineer both for an intruder, which makes it difficult for the intruder to understand
the purpose of the Ic, and for the IC developer for the purpose of finding the
embedded Trojans;
• transmitted data streams can be encoded, which ensures proper protection; in
this case, internal hardware decoding of the bit stream is possible in many
653
• Platform target FPGAs containing embedded memory controllers and even entire
processor cores;
• Specialized ASIC microcircuits, which can contain small reconfigurable components for implementation of certain functions.
The main advantage of reconfigurable logic from the point of its safety consists
in the fact that its use makes it possible to separate IC design stages and its hardware
implementation stages. If the final design of a typical IC is transferred directly to semiconductor production, in case reconfigurable logic is used in it, any programmable
logic block or macroblock is inserted in the IC before it is launched into production; after production, it is programmed with a special configurable bit stream, thus
completing hardware implementation of the project. In practice, such separation
means that any project can actually be developed in a trusted environment almost
completely, excluding certain peripheral functions (options) added to the main logical
functions of the microcircuit.
This method ensures complete control over the project at the RTL level; however,
development and introduction of various versions of reconfigurable logic is exposed
to the same threats from hardware Trojans that are characteristic of standard specialized IC (ASIC). The intruders can perform the full range of attacks: Change functionality and specification, cause leakage of confidential information and perform
DoS attacks. For example, malicious changes in IC logic elements can lead to emergence of additional logic operations, which are potentially dangerous and may lead
to appearance of data leakage channels through various standard peripheral devices.
Therefore, a new task appeared already in 2005–2006: What is the best method
to implement a safe project knowing that its underlying reconfigurable logic can
theoretically be infected by a hardware Trojan embedded in the IC, and how to
protect the project after its implementation, i.e., protect the information data stream
from being distorted or infected by this Trojan. A three-stage approach to ensuring
such security of the FPGA bitstream was suggested in [17]; it includes a number of
specific solutions. First, integrity of configuration is verified by its reverse reading;
second, if incorrect configuration is detected, FPGA is partially modified; third, if the
system is compromised, the FPGA automatically uses the standard request-response
protocol to notify a third party.
The work [18] presents an overview of technological and methodological solutions
to protect FPGA bitstreams and the internal memory embedded in the IC from eventbased failures. The authors draw the following conclusions:
• If the stages of FPGA production and IC design on FPGA are separated in time
and space, or the project involves third-party IP blocks, the intruder can easily
introduce changes in any such project;
• randomly reconstructed data transmission streams are quite difficult to reverse
engineer both for an intruder, which makes it difficult for the intruder to understand
the purpose of the Ic, and for the IC developer for the purpose of finding the
embedded Trojans;
• transmitted data streams can be encoded, which ensures proper protection; in
this case, internal hardware decoding of the bit stream is possible in many