658
7 Countermeasures Against Hardware Trojans
7.2.2 Structure and Operating Principle of a Standard SoC
Bus
As we know, system bus of a single-chip system is not an actual physical bus;
it performs many functions associated with implementation of interconnection of
the processor core with the surrounding interface logic. Examples of such standard
SoC buses are advanced micro-controller bus architecture (AMBA) by ARM, CoreConnect by IBM, Avalon Bus Architecture by Altera, Wishbone by Opencores and
STBus by STMicroelectronics [30—31]. Even though each of these buses is characterized by specific architecture, performance, advantages, and protocols, all of them
are designed to perform the same functions of intermediate bus mastership in the
environment of several master bus devices. As a rule, this includes transmitting of
received addresses from the current master device in the sample signals to slave IPs,
data transmission from the selected slave IP to the current master device, ensuring
logical and temporal compatibility between different levels of the bus.
In Fig. 7.1, the authors of [29] use a regular bus arbiter connected to three master
devices and three slave devices as an example.
A device that wants to receive the master node status can generate its request
using the Mastership_REQ line. If it is provided with the status of the master node,
the arbiter will inform the requesting device about it using the corresponding line
MASTER ID; at the same time, it will set MASTER ID in such a manner that all
multiplexors will allow signals from the selected master device to enter slave devices.
Each slave device also has the LOCK signal, which will be set operatively when
it is necessary to block the bus. Such necessity can occur, for example, when there
is a certain time restriction that forces the master device to stop the main task (such
as transmitting the accepted packet into the main memory) immediately. When the
bus is locked, the arbiter immediately informs other potential master devices using
the special MASTER LOCK signals. In cases when the master device performs a
less critical task in terms of time, e.g., when the CPU extracts an instruction from
memory, the CPU usually does not set LOCK. This allows the arbiter to temporarily
deprive the CPU of its status of a master device and temporarily provide another
device like modem with such status in case of such time-critical task.
In a regular operating system, the status of the master node is passed between
different devices in accordance with standardized time diagrams of data receipt and
various requests and priorities of master devices. However, in case of a Trojan attack,
such malicious master device can request (and immediately receive) the status of the
master node and then block the bus for any period of time required by the intruder.
By controlling the bus in such a manner, the intruder can completely freeze the
system, preventing CPU from extracting any software instructions or downloading
new data. Moreover, the intruder can easily access normally confidential system
addresses in order to ultimately reach the main modes of operation of confidentiality
and control systems.
7 Countermeasures Against Hardware Trojans
7.2.2 Structure and Operating Principle of a Standard SoC
Bus
As we know, system bus of a single-chip system is not an actual physical bus;
it performs many functions associated with implementation of interconnection of
the processor core with the surrounding interface logic. Examples of such standard
SoC buses are advanced micro-controller bus architecture (AMBA) by ARM, CoreConnect by IBM, Avalon Bus Architecture by Altera, Wishbone by Opencores and
STBus by STMicroelectronics [30—31]. Even though each of these buses is characterized by specific architecture, performance, advantages, and protocols, all of them
are designed to perform the same functions of intermediate bus mastership in the
environment of several master bus devices. As a rule, this includes transmitting of
received addresses from the current master device in the sample signals to slave IPs,
data transmission from the selected slave IP to the current master device, ensuring
logical and temporal compatibility between different levels of the bus.
In Fig. 7.1, the authors of [29] use a regular bus arbiter connected to three master
devices and three slave devices as an example.
A device that wants to receive the master node status can generate its request
using the Mastership_REQ line. If it is provided with the status of the master node,
the arbiter will inform the requesting device about it using the corresponding line
MASTER ID; at the same time, it will set MASTER ID in such a manner that all
multiplexors will allow signals from the selected master device to enter slave devices.
Each slave device also has the LOCK signal, which will be set operatively when
it is necessary to block the bus. Such necessity can occur, for example, when there
is a certain time restriction that forces the master device to stop the main task (such
as transmitting the accepted packet into the main memory) immediately. When the
bus is locked, the arbiter immediately informs other potential master devices using
the special MASTER LOCK signals. In cases when the master device performs a
less critical task in terms of time, e.g., when the CPU extracts an instruction from
memory, the CPU usually does not set LOCK. This allows the arbiter to temporarily
deprive the CPU of its status of a master device and temporarily provide another
device like modem with such status in case of such time-critical task.
In a regular operating system, the status of the master node is passed between
different devices in accordance with standardized time diagrams of data receipt and
various requests and priorities of master devices. However, in case of a Trojan attack,
such malicious master device can request (and immediately receive) the status of the
master node and then block the bus for any period of time required by the intruder.
By controlling the bus in such a manner, the intruder can completely freeze the
system, preventing CPU from extracting any software instructions or downloading
new data. Moreover, the intruder can easily access normally confidential system
addresses in order to ultimately reach the main modes of operation of confidentiality
and control systems.