7.2 A Trojan-Resistant System …
663
Comparator
Counter
Reset
System clocking
Interruption
Malicious bus
interlock device
Global interlock
device
Standard bus
arbiter
Provision
Provision
Provision
Bus request x1
Bus request x2
Bus request x3
Bus request
Bus request
Latch release
Register of original mask
containing Trojan
Unauthorized access detection
Interlock 1
Interlock 2
Interlock 3
Fig. 7.5 Structural diagram of the SoC arbiter safety
active throughout every time cycle of bus usage by the master device. As soon as
the counter exceeds the set threshold, the malicious bus interlock signal activates
immediately. This threshold can be set based on specifics of each application or vary
adaptively during operation depending on the conditions of functioning of a specific
one-chip system, thus minimizing the possibility of generation and processing of a
false notification. In this structure, after the interlock signal of the malicious bus, the
special register for masking of the master device immediately disables the interlock
and corresponding request signals, and such attack-resistant arbiter returns to normal
operation.
It is necessary to touch upon the following question, which is important for SoC
security specialists: the arbiter shown in Fig. 7.5 also receives the signal of unauthorized access detection from the address decoder as explained above. Due to this, the
arbiter automatically saves MASTER ID of the malicious master device in the mask
register of the master device in order to prevent any further attempts of this master
device to obtain unauthorized access to the bus.
663
Comparator
Counter
Reset
System clocking
Interruption
Malicious bus
interlock device
Global interlock
device
Standard bus
arbiter
Provision
Provision
Provision
Bus request x1
Bus request x2
Bus request x3
Bus request
Bus request
Latch release
Register of original mask
containing Trojan
Unauthorized access detection
Interlock 1
Interlock 2
Interlock 3
Fig. 7.5 Structural diagram of the SoC arbiter safety
active throughout every time cycle of bus usage by the master device. As soon as
the counter exceeds the set threshold, the malicious bus interlock signal activates
immediately. This threshold can be set based on specifics of each application or vary
adaptively during operation depending on the conditions of functioning of a specific
one-chip system, thus minimizing the possibility of generation and processing of a
false notification. In this structure, after the interlock signal of the malicious bus, the
special register for masking of the master device immediately disables the interlock
and corresponding request signals, and such attack-resistant arbiter returns to normal
operation.
It is necessary to touch upon the following question, which is important for SoC
security specialists: the arbiter shown in Fig. 7.5 also receives the signal of unauthorized access detection from the address decoder as explained above. Due to this, the
arbiter automatically saves MASTER ID of the malicious master device in the mask
register of the master device in order to prevent any further attempts of this master
device to obtain unauthorized access to the bus.