682
7 Countermeasures Against Hardware Trojans
7.4.6 Methods of Safe Microcircuit Design
7.4.6.1 Stages of Safe Microcircuit Design
The authors of [72] ultimately attempted to apply the proven methods from the safe
programming technique to the process of development of trusted ICs. However, due
to differences between development of circuits and programs, as demonstrated above,
the relevant methods need to be selected very carefully. In order to reduce the possibility of introducing hardware Trojans, they developed such a method adequate to the
process of microcircuit development. The authors of [72] considered the following
stages of its implementation.
Threat modeling. Based on the analysis of attack types and known descriptions
of hardware Trojans, including the ones generalized in [76], they analyzed their
insertion points. The category of these points is called the attack surface. The analysis
revealed advantages and disadvantages of introducing a malicious circuit during
each determined phase (stage) of the development project in such manner that would
provide a comprehensive picture, taking into account the prospects for both concerned
parties, i.e., developers and attackers.
Selection of methods. Methods that were deemed acceptable by the authors
required significant modernization. During this stage, technical possibility of introducing the method was analyzed, and the additional requirements needed for its
actual application were determined.
Determination of the detection cycle. After all preliminary requirements are
formulated, the complete Hardware Trojan Detection Cycle is assembled and
described in detail to be used by secure ASK developers. Special attention is given
to using the combination of automatic processing and human interference.
Assessment. Final assessment shall demonstrate that the designed HTDS detection
cycle achieves the set goal, i.e., successfully detects circuit Trojans. For this, the
authors of [72] used test implementations of a malicious circuit from the Hardware
Trojan Kit [77]. As an example, we present the assessment of implementation of
one such hardware Trojans. We will demonstrate that this assessment identified the
limitations of this method.
7.4.6.2 Description of Threat Models
As demonstrated above, a malicious circuit can be introduced during various stages
of the production process. Each stage has its own representation (description), risks,
and advantages for the attacker. Malicious functionality installed into a (machinereadable) specification or design needs to be carefully hidden, since specifications
are reviewed and verified by engineers, testers, and developers; moreover, they are
extremely difficult to change.
7 Countermeasures Against Hardware Trojans
7.4.6 Methods of Safe Microcircuit Design
7.4.6.1 Stages of Safe Microcircuit Design
The authors of [72] ultimately attempted to apply the proven methods from the safe
programming technique to the process of development of trusted ICs. However, due
to differences between development of circuits and programs, as demonstrated above,
the relevant methods need to be selected very carefully. In order to reduce the possibility of introducing hardware Trojans, they developed such a method adequate to the
process of microcircuit development. The authors of [72] considered the following
stages of its implementation.
Threat modeling. Based on the analysis of attack types and known descriptions
of hardware Trojans, including the ones generalized in [76], they analyzed their
insertion points. The category of these points is called the attack surface. The analysis
revealed advantages and disadvantages of introducing a malicious circuit during
each determined phase (stage) of the development project in such manner that would
provide a comprehensive picture, taking into account the prospects for both concerned
parties, i.e., developers and attackers.
Selection of methods. Methods that were deemed acceptable by the authors
required significant modernization. During this stage, technical possibility of introducing the method was analyzed, and the additional requirements needed for its
actual application were determined.
Determination of the detection cycle. After all preliminary requirements are
formulated, the complete Hardware Trojan Detection Cycle is assembled and
described in detail to be used by secure ASK developers. Special attention is given
to using the combination of automatic processing and human interference.
Assessment. Final assessment shall demonstrate that the designed HTDS detection
cycle achieves the set goal, i.e., successfully detects circuit Trojans. For this, the
authors of [72] used test implementations of a malicious circuit from the Hardware
Trojan Kit [77]. As an example, we present the assessment of implementation of
one such hardware Trojans. We will demonstrate that this assessment identified the
limitations of this method.
7.4.6.2 Description of Threat Models
As demonstrated above, a malicious circuit can be introduced during various stages
of the production process. Each stage has its own representation (description), risks,
and advantages for the attacker. Malicious functionality installed into a (machinereadable) specification or design needs to be carefully hidden, since specifications
are reviewed and verified by engineers, testers, and developers; moreover, they are
extremely difficult to change.