7.4 Using Classic Methods of Reliable …
683
Attacks during the implementation phase (e.g., attacks on design) allow the
attacker to access high-level functions, as well as low-level signals. The main advantage for the intruder here consists in low costs of installing the malicious function;
however, this option is associated with increased risks of its detection during qualification testing of the product. As a means of protection, the attacker can install its
modifications in linking (interface) logic circuits between modules or even distribute
the Trojan fragments among different modules.
Modifications of the list of connections are extremely difficult to understand even
for a highly qualified product developer and require the intruder to introduce their
Trojans on a very low-level language. This can ultimately lead to small-size and
complicated modifications of the circuit with a minimum number of altered gates
and interconnections. Moreover, modern synthesis means today can carry software
Trojans and simply cover hardware Trojans every time the chip synthesis (attacking
synthesis) is performed. Modifications of masks and attacks during lengthy cycle of
the microcircuit production can introduce even more subtle changes (such as [78])
in the circuit; however, they usually require a deep understanding of operation of the
attacked circuit itself as well as the production process (production attacker).
We suggest that the earlier a Trojan is introduced in the production stage, the more
hints at its presence are dispersed across the objects associated with the project.
7.4.6.3 Traceability in a Microcircuit
The authors of [72] suggest using traceability in development of secure microcircuits
in the same manner as it is done during development of secure software. Based on
the set requirements, detailed specification is developed, which is recorded in the
first table (Fig. 7.15, left table).
Each specification document has its own history. Certain specific authors are
referenced in separate specifications or paragraphs. These specifications serve as
a basis for creation of special tests. Test scenarios are tied to specific specification
points covered by them (middle table), involved testing engineers, and, subsequently,
to the covered lines of the source code. All implementation variants are once again
based on specifications. Source-code control system is also theoretically able to bind
each version and related parts of the source code to specific authors and specification
points or any earlier request for introduction of a specific change, effectively ensuring
traceability of each correction of each line of the source code.
Even frequent use of third-party IP blocks by the developer requires no special
processing, since all libraries of such third party are also known in development
of software equipment. However, the mechanism for generation of the circuit and
the list of connection here works totally differently from the way it happens in
software development. Here, the entire developed logic and circuit are optimized
to a large extent. Even nested netlists (often generated for visualization) contain
some meta-information (e.g., the module or process name). During this stage, link
to the source code is usually attached to the elements: in fact, many of today’s
development environments do it in one way or another. However, netlists without
683
Attacks during the implementation phase (e.g., attacks on design) allow the
attacker to access high-level functions, as well as low-level signals. The main advantage for the intruder here consists in low costs of installing the malicious function;
however, this option is associated with increased risks of its detection during qualification testing of the product. As a means of protection, the attacker can install its
modifications in linking (interface) logic circuits between modules or even distribute
the Trojan fragments among different modules.
Modifications of the list of connections are extremely difficult to understand even
for a highly qualified product developer and require the intruder to introduce their
Trojans on a very low-level language. This can ultimately lead to small-size and
complicated modifications of the circuit with a minimum number of altered gates
and interconnections. Moreover, modern synthesis means today can carry software
Trojans and simply cover hardware Trojans every time the chip synthesis (attacking
synthesis) is performed. Modifications of masks and attacks during lengthy cycle of
the microcircuit production can introduce even more subtle changes (such as [78])
in the circuit; however, they usually require a deep understanding of operation of the
attacked circuit itself as well as the production process (production attacker).
We suggest that the earlier a Trojan is introduced in the production stage, the more
hints at its presence are dispersed across the objects associated with the project.
7.4.6.3 Traceability in a Microcircuit
The authors of [72] suggest using traceability in development of secure microcircuits
in the same manner as it is done during development of secure software. Based on
the set requirements, detailed specification is developed, which is recorded in the
first table (Fig. 7.15, left table).
Each specification document has its own history. Certain specific authors are
referenced in separate specifications or paragraphs. These specifications serve as
a basis for creation of special tests. Test scenarios are tied to specific specification
points covered by them (middle table), involved testing engineers, and, subsequently,
to the covered lines of the source code. All implementation variants are once again
based on specifications. Source-code control system is also theoretically able to bind
each version and related parts of the source code to specific authors and specification
points or any earlier request for introduction of a specific change, effectively ensuring
traceability of each correction of each line of the source code.
Even frequent use of third-party IP blocks by the developer requires no special
processing, since all libraries of such third party are also known in development
of software equipment. However, the mechanism for generation of the circuit and
the list of connection here works totally differently from the way it happens in
software development. Here, the entire developed logic and circuit are optimized
to a large extent. Even nested netlists (often generated for visualization) contain
some meta-information (e.g., the module or process name). During this stage, link
to the source code is usually attached to the elements: in fact, many of today’s
development environments do it in one way or another. However, netlists without