686
7 Countermeasures Against Hardware Trojans
corresponding sets of test scenarios. After assessment, this testing engineer or chief
engineer marks the structure as malicious or as an actually necessary developed
object. The latter case is accompanied by analysis of the error. Since the accuracy of
detection rules is not perfect, and erroneous results continue to emerge, this information is sent back to the full cycle. In case the incident is specific to the project,
an exception is added to the sets of rules, or a specific construct (e.g., netlist area or
lines of source codes) is white-listed. If the findings (true or false results) lead to a
new aspect or knowledge, the above knowledge base is amended and expanded.
7.4.7 Experimental Results of Application of the HTDS
Method
In order to evaluate the effectiveness of these approaches to Trojan identification, the
authors of [72] used a set of hardware Trojans [77] that allows the modular design
of hardware Trojans known to the reader from the previous chapters and based on
the attributes of activation, hidden connection, payload, and detection. Various rules
and properties were used to creat the first database for Trojan detection based on
the designed and produced modules. They turned out to be useful during analysis of
structures and creation of new variants, even though, as the authors of [72] ironically
note, “Trojans will rarely come as neatly packaged modules”.
Modules in [72] were designed and tested on several FPGA by Xilinx. Source
blocks, as well as synthesized objects were subsequently analyzed for their typical
properties, characteristics, and identified malicious structures that could serve as an
indicator for identification of the malicious schemes and included in the following
list.
• Asynchronous latch. The latch is not clocked by any of the usually small number
of global clock signals.
• Strobed wire or output data. Signal filtered by another gate in order to falsify its
output data.
• Ring oscillator. Combination loop without constant frequency.
• Unused output or splicing wire. Used for data leakage, e.g., by analyzing
electromagnetic radiation.
• Hidden states of the finite state machine (FSM) Depending on the encryption
(e.g., single or sequential encryption), they can be extremely hard to detect.
• Latches or triggers independent of the global (general) reset signal.
• Local or strobed synchronization. As a rule, most gates are controlled by one of
the global (common for many blocks) signals.
The solutions found in [72] were demonstrated on a ring oscillator-based example.
In the simplest case, a ring oscillator is a cyclic circuit with an odd number of inverters,
which transmits the output signal back to the input. The oscillator generates the
signal with a frequency based on numeric values of the valve delays and type of the
7 Countermeasures Against Hardware Trojans
corresponding sets of test scenarios. After assessment, this testing engineer or chief
engineer marks the structure as malicious or as an actually necessary developed
object. The latter case is accompanied by analysis of the error. Since the accuracy of
detection rules is not perfect, and erroneous results continue to emerge, this information is sent back to the full cycle. In case the incident is specific to the project,
an exception is added to the sets of rules, or a specific construct (e.g., netlist area or
lines of source codes) is white-listed. If the findings (true or false results) lead to a
new aspect or knowledge, the above knowledge base is amended and expanded.
7.4.7 Experimental Results of Application of the HTDS
Method
In order to evaluate the effectiveness of these approaches to Trojan identification, the
authors of [72] used a set of hardware Trojans [77] that allows the modular design
of hardware Trojans known to the reader from the previous chapters and based on
the attributes of activation, hidden connection, payload, and detection. Various rules
and properties were used to creat the first database for Trojan detection based on
the designed and produced modules. They turned out to be useful during analysis of
structures and creation of new variants, even though, as the authors of [72] ironically
note, “Trojans will rarely come as neatly packaged modules”.
Modules in [72] were designed and tested on several FPGA by Xilinx. Source
blocks, as well as synthesized objects were subsequently analyzed for their typical
properties, characteristics, and identified malicious structures that could serve as an
indicator for identification of the malicious schemes and included in the following
list.
• Asynchronous latch. The latch is not clocked by any of the usually small number
of global clock signals.
• Strobed wire or output data. Signal filtered by another gate in order to falsify its
output data.
• Ring oscillator. Combination loop without constant frequency.
• Unused output or splicing wire. Used for data leakage, e.g., by analyzing
electromagnetic radiation.
• Hidden states of the finite state machine (FSM) Depending on the encryption
(e.g., single or sequential encryption), they can be extremely hard to detect.
• Latches or triggers independent of the global (general) reset signal.
• Local or strobed synchronization. As a rule, most gates are controlled by one of
the global (common for many blocks) signals.
The solutions found in [72] were demonstrated on a ring oscillator-based example.
In the simplest case, a ring oscillator is a cyclic circuit with an odd number of inverters,
which transmits the output signal back to the input. The oscillator generates the
signal with a frequency based on numeric values of the valve delays and type of the