7.5 Using Sandbox as a Method of Protection …
693
certain specific characteristic properties of Trojans [102, 103]. The main idea of
the method is to analyze the behavior of the inspected IP and perform subsequent
functional verification with a high ratio of coverage of Trojan events and states in
order to identify and deviations from normal IP behavior. It should be noted here
that the main problem of most known static approaches to identification of hidden
hardware Trojans is the need to use a golden reference. This is due to the fact that
all design centers of development companies buy from their external partners, who
are not always trusted, COTS and IPs that they cannot design themselves due to the
absence of this reference golden model.
It has to be said that all known online methods based on analysis and processing
of characteristics of various “side” channels are capable of intercepting Trojans
embedded in the hardware as soon as they activate. However, they still need a certain
reference physical profile, which can be provided today by the standard golden reference model of the device. Such monitoring method used to ensure safety of electronic
devices is detailed in [104]. Unfortunately, many important details concerning both
conceptual and practical implementation of such strategy haven’t been presented by
researchers [104] yet. Perhaps it will happen after publication of this book.
Another effective verification tool based on using parity information for online
verification of potential unsafe introduction was presented in the work [93]. The
verification tool here is the classic parity verification tool protected with the help
of the randomization procedure in order to prevent attacks of potential Trojans.
Regardless of the fact that this method, according to the authors, achieved success
in somewhat around 99.98% of the attempts, the authors of [90] still indicated that
they failed to present a sufficiently convincing systematic approach as a means of
designing truly universal tools of such verification.
In the work [105], another interesting mechanism of isolation of hardware Trojans
was presented as a system of monitoring and analysis of the data traffic stream
between the embedded Trojan device and the external computing network for
detection and prevention of potential DDoS attacks.
Therefore, the main methods suggested in the cited original work [90] is substantiated by the suggestion that more effective and cheaper IP protection can be achieved
by focusing on a small set of effective protective means. By focusing on measurements and analysis of the component parameter values at their thresholds and using
relevant verification tools to monitor unauthorized behavior it is actually possible to
ensure complete protection of the remaining part of the system. However, the use of
verification tools alone cannot be considered a classic sandbox.
After all, physical combination of verification tools and isolated virtual resources
provided by unreliable third-party IP is what actually makes a perfect hardware
sandbox. Such an approach can be considered as opposition to another model known
to specialists—TrustZone [106], which is available in ARM series processors. Since
TrustZone ARM isolates suspicious parts of the system in the reliable area of
the sandbox and provides unreliable IPs with unlimited access to the rest of the
system, such methodological approach does not provide all trusted components with
unlimited access to all system resources and automatically places these unreliable
components in hardware sandboxes.
693
certain specific characteristic properties of Trojans [102, 103]. The main idea of
the method is to analyze the behavior of the inspected IP and perform subsequent
functional verification with a high ratio of coverage of Trojan events and states in
order to identify and deviations from normal IP behavior. It should be noted here
that the main problem of most known static approaches to identification of hidden
hardware Trojans is the need to use a golden reference. This is due to the fact that
all design centers of development companies buy from their external partners, who
are not always trusted, COTS and IPs that they cannot design themselves due to the
absence of this reference golden model.
It has to be said that all known online methods based on analysis and processing
of characteristics of various “side” channels are capable of intercepting Trojans
embedded in the hardware as soon as they activate. However, they still need a certain
reference physical profile, which can be provided today by the standard golden reference model of the device. Such monitoring method used to ensure safety of electronic
devices is detailed in [104]. Unfortunately, many important details concerning both
conceptual and practical implementation of such strategy haven’t been presented by
researchers [104] yet. Perhaps it will happen after publication of this book.
Another effective verification tool based on using parity information for online
verification of potential unsafe introduction was presented in the work [93]. The
verification tool here is the classic parity verification tool protected with the help
of the randomization procedure in order to prevent attacks of potential Trojans.
Regardless of the fact that this method, according to the authors, achieved success
in somewhat around 99.98% of the attempts, the authors of [90] still indicated that
they failed to present a sufficiently convincing systematic approach as a means of
designing truly universal tools of such verification.
In the work [105], another interesting mechanism of isolation of hardware Trojans
was presented as a system of monitoring and analysis of the data traffic stream
between the embedded Trojan device and the external computing network for
detection and prevention of potential DDoS attacks.
Therefore, the main methods suggested in the cited original work [90] is substantiated by the suggestion that more effective and cheaper IP protection can be achieved
by focusing on a small set of effective protective means. By focusing on measurements and analysis of the component parameter values at their thresholds and using
relevant verification tools to monitor unauthorized behavior it is actually possible to
ensure complete protection of the remaining part of the system. However, the use of
verification tools alone cannot be considered a classic sandbox.
After all, physical combination of verification tools and isolated virtual resources
provided by unreliable third-party IP is what actually makes a perfect hardware
sandbox. Such an approach can be considered as opposition to another model known
to specialists—TrustZone [106], which is available in ARM series processors. Since
TrustZone ARM isolates suspicious parts of the system in the reliable area of
the sandbox and provides unreliable IPs with unlimited access to the rest of the
system, such methodological approach does not provide all trusted components with
unlimited access to all system resources and automatically places these unreliable
components in hardware sandboxes.