722
7 Countermeasures Against Hardware Trojans
chip with the help of added control signals connected to the common key register
(CK). When the correct CK is received, the scheme is equivalent to the original one;
otherwise, the chip operation mode changes as if random inverters are placed on
the selected connection conductors. EPIC creates the CK in a random fashion in
order to prevent it from being stolen by an intruder. After such modification of the
microcircuit design, the developer covertly transfers the CK to the owner of IP rights
and documentarily destroys all other copies. After that, all standard IC design stages
are performed, and the product is transferred to the foundry. After that, every such
IC will be uniquely locked by interaction with random and uncloneable identifiers
generated by the IC itself.
However, according to the conditions of implementation of this protection method,
at the time of activation of the chip, the production plant shall have a channel for
secure communication with the developer (holder of IP rights) and send the RCK-Pub
for the IC to be activated. For this, the EPIC protocol uses the special private key of
the manufacturer to verify authenticity of data transfer. Various options (extensions)
of this protocol can send a timestamp, a serial number or other identifying sequences.
In response, the developer (holder of IP rights) transfers the input key (IK), which
shows the CK encrypted with the help of PCK-Pub and later marked with MK-Pri.
The order of encryption and the order of installing the label on the IC to generate
the IK is a critical point for the method—after all, it is necessary to ensure that other
subjects, except for the developer (holder of IP rights) cannot create such an IK, even
if the CK is compromised due to any factor (work of the competitor’s agents). The
use of RCK-Pub for message encryption significantly complicates the possibility of
a successful statistical attack on MK-Pri. The developer can use a publicly available
production key for additional encoding of the resulting IK, using RCK-Pri and MKPub to verify that the IK was actually sent by the developer. After decryption, CK
is generated, which unlocks the chip and makes the testing process possible. After
completion of the testing stage, the IC can already go on sale.
It is shown that EPIC will be fail-safe with regard to various attack models, as
described in [134]. We should note here that early EPIC versions were assessed by
other groups of security experts from the point of view of protection and possible
vulnerabilities [135]. It was determined that EPIC is vulnerable if the IK is calculated
from CK, MK-Pri, and RCK-Pub in an incorrect order; first, the CK shall be encrypted
with the help of the PCK-Pub; after that, the resulting encrypted text shall be marked
with the help of the MK-Pri, which is the standard protocol for data transmission
with public key on condition of strict compliance with obligations. On the other hand,
if the IK is calculated properly, there are no currently known (published) cases of
successful attacks against EPIC on the logic level [136].
The work [132] presents an interesting external method of IC interlock. Here, the
foundry and the design enterprise jointly use the private key known to them exclusively, which interacts with the combinational logic on chip through the interface
and is used to interlock and control buses, including the buses used for connection
and interface between several cores on the same chip. Another variant of hardware
metering using non-symmetric key cryptography was discussed in [125]. The work in
[119] is another method of combinational interlock that uses a small programmable
7 Countermeasures Against Hardware Trojans
chip with the help of added control signals connected to the common key register
(CK). When the correct CK is received, the scheme is equivalent to the original one;
otherwise, the chip operation mode changes as if random inverters are placed on
the selected connection conductors. EPIC creates the CK in a random fashion in
order to prevent it from being stolen by an intruder. After such modification of the
microcircuit design, the developer covertly transfers the CK to the owner of IP rights
and documentarily destroys all other copies. After that, all standard IC design stages
are performed, and the product is transferred to the foundry. After that, every such
IC will be uniquely locked by interaction with random and uncloneable identifiers
generated by the IC itself.
However, according to the conditions of implementation of this protection method,
at the time of activation of the chip, the production plant shall have a channel for
secure communication with the developer (holder of IP rights) and send the RCK-Pub
for the IC to be activated. For this, the EPIC protocol uses the special private key of
the manufacturer to verify authenticity of data transfer. Various options (extensions)
of this protocol can send a timestamp, a serial number or other identifying sequences.
In response, the developer (holder of IP rights) transfers the input key (IK), which
shows the CK encrypted with the help of PCK-Pub and later marked with MK-Pri.
The order of encryption and the order of installing the label on the IC to generate
the IK is a critical point for the method—after all, it is necessary to ensure that other
subjects, except for the developer (holder of IP rights) cannot create such an IK, even
if the CK is compromised due to any factor (work of the competitor’s agents). The
use of RCK-Pub for message encryption significantly complicates the possibility of
a successful statistical attack on MK-Pri. The developer can use a publicly available
production key for additional encoding of the resulting IK, using RCK-Pri and MKPub to verify that the IK was actually sent by the developer. After decryption, CK
is generated, which unlocks the chip and makes the testing process possible. After
completion of the testing stage, the IC can already go on sale.
It is shown that EPIC will be fail-safe with regard to various attack models, as
described in [134]. We should note here that early EPIC versions were assessed by
other groups of security experts from the point of view of protection and possible
vulnerabilities [135]. It was determined that EPIC is vulnerable if the IK is calculated
from CK, MK-Pri, and RCK-Pub in an incorrect order; first, the CK shall be encrypted
with the help of the PCK-Pub; after that, the resulting encrypted text shall be marked
with the help of the MK-Pri, which is the standard protocol for data transmission
with public key on condition of strict compliance with obligations. On the other hand,
if the IK is calculated properly, there are no currently known (published) cases of
successful attacks against EPIC on the logic level [136].
The work [132] presents an interesting external method of IC interlock. Here, the
foundry and the design enterprise jointly use the private key known to them exclusively, which interacts with the combinational logic on chip through the interface
and is used to interlock and control buses, including the buses used for connection
and interface between several cores on the same chip. Another variant of hardware
metering using non-symmetric key cryptography was discussed in [125]. The work in
[119] is another method of combinational interlock that uses a small programmable