8.7 What Did the Authors Learn About Hardware Trojans in Microcircuits?
805
commissioned by the Ministry of Defense of the USSR, in which we were involved
due to our senior comrades, we found quite a lot of such backdoors in the imported
microcircuits, which we had to reproduce for the needs of the Soviet industrial
and military complex. Many years later, we decided to present these multiple nondeclared functions for several foreign microcircuits reproduced by us back then in
one of the chapters of this encyclopedia. Of course, after dealing with these backdoors
in the soviet analogs of microcircuits, some of which were subsequently produced
at Integral, we closed these backdoors, leaving only the channels of access to the
internal structure of microcircuits required by our developers.
This required much less additional elements and connections than solving tasks
of the embedded diagnostics: it was necessary to provide access to nearly all main
units unauthorized by the developer.
Of course, the traditional method used at Integral back then didn’t involve solving
specific tasks characteristic of Trojans (masking, minimum number of used elements,
minimum number of links, organization of the sleeping mode, etc.). However, these
are all technical details.
When discussing this situation, the authors unanimously agreed that only the
absence of the timely decision from the wise CPSU helped the Integral employees
to avoid the dubious fame of inventors of hardware Trojans.
Although it should be said in all fairness if semiconductor factories of the Ministry
of Electronic Industry of the USSR were doing what the semiconductor factories in
China are doing under wise supervision of the Communist Party of the PRC, then
technically competent experts of the KGB would have prepared the corresponding
reports, while the CPSU Central Committee and the Council of Ministers of the
USSR would have adopted another corresponding secret resolution.
But Chinese factories are now supplying huge quantities of microcircuits to
the international market, while the few semiconductor plants in the USSR could
not satisfy all current and potential requirements of the developing Soviet military
industrial and spacecraft complexes.
The study of all these non-declared functions helped us obtain valuable experience
in a new technical field—the embedded technical diagnostics. The essence of the
solution is as follows: additional elements and additional connections between these
elements, which realize the operation algorithms and electrical modes of microcircuit
operation set by the developer are introduced in the microcircuit. Metering engineers
(there was such occupation) could use these additional elements and connections in
order to quickly identify the reasons for a process fault or a circuitry mistake produced
by the microcircuit during standard tests. By supplying the required effects via the
necessary pinouts (pads) of the microcircuit, they could force the main blocks of the
circuit (ALU, registers, counters, interface modules) to perform various operations
(not provided by the circuit developer) in order to quickly get to the cause of the
failure.
Integral’s developers later used this experience in development and analysis of
more and more complex highly integrated microcircuits. Now we understand that
those additional diagnostic blocks were essentially analogous to the structure that
would later be known as hardware Trojans.
805
commissioned by the Ministry of Defense of the USSR, in which we were involved
due to our senior comrades, we found quite a lot of such backdoors in the imported
microcircuits, which we had to reproduce for the needs of the Soviet industrial
and military complex. Many years later, we decided to present these multiple nondeclared functions for several foreign microcircuits reproduced by us back then in
one of the chapters of this encyclopedia. Of course, after dealing with these backdoors
in the soviet analogs of microcircuits, some of which were subsequently produced
at Integral, we closed these backdoors, leaving only the channels of access to the
internal structure of microcircuits required by our developers.
This required much less additional elements and connections than solving tasks
of the embedded diagnostics: it was necessary to provide access to nearly all main
units unauthorized by the developer.
Of course, the traditional method used at Integral back then didn’t involve solving
specific tasks characteristic of Trojans (masking, minimum number of used elements,
minimum number of links, organization of the sleeping mode, etc.). However, these
are all technical details.
When discussing this situation, the authors unanimously agreed that only the
absence of the timely decision from the wise CPSU helped the Integral employees
to avoid the dubious fame of inventors of hardware Trojans.
Although it should be said in all fairness if semiconductor factories of the Ministry
of Electronic Industry of the USSR were doing what the semiconductor factories in
China are doing under wise supervision of the Communist Party of the PRC, then
technically competent experts of the KGB would have prepared the corresponding
reports, while the CPSU Central Committee and the Council of Ministers of the
USSR would have adopted another corresponding secret resolution.
But Chinese factories are now supplying huge quantities of microcircuits to
the international market, while the few semiconductor plants in the USSR could
not satisfy all current and potential requirements of the developing Soviet military
industrial and spacecraft complexes.
The study of all these non-declared functions helped us obtain valuable experience
in a new technical field—the embedded technical diagnostics. The essence of the
solution is as follows: additional elements and additional connections between these
elements, which realize the operation algorithms and electrical modes of microcircuit
operation set by the developer are introduced in the microcircuit. Metering engineers
(there was such occupation) could use these additional elements and connections in
order to quickly identify the reasons for a process fault or a circuitry mistake produced
by the microcircuit during standard tests. By supplying the required effects via the
necessary pinouts (pads) of the microcircuit, they could force the main blocks of the
circuit (ALU, registers, counters, interface modules) to perform various operations
(not provided by the circuit developer) in order to quickly get to the cause of the
failure.
Integral’s developers later used this experience in development and analysis of
more and more complex highly integrated microcircuits. Now we understand that
those additional diagnostic blocks were essentially analogous to the structure that
would later be known as hardware Trojans.