Security of Safety Important I&C Systems - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 251

Tehranipoor M. et al., (Tehranipoor, M. et
al., 2010) distinguished the following activation
mechanisms for HTs:

All the approaches to HT detection can be
divided into two categories: destructive and
nondestructive.
Destructive approaches are based on de-
metallization process followed by scanning using
an electronic microscope. Such approaches are
extremely expensive and time-consuming (about
several months for single chip), becoming inef-
fective when increasing of transistor density on
the chip. Moreover, taking into account that only
a small part of chips from a manufactured lot can
contain HTs, such approaches can be considered
as ineffective.
Nondestructive approaches, in turn, can be
divided into two categories: invasive (based on
modification of original FPGA electronic design in
order to insert functions intended for HT detection)
and non-invasive (do not require modification of
original FPGA electronic design).
Invasive approaches to HTs detection in chips
can be divided into two subcategories:

• Initial Activation: HT is activated (i.e. it

is triggered without addition conditions or
events) at the moment of chip fabrication.

• Event-Based Activation: HTs are be-

ing activated only by a speciic internal or
external event. Internal event is an event
caused by a chip or device that contains
HTs. Internal events can occur after pre-
determined time period or due to speciic
physical conditions (for example, chip tem-
perature). Activation by an external event
means that speciic signal or combination
of signals (for example, speciied sequence
in input data from the user) inputs a chip or
device, which contains HTs, or data input
through special port.

Effect of HT activation can vary from im-
perceptible disturbances in operation of device,
which contains HT, to catastrophic failures of the
system, which contains such device, and can be
divided into the following groups:

• Preventive (intended for prevention of in-
sertion of HTs at the stages of chip devel-
opment or fabrication).
• Assistive (intended for detection of insert-
ed HTs into a chip).

• Change device functionality (by addition
of complementary logic, or removing/by-
passing existing logic): It mostly leads to
subtle errors that are almost undetectable.
• Downgrade performance due to intentional
change of device parameters by HT, and
can be caused by functional characteristics
or interface characteristics.
• Leak of information through overt or co-
vert channels.
• Denial of Service: It prevents operation of
function or resource, usually causing un-
expected lack of bandwidth, computation
or battery power; physical destroying, dis-
abling or altering device's coniguration is
also possible.

A possibility of insertion of HT during chip
design stage depends on availability of unused
space (or possibility of obtaining such space via
logic optimization of electronic design) within
chip layout. Moreover, a complexity of insertion
of HT into a chip significantly depends on a pos-
sibility of “masking” of original electronic design
by vendors through expansion of reachable state
space to make it difficult to reverse-engineer by
adversaries the chip functionality and find the
true rare events (so, inserted HTs by adversaries
can have no effect on normal chip operation or
become easily detectable).
For HTs detecting is possible to use approaches
based on testing of chip logic or measuring pa-
rameters of chip side-channels, since an adversary