Security of Safety Important I&C Systems - Nuclear Power Plant Instrumentation and Control Systems for Safety and Security - page 252

uses rare internal states of the chip to construct
HT. Also to detect HT, vendors can insert special
“latches” into electronic design, responding to
specified event, much more likely caused by HT
in the chip.
Non-invasive approaches for HT detection
consist in comparison of behavior of test FPGA
chip and etalon chip (or etalon functional model).
Hence, non-invasive approaches can be divided
into the following subcategories:

• Use of combined hardware-software ap-
proach that consists in using of simply
veriiable hardware module external to the
chip, allowing detecting DoS-attacks and
privilege escalation attacks (attacks can be
detected using periodic checks and cause
decrease of mean performance level by
several percent).

Approaches to HT detection, used during
chip testing, can be based on logic checking or
measurement of side-channel parameters (for
example, power, delays, etc.). Advantage of such
approaches is that their implementation does not
require resources overhead for test chips. The
only disadvantage consists in that there should
be etalon (“golden”) chip similar to the test chip,
but without HTs inserted inside.
The only disadvantage of approaches to HTs
detection that are based on logic testing, is the
enormously large HTs space, which makes the
generation of an exhaustive set of test vectors to
detect all possible HTs computationally infeasible.
Logic testing-based approaches can be based on
the following principles:

• HT detection approaches used during chip
operation (use real-time diagnostic system
to detect HTs during normal operation of
a chip).
• HT detection approaches used during test-
ing (intended for detecting of HTs during
chip testing, before its use).

All the approaches to HT detection, used
during chip operation, require chip resources for
their implementation (cause increase of power
consumption), since they perform checks during
normal chip operation, and, in a case of deviation,
they trigger appropriate countermeasures. Such
approaches are used as the last line of chip de-
fense, providing absolute credibility of computed
results, and can be based on any of the following
principles:

• Use of a technique based on inserting ran-
domization elements for probabilistic com-
parison of functionality of manufactured
chip with its electronic design.
• Generation of statistical vector, which rep-
resents an optimal set of test vectors, al-
lowing trigger speciied (often rarely used)
node in a circuit to its rare value multiple
times.

• Use of novel bus architecture that can de-
tect operating HTs inside the chip, activate
protection against them, and also notify
about such activity (such architecture re-
quires about 800 logic elements for the
chip, which contains 4 millions of logic
elements, and cause minor delays).
• Use of scheme that implements (by hard-
ware) HT detection functionality in sev-
eral chips simultaneously and compares
them in order to dynamically assess their
trust-levels.

Side-channel parameters analysis-based ap-
proaches for HT detection are based on the follow-
ing assumption. Even if HT presence inside a chip
does not cause visible deviations during testing,
then HT presence could be detected by monitoring
the effect on such physical parameter such as chip