硬件木马检测与防范研究综述

doi:10.11959/j.issn.2096-109x.2017.00160

摘要/Abstract

摘要：

集成电路芯片的设计和制造是当今电子化产业中关键的组成部分，第三方技术服务的日益普及可能导致电路芯片在制造过程中被植入硬件木马，这对电子设备在安全性上带来了很大的挑战。在简单介绍硬件木马的概念的基础上，分析了硬件木马的组成与特点，然后重点探讨了现阶段硬件木马的检测和防范技术，最后对硬件木马的发展趋势进行了总结。

关键词: 集成电路芯片, 硬件木马, 检测, 防范

Abstract:

The design and manufacture of integrated circuit chips are now a key component of the electronic industry.The increasing popularity of third-party technology services may lead to the implantation of hardware chips in the manufacturing process,which brings great challenge to the security of electronic devices.After introducing the concept of hardware Trojans,the characteristics and its forms were briefly analyzed.Then the detection technologies,and the prevention strategies of the hardware Trojans were discussed.At last,the development trend of the hardware Trojans was summarized.

Key words: integrated circuit chips, hardware Trojans, detection, prevention

中图分类号:

TN972

许强,蒋兴浩,姚立红,张志强,张诚. 硬件木马检测与防范研究综述[J]. 网络与信息安全学报, 2017, 3(4): 1-13.

Qiang XU,Xing-hao JIANG,Li-hong YAO,Zhi-qiang ZHANG,Cheng ZHANG. Overview of the detection and prevention study of hardware Trojans[J]. Chinese Journal of Network and Information Security, 2017, 3(4): 1-13.

图/表 9

图1

图2

图3

图4

图5

图6

图7

表1

表2

参考文献 48

[1]	YANG K Y , HICKS M , DONG Q ,et al. A2:analog malicious hardware[C]// 2016 IEEE Symposium on Security and Privacy (SP). 2016: 18-37.
[2]	ZHANG J , YUAN F , WEI L ,et al. VeriTrust：verification for hardware trust[C]// The Computer-aided Design of Integrated Circuits and Systems. 2013: 1148-1161.
[3]	KARRI R , RAJENDRAN J , ROSENFELD K . Trustworthy hardware:identifying and classifying hardware Trojans[J]. Journal of Computer, 2010,43(10): 39-46.
[4]	XIAO K , FORTE D , JIN Y ,et al. Hardware Trojans:lessons learned after one decade of research[J]. ACM Transactions on Design Automation of Electronic Systems, 2016,22(1): 1-23.
[5]	BAO C , FORTE D , SRIVASTAVA A . On application of one-class SVM to reverse engineering-based hardware Trojan detection[C]// The International Symposium on Quality Electronic Design. 2014: 47-54.
[6]	BANGA M , HSIAO M S . A region based approach for the identification of hardware Trojans[C]// IEEE Workshop on Hardware Oriented Security and Trust-HOST. 2008: 40-47.
[7]	BHUNIA S , HSIAO M S , BANGA M ,et al. Hardware Trojan attacks:threat analysis and counter measures[J]. Proceedings of the IEEE, 2014,102(8): 1229-1247.
[8]	BAUMGATEN A , STEFFEN M , CLAUSMAN M ,et al. A case study in hardware Trojan design and implementation[J]. International Journal of Information Security, 2011,10(1): 1-14.
[9]	LIN L , KASPEr M , GUNEYSU T ,et al. Trojan side-channel:light weight hardware trojans through side-channel engineering[C]// The 11th International Workshop on Cryptographic Hardware and Embedded Systems ( CHES 2009 ) . 2009: 382-395.
[10]	JIN Y , MAKRIS Y . Hardware Trojans in wireless cryptographic ICs[J]. IEEE Design & Test, 2010,27(1): 26-35.
[11]	倪林, 李少青, 马瑞聪 ,等. 硬件木马检测与防护[J]. 数字通信, 2014,41(1): 59-63.
	NI L , LI S Q , MA R C ,et al. Hardware Trojan detection and protection[J]. Digital Communications, 2014,41(1): 59-63.
[12]	谢海, 恩云飞, 王力纬 . 电磁泄露型硬件木马设计与检测[J]. 广东工业大学学报, 2013(4): 70-73.
	XIE H , EN Y F , WANG L W . Design and detection of hardware Trojan based on electromagnetic leakage[J]. Journal of Guangdong University of Technology, 2013(4): 70-73.
[13]	邹程, 张鹏, 邓高明 ,等. 基于功率旁路泄露的硬件木马设计[J]. 计算机工程, 2011,37(11): 135-137.
	ZOU C , ZHANG P , DENG G M ,et al. Design of hardware Trojan based on power side-channel exposure[J]. Computer Engineering, 2011,37(11): 135-137.
[14]	吴志凯, 魏佩, 陈吉华，等. 一种基于少态触发的硬件木马设计与实现[C]// 微处理器技术论坛. 2014.
	WU Z K , WEI P , CHEN J H ,et al. Design and implementation based on less state trigger hardware Trojans[C]// Microprocessor Technology BBS, 2014.
[15]	王晓晗, 李雄伟, 张阳 ,等. 一种基于故障注入的硬件木马设计[J]. 军械工程学院学报, 2015(5): 57-61.
	WANG X H , LI X W , ZHANG Y ,et al. Hardware Trojan design based on fault injection[J]. Journal of Ordnance Engineering College, 2015(5): 57-61.
[16]	李蕾, 尚子靖, 冯建华 ,等. 基于有限状态机的硬件木马设计和插入[J]. 北京大学学报:自然科学版, 2013,49(6): 1105-1110.
	LI L , SHANG Z J , FENG J H ,et al. Design and insertion of hardware Trojan based on finite state machine[J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2013,49(6): 1105-1110.
[17]	AGRAWAL D , BAKTIR S , KARAKOYUNLU D ,et al. Trojan detection using IC fingerprinting[C]// /The 2007 IEEE Symposium Security and Privacy. 2007: 296-310.
[18]	BHASIN S , DANGER J L , GUILLEY S ,et al. Hardware Trojan horses in cryptographic IP Cores[C]// Fault Diagnosis and Tolerance in Cryptography. 2013: 15-29.
[19]	刘华锋, 罗宏伟, 王力纬 . 硬件木马综述[J]. 微电子学, 2011,41(5): 709-713.
	LIU H F , LUO H W , WANG L W ,et al. Survey on hardware Trojan horse[J]. Microelectronics, 2011,41(5): 709-713.
[20]	POTKONJAK M , NAHAPETIAN A , NELSON M ,et al. Hardware Trojan horse detection using gate-level characterization[C]// Design Automation Conference (DAC '09). 2009: 688-693.
[21]	NARASIMHAN S , DU D , CHAKRABORTY R S ,et al. Multiple-parameter side-channel analysis:a non-invasive hardware trojan detection approach[C]// IEEE Workshop on Hardware-Oriented Security and Trust-HOST. 2010: 13-18.
[22]	BANGA M , HSIAO M S . VITAMIN:voltage inversion technique to ascertain malicious insertions in ICs[C]// IEEE Workshop onHardware-Oriented Security and Trust-HOST. 2009: 104-107.
[23]	JIN Y , MAKRIS Y . Hardware Trojan detection using path delay fingerprint[C]// IEEE Workshop on Hardware-Oriented Securityand Trust- HOST, 2008: 51-57.
[24]	EXURVILLE I , FOURNIER J , DUTERTRE J M ,et al. Practical measurements of data path delays for IP authentication and integrity verification[C]// IEEE International Workshop on Reconfigurableand Communication-Centric Systems-on-Chip-ReCoSoC. 2013: 1-6.
[25]	李雄伟, 王晓晗, 张阳 ,等. 基于多旁路综合分析的硬件木马检测方法[J]. 计算机仿真, 2015,32(3): 216-219.
	LI X W , WANG X H , ZHANG Y ,et al. Hardware Trojan detection method based on multiple side-channels analysis[J]. Computer Simulation, 2015,32(3): 216-219.
[26]	NGO X T , NAJM Z , GUILLEY S ,et al. Method taking into account process dispersion to detect hardware Trojan horse by sidechannel[C]// Security Proofs for Embedded Systems?PROOFS. 2014.
[27]	RAD R , PLUSQUELLIC J , TEHRANIPOOR M . Sensitivity analysis to hardware Trojans using power supply transient signals[C]// IEEE Workshop on Hardware-Oriented Security and Trust-HOST. 2008: 3-7.
[28]	RAD R , WANG X , TEHRANIPOOR M ,et al. Power supply signal calibration techniques for improving detection resolutionto hardware Trojans[C]// IEEE International Conference on ComputerAided Design-ICCAD. 2008: 632-639.
[29]	SUI Q . Hardware Trojan detection based on side channel signal analysis[D]. Changsha:National University of Defense Technology, 2012.
[30]	CHAKRABORTY R S , WOLFF F , PAUL S ,et al. ME-RO:a statistical approach for hardware Trojan detection[C]// Lecture Notes in Computer Science. 2009: 396-410.
[31]	冯秋丽 . 基于节点活性的硬件木马检测方法研究[D]. 广州：广东工业大学. 2016.
	FENG Q L . The research of hardware Trojan detection method based on nodes activity[D]. Guangzhou:Guangdong University of Technology. 2016.
[32]	CHAKRABONY R S , BHUNIA S . Security against hardware Trojan attacks using key—based design obfuscation[J]. Journal of Electronic Testing, 2011,27(6): 767-785.
[33]	XIAO K , TEHRANIPOOR M . BISA:built-in self-authentication for preventing hardware Trojan insertion[C]// IEEE Intemational Workshop on Hardware-oriented Security and Trust. 2013: 45-50.
[34]	ROY J A , KOUSHANFAR F , MARKOV I L . EPIC:ending piracy of integrated circuits[C]// Design,Automation & Test in Europe. 2008: 1069-1074.
[35]	LIU B , WANG B . Embedded reconfigurable logic for ASIC design obfuscation against supply chain attacks[C]// The Design,Automation and Test in Europe Conference and Exhibition (DATE’14). 2014: 1-6.
[36]	RAJENDRAN J , ZHANG H , SINANOGLU O ,et al. High-level synthesis for security and trust[C]// The 2013 IEEE 19th International on-Line Testing Symposium (IOLTS’13). 2013: 232-233.
[37]	BI Y , GAILLARDON P E , HU X S ,et al. Leveraging emerging technology for hardware security - case study on silicon nanowire FETs and graphene SymFETs[C]// Test Symposium. 2014: 342-347.
[38]	KEREN I L , KARPOVSKY M . Duplication based one-to-many coding for Trojan HW detection[C]// The 2010 IEEE 25th International Symposium on Defect and Fault Tolerance in VLSI Systems (DFT’10). 2010: 160-166.
[39]	REECE T , LIMBRICK D B , ROBINSON W H . Design comparison to identify malicious hardware in external intellectual property[C]// IEEE International Conference on Trust,Security and Privacy in Computing and Communications. 2011: 639-646.
[40]	王龙, 陈吉华, 李少青，等. 基于第三方IP核硬件木马防护性设计[C]// 微处理器技术论坛. 2015.
	WANG L , CHENJ H , LI S Q ,et a1. Based on the third party IP core hardware Trojan defensive design[C]// Microprocessor Technology BBS. 2015.
[41]	IMESON F , EMTENAN A , GARG S ,et al. Securing computer hardware using 3D integrated circuit (IC) technology and split manufacturing for obfuscation[C]// The Usenix Security Symposium. 2013.
[42]	VAIDYANATHAN K , DAS B P , SUMBUL E ,et al. Building trusted ICs using split fabrication[C]// IEEE International Symposium on Hardware-Oriented Security and Trust. 2014: 1-6.
[43]	XIAO K , FORTE D , TEHRANIPOOR M M . Efficient and secure split manufacturing via obfuscated built-in self-authentication[C]// The 2015 IEEE International Symposium on Hardware Oriented Security and Trust (HOST’15). 2015: 14-19.
[44]	BHUNIA S,ABRAMOVICI M , AGRAWAL D , et a1 . Protection against hardware Trojan attacks:towards a comprehensive solution[J]. IEEE Design & Test, 2013(3): 6-17.
[45]	SALMANI H , TEHRANIPOOR M , PLUSQUELLIC J . A novel technique for improving hardware Trojan detection and reducing trojan activation time[C]// IEEE Transactions on Very Large Scale Integration (VLSI) Systems. 2012: 112-125.
[46]	SALMANI H , TEHRANIPOOR M , PLUSQUELLIC J . A layout-aware approach for improving localized switching to detect hardware Trojans in integrated circuits[C]// 2010 IEEE International Workshop on Information Forensics and Security(WIFS 2010). 2010.
[47]	石朝阳, 邹雪城, 明瑞华 ,等. 一种基于密钥的硬件木马预防方法研究[J]. 现代电子技术, 2016,39(20).
	SHI Z Y , ZOU X C , MING R H ,et a1. Hardware Trojan prevention method based on secret key[J]. Modern Electronics Technique, 2016,39(20).
[48]	曾辰熙, 吴泉源, 李爱平 ,等. 基于模糊层次分析的木马攻击效果评估技术研究[J]. 网络与信息安全学报, 2016,2(7): 49-58.
	ZENG C X , WU Q Y , LI A ,et al. Research on FAHP based Trojan attack effect evaluation[J]. Chinese Journal of Network and Information Security, 2016,2(7): 49-58.

检测方法	优势	缺陷
逆向工程	能够获得金片，精确度较高（不含木马的芯片）	耗时、流程复杂、对原电路有破坏性
物理检测	原理简单、能够获得金片	不适用于结构复杂的芯片，对原电路有破坏性
反向解剖	检验方式彻底，正检率高	采集芯片版图工艺复杂，时间代价高，对原电路有破坏性
旁路分析	对大型木马电路有效，测试方法较为简单，对原电路无破坏	受工艺噪声影响，成熟性有待提高
功能测试	对小型木马电路有效，不受工艺噪声影响，易于自动化实现，对原电路无破坏	测试方式较死板，时间代价大

防范技术	优势	缺陷
授信设计	设计灵活，较易实现	工程量大，导致额外时延和功耗
授信分块制造	技术含量高，风险最小化，不改变原来电路构造	难度较大，工艺复杂，制造周期长，涉及多方向加工协作
实时监控与电路和增强	能控制危害伟播，设计方式灵活，能够把握电路实时状态	导致额外时延和功耗，制造成本大