Novel protection against hardware trojan horses Malware, viruses and other cyber-menaces typically target software. But equally dangerous – and growing – are the so-called trojan horses, that infect and physically manipulate computer hardware. The EU-funded project HINT has explored protective and detective technologies to keep computer systems free of these threats. Digital Economy © Shutterstock Trojan horses targeting computer hardware can take several forms, either as a physical alteration of original computer parts, a swap of counterfeited components into a computer system or hidden functions that manipulate the security features embedded in critical processing devices – particularly integrated circuits (IC) – in order to hijack, control or spy on their information. These hardware trojan horses have been around for the past dozen years, though the computer manufacturing industry has traditionally been reluctant to talk about this because of fear of reputational damage. Countering hardware trojan horses was the main goal of the HINT project, whose research focused on developing ‘integrity checking’ of computer parts based on trusted computing technologies. After a 36-month, 5.1-million effort co-funded by the EU that ended in September 2015, HINT participants are now working on commercialising the project’s technologies. “This could save vast amounts of verification time and money”, says Jacques Fournier, a researcher in embedded systems’ security at CEA, French Atomic Energy Commission, one of the project’s seven research consortium partners. ‘With the fast evolution of products and the complexity of the IC chain, there are now so many different many actors in so many different locations that it is difficult to satisfy the trust of your supply chain,” said Mr. Fournier. “When it comes to niche markets you might be able to do that, but not for the large market where just-in-time delivery is imperative.’ Key to HINT was its research into ‘physically unclonable functions’ (PUFs) as a way to measure the unique characteristics, or fingerprint, of an IC and thus its security. The idea is knows since 10-15 years but its commercialisation has been slow due to the plethora of technical issues that have to be addressed such as an IC’s process variations, its sensitivity to temperature, aging, etc., all of which can alter its fingerprint. HINT’s innovation was to devise a PUF that addresses all of these, especially the aging function of an IC. It also developed a way to measure the malicious modification of a circuit as well as other tools. According to Mr. Fournier, HINT was one of the first projects to produce tangible results in the area of IC aging and is now at a technology readiness level (TRL) of 3-4, with more tests planned to bring this level even higher. ‘For example, we’ve done a proof-of-concept for the integrity verification of programmable ICs and here we’re at a TRL of 5-6. The next step will be a security proof-of-concept for other kinds of ICs such as application-specific integrated circuits. Once done, then we can go to classical chip manufacturers and promote it to them,’ said Mr. Fournier. ‘Chip makers are very interested in this because the classical verification processes they currently have in place for smart cards are very costly.’ Keywords HINT, cyber security, Trojan horse, hardware, threat, embedded systems, integrity, integrated circuits
