Hardware Trojan with enhanced concealment in network-on-chip and attack method
By designing a concealment enhancement hardware Trojan for on-chip networks, and using tampering with data packets to implement black hole and deep pit attacks, the problem of difficult to prevent hardware Trojan attacks in the existing technology is solved, and efficient concealment enhancement and attack effects on on-chip networks are achieved.
Patent Information
- Application Number
- CN202510339140.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-21
- Publication Date
- 2025-04-25
AI Technical Summary
The prior art is difficult to effectively solve the security challenges in on-chip networks, especially when facing hardware Trojan attacks, and it is difficult to prevent information leakage and increased network latency caused by black hole and deep pit attacks.
Design a concealment-enhanced hardware Trojan for on-chip networks, implement black hole and deep pit attacks by tampering with data packets, use trigger modules, black hole function modules and configuration modules to implement attacks, and add configuration modules so that attackers can control hardware Trojans when the chip is running.
It has achieved enhanced concealment of on-chip networks, and can efficiently conduct black hole and deep pit attacks, causing packet loss or information leakage. Due to the addition of configuration modules, hardware Trojans are more concealed and efficient.
Smart Images
Figure CN119885167A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of integrated circuits, and in particular relates to a hardware Trojan with enhanced concealment in an on-chip network and an attack method. Background Art
[0002] With the increasing demand for high-performance computing and parallel processing, many-core systems have become core components in systems such as data centers and servers. Many-core systems are systems that have many cores in a single chip, and each core works together through an on-chip communication module to provide multi-program parallelism and high-performance computing capabilities. In order to meet the information security requirements of systems such as data centers and servers, the security and reliability of the on-chip system needs to be guaranteed at the hardware level. However, in today's on-chip systems, security has become a very critical challenge.
[0003] Hardware Trojans are usually designed to attack different components on a chip. One of the mainstream attacks is against the on-chip network in the chip. Boraten et al. proposed a side channel attack launched by an on-chip network Trojan, which can steal sensitive information in the on-chip network by continuously injecting false information. Ancajas et al. proposed a hidden threat model when the on-chip system uses a third-party on-chip network. The attack selects nodes where traffic converges as victim nodes and then the controller rejects any resource requests, thereby drastically increasing network latency. Ganguly et al. and Fang et al. both proposed a flooding attack in a wireless on-chip network, which injects a large number of junk data packets into high-bandwidth nodes in the network, thereby blocking the output virtual channels of network nodes at all levels, and ultimately causing widespread bandwidth loss. Boratend et al. cleverly used the error correction mechanism of the on-chip network, and caused the error correction mechanism to retransmit continuously by continuously injecting errors, resulting in a shortage of resources such as bandwidth and buffers in the network.
[0004] Black hole and deep pit attack denial of service attacks are two very serious Trojan attacks in sensor networks. In a black hole attack, the malicious node will stop forwarding the data of the surrounding nodes, causing a large number of data packets to disappear. Such malicious nodes are called black hole nodes or black hole areas. In a deep pit attack, the traffic in the network will be attracted to the malicious node, thereby triggering other types of attacks (such as black hole attacks or selective forwarding) to attack these traffic. Summary of the invention
[0005] The purpose of the present invention is to provide a hardware Trojan with enhanced concealment in an on-chip network and its CDR, wherein the hardware Trojan implements a black hole attack by tampering with data packets, thereby causing packet loss or information leakage in the on-chip network.
[0006] In order to solve the above technical problems, the present invention provides a hardware Trojan with enhanced concealment in an on-chip network, comprising: The main body includes a trigger module, a black hole function module and a configuration module; the trigger module is used to monitor the data flow in real time and activate the hardware Trojan; the black hole function module is used to implement a black hole attack, which includes modifying the destination field in the data packet; the configuration module is used to receive parameters transmitted by the attacker, and update the parameters to the storage unit of the hardware Trojan, and input the parameters to the trigger module and the black hole function module; A deep pit generator, comprising a deep pit function module; the deep pit function module is activated by the trigger module to implement a deep pit attack, wherein the deep pit attack includes updating a trusted Credit signal; The hardware Trojan includes: comparator 1, comparator 2, configuration register 1, configuration register 2, configuration register 3, configuration register 4, configuration register 5, AND gate 1, AND gate 2, multiplexer 1, multiplexer 2 and multiplexer 3.
[0007] Preferably, the specific connection structure of the hardware Trojan includes: the two input ends of the comparator one are respectively connected to the hardware Trojan built-in command cmd parameter and the bit where the configuration command cmd of the configuration data packet is located, and the output result of the comparator one is used as the control end signal of the configuration register one, configuration register two, configuration register three, configuration register four and configuration register five in turn; the data input ends of the configuration register one, configuration register two, configuration register three, configuration register four and configuration register five are connected to the bit where the trigger mode, attack mode, activation bit, attack target ID and malicious node ID of the configuration data packet are located in turn; the output end of the configuration register one is connected to the control end of the multiplexer one; the output end bit0 of the configuration register two is connected to the input end two of the AND gate one, and the output end bit1 is connected to the input end two of the AND gate two; the output end of the configuration register three is connected to the output end of the multiplexer one The output end of the configuration register 4 is connected to the input end 1 of the comparator 2; the input end 2 of the comparator 2 is connected to the bit where the target address of the data packet is located, and the output end of the comparator 2 is connected to the input end 2 of the multiplexer 1; the output end of the configuration register 5 is connected to the input end 1 of the multiplexer 2; the input end 2 of the multiplexer 2 is connected to the bit where the target address of the data packet is located; the input end 1 of the AND gate 1 and the AND gate 2 is connected to the output end of the multiplexer 1 and outputs an activation signal; the output end of the AND gate 1 is connected to the control end of the multiplexer 2; the output end of the multiplexer 2 outputs the black hole attack result; the output end of the AND gate 2 is connected to the control end of the multiplexer 3; the two input ends of the multiplexer 3 are respectively connected to the fixed value built into the hardware Trojan and the original trusted Credit parameter, and the output end of the multiplexer 3 outputs the deep pit attack result.
[0008] Preferably, the configuration module stores parameter data transmitted by the configuration data packet through configuration registers one to five, and the parameter data includes trigger mode, attack mode, activation bit, attack target ID and malicious node ID. The cmd parameter of the configuration package is verified by comparator one. If a specific bit of the data packet is equal to the cmd parameter built into the hardware Trojan, it indicates that the data packet is a configuration data packet, and the hardware Trojan will read other data after the configuration cmd parameter and store it in the configuration register.
[0009] Preferably, the trigger module generates an activation signal through a multiplexer 1. According to different trigger modes, the trigger module selects different inputs as activation signals. The hardware Trojan includes four trigger modes, namely, sleep mode, continuous attack mode, specific attack mode and configuration package activation mode.
[0010] Preferably, the black hole function module and the deep pit function module generate black hole attack results and deep pit attack results respectively through multiplexer 2 and multiplexer 3, and select to output original data or tampered data according to the different values in the activation signal and the attack mode. Only when the corresponding values in the activation signal and the attack mode are true, the black hole function module or the deep pit function module will launch an attack and tamper the data to a set value; otherwise, the original data will remain unchanged.
[0011] The present invention also provides a method for attacking a hardware Trojan horse with enhanced concealment in a network on chip, using the hardware Trojan horse with enhanced concealment in a network on chip as described above, comprising: When the hardware Trojan is ready, it will monitor the data packets passing through the malicious router where the hardware Trojan is located in real time; When the attacker needs to configure or activate the hardware Trojan, he sends a configuration data packet to the malicious router. If the hardware Trojan recognizes the data packet as a configuration data packet, it updates the parameter data of the configuration data packet to the configuration register of the hardware Trojan. If the hardware Trojan recognizes the data packet as a normal data packet, the trigger module is started to generate an activation signal according to the set activation mode; If the activation signal is false, it means that the hardware Trojan should not attack the data packet, so the data packet will not be modified and the next data packet will continue to be monitored; If the activation signal is true, the corresponding attack module is started according to the set attack mode, including launching a black hole attack or a deep pit attack.
[0012] Compared with the prior art, the present invention has the following beneficial effects: The hardware Trojan of the present invention needs to be inserted into the router structure of the on-chip network by untrusted staff during the design or production process of the chip, and the black hole and deep pit attacks are realized by monitoring and modifying the data of the data packets passing through the router nodes. Functionally, the hardware Trojan can tamper with important data in the on-chip network data packets, causing the data packets to be forwarded to the malicious nodes controlled by the attacker, while the original destination cannot receive the data packets. In terms of performance, the hardware Trojan is highly concealed, and it is difficult to detect the hidden hardware Trojan without the activation of the attacker. In terms of structural composition, compared with the typical hardware Trojan of trigger module plus functional module, the proposed hardware Trojan adds a configuration module, which enables the attacker to control the hardware Trojan when the chip is operating, and enables the attacker to make the hardware Trojan more concealed or improve the attack effect of the Trojan by modifying the hardware Trojan parameters, posing a serious threat to the on-chip network. BRIEF DESCRIPTION OF THE DRAWINGS
[0013] Figure 1 It is a schematic diagram of the process and specific position of inserting the hardware Trojan into a router of the present invention.
[0014] Figure 2 It is a schematic diagram of the composition structure of the hardware Trojan of the present invention.
[0015] Figure 3 It is a specific circuit diagram of the hardware Trojan of the present invention.
[0016] Figure 4 It is an attack flow chart of the hardware Trojan with enhanced concealment of the present invention. DETAILED DESCRIPTION
[0017] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The advantages and features of the present invention will become more apparent from the following description. It should be noted that the accompanying drawings are in very simplified form and in non-precise proportions, and are only used to conveniently and clearly assist in explaining the purpose of the embodiments of the present invention.
[0018] The present invention is an on-chip network architecture for a typical multi-core system, where each node includes a processor, an L1 cache, an L2 cache, and a router. Each node is connected to each other through a router. When a node needs to send data to another node, the data is encapsulated as a data packet and injected into the router, and then transmitted in the on-chip network and reaches the destination router, and finally the destination router forwards the data packet to the processor for data processing. Figure 1 The left half shows the structure of a typical on-chip network router. The router is mainly composed of five pipeline units, including input buffers, route computation units, virtual channel arbitrators (VC Allocator), crossbar switch arbitrators (Switch Allocator), and crossbar switches. After the data packet enters the router, it is stored in the input buffer. Then the router obtains the output result after route computation, virtual channel arbitration, and crossbar switch arbitration. The data packet is forwarded to the corresponding output port through the crossbar switch and finally reaches the next router connected to the port.
[0019] The hardware Trojan horse proposed by the present invention needs to be inserted into the router structure of the on-chip network by untrusted staff during the design or production process of the chip. Figure 1 It shows the process and specific location of inserting hardware Trojans into routers. Figure 1In the figure, the router structure on the left is a typical credit-based virtual channel router, in which the Credit signal input to the virtual channel arbiter (VC allocator) is the credit information sent by the surrounding routers directly connected to the router, indicating the size of its free buffer. The Credit signal sent by the router indicates the size of the free buffer of the router. This signal is generally used in adaptive routing algorithms. When the router calculates the exit, it selects the router with a larger free buffer as the result. Normal data packets are input from the input port and stored in the input buffer. After the router calculates the output result, the data packet is forwarded to the next router after the corresponding exit. Based on the working principle of the router, the attacker inserts the hardware Trojan into the appropriate position, enabling it to launch a built-in Trojan attack. Figure 1 The right half shows the specific location where the hardware Trojan is inserted into the router. The part marked with "M" is the main part of the Trojan, which is inserted between the input port and the input buffer; and the part marked with "S" is the deep pit generator, which is inserted between the virtual channel arbitrator and the Credit signal output port. The main part of the Trojan is the main functional module of the hardware Trojan, integrating most of the functions of the hardware Trojan, including triggering, configuration, and black hole attack; and the main function of the deep pit generator is to implement deep pit attacks.
[0020] like Figure 2 As shown, an embodiment of the present invention proposes a hardware Trojan with enhanced concealment in an on-chip network. The Trojan consists of two parts: a main body and a deep pit generator. The main body integrates the trigger module, black hole function module and configuration module of the Trojan; the deep pit generator integrates the deep pit function module of the Trojan. The trigger module is used to activate the hardware Trojan, which determines when and under what conditions the Trojan will be activated. The trigger monitors the passing data stream in real time, and once the conditions are met, it will activate the black hole module, the deep pit module or the configuration module. The function of the configuration module is to receive the parameters transmitted by the attacker and update the parameters in the storage unit of the Trojan. These parameters will be used as important inputs in the trigger module, the black hole module and the deep pit module. The black hole module is used to implement the black hole attack, and its main task is to modify the destination field in the data packet. The function of the deep pit module is to implement the deep pit attack, and its main task is to update the trusted Credit signal. The deep pit module of the deep pit generator is activated by the trigger module of the main body, so no additional trigger module is required.
[0021] like Figure 3As shown, the specific circuit of the hardware Trojan in the embodiment of the present invention includes: comparator 1, comparator 2, configuration register 1, configuration register 2, configuration register 3, configuration register 4, configuration register 5, AND gate 1, AND gate 2, multiplexer 1, multiplexer 2 and multiplexer 3; Among them, the two input ends of the comparator one are respectively connected to the bits where the cmd parameters of the hardware Trojan built-in command and the configuration command cmd of the configuration data packet are located, and the output result of the comparator one is used as the control end signal of the configuration register one, configuration register two, configuration register three, configuration register four and configuration register five in turn; the data input ends of the configuration register one, configuration register two, configuration register three, configuration register four and configuration register five are connected to the bits where the trigger mode, attack mode, activation bit, attack target ID and malicious node ID of the configuration data packet are located in turn; the output end of the configuration register one is connected to the control end of the multiplexer one; the output end bit0 of the configuration register two is connected to the input end two of the AND gate one, and the output end bit1 is connected to the input end two of the AND gate two; the output end of the configuration register three is connected to the input end one of the multiplexer one; the configuration The output end of the configuration register 4 is connected to the input end 1 of the comparator 2; the input end 2 of the comparator 2 is connected to the bit where the target address of the data packet is located, and the output end of the comparator 2 is connected to the input end 2 of the multiplexer 1; the output end of the configuration register 5 is connected to the input end 1 of the multiplexer 2; the input end 2 of the multiplexer 2 is connected to the bit where the target address of the data packet is located; the input end 1 of the AND gate 1 and the AND gate 2 is connected to the output end of the multiplexer 1 and outputs an activation signal; the output end of the AND gate 1 is connected to the control end of the multiplexer 2; the output end of the multiplexer 2 outputs the black hole attack result; the output end of the AND gate 2 is connected to the control end of the multiplexer 3; the two input ends of the multiplexer 3 are respectively connected to the fixed value built into the hardware Trojan and the original trusted Credit parameter, and the output end of the multiplexer 3 outputs the deep pit attack result.
[0022] First, the configuration module stores the parameter data transmitted by the configuration data packet by setting different configuration registers, including trigger mode, attack mode, activation bit, attack target ID, and malicious node ID. Figure 3 The comparator marked as ① (target comparator) is used to verify the cmd parameter of the configuration packet. Once the specific bit of the data packet is equal to the cmd parameter built into the hardware Trojan, it indicates that the data packet is a configuration data packet. The hardware Trojan will read the subsequent data and store it in the configuration register. Figure 3 The comparator marked as ② in the figure is used to compare whether the destination field of the normal data packet is equal to the attack target ID field of the configuration storage. Figure 3The multiplexer marked as ③ in the figure is used to generate the activation signal for the trigger module. Depending on the trigger mode, the trigger module selects different inputs as the activation signal. This hardware Trojan has four main trigger modes, namely, sleep mode, continuous attack mode, specific attack mode, and configuration package activation mode. Table 1 shows the descriptions of the four modes and the corresponding binary address codes.
[0023] Table 1
[0024] Figure 3 The multiplexers marked as ④ and ⑤ in the figure are used to generate black hole attack results and deep pit attack results respectively. The attack module chooses to output the original data or the tampered data according to the values of the activation signal and the attack mode. Table 2 shows the corresponding output results of the attack module under different conditions. Only when the corresponding values in the activation signal and the attack mode are true, the attack module will launch an attack and tamper the data to the set value; otherwise, the original data remains unchanged.
[0025] Table 2
[0026] Hardware Trojans can be controlled by attackers and selectively attack. By adding configuration modules to hardware Trojans, some parameters of the hardware Trojans can be controlled by attackers. Attackers can modify the hardware Trojan parameters to make the hardware Trojans more concealed or improve the attack effect of the Trojans. On the one hand, attackers can put the Trojans into hibernation under high-risk conditions, and if the detection party does not understand the format of the configuration data packet, it is difficult to activate and detect the dormant Trojans; on the other hand, the Trojans can be set to a specific attack mode to attack only some specific data packets. In this case, some similar packet detection methods and similar destination detection methods will not work.
[0027] Once the attacker wants to launch a Trojan attack, he will run a malicious program in the multi-core system to launch a configuration packet. First, the attacker requests the service of the multi-core system as a consumer, and then runs the disguised malicious program in the multi-core system to obtain the information of the multi-core system and send the configuration packet. In order for the hardware Trojan to receive the configuration packet, the attacker needs to locate the node where the hardware Trojan is located. In one case, when the multi-core system uses the Message Passing Interface (MPI) as the communication protocol for each core, the attacker can easily obtain the ID of a specific node. In fact, MPI is the main communication model for most current high-performance computing machines. In addition, we provide another method that uses reverse engineering technology to parse the cache address to infer the node ID. Once the node ID, the topology of the on-chip network and the routing algorithm are known, the attacker can accurately locate the hardware Trojan. After locating the hardware Trojan, the malicious program sends a configuration packet to the malicious node containing the hardware Trojan. A configuration packet contains the following fields: 1) Configuration cmd field. A specific sequence of fields is used to indicate the identity of the configuration data packet. Only when this field is equal to the built-in cmd field of the hardware Trojan will the data packet be identified as a configuration data packet and the configuration will be updated.
[0028] 2) Trigger mode field. This field is used to determine how the Trojan uses to activate the Trojan. Two binary codes are used to represent four modes: sleep mode, continuous attack mode, specific attack mode, and configuration package activation mode. The sending address codes are 00, 01, 10, and 11 respectively.
[0029] 3) Attack mode field. This field is used to determine what type of attack the Trojan launches. It uses two binary codes to control black hole and deep pit attacks respectively. Bit 0 controls whether the black hole attack is started or not; bit 1 controls whether the deep pit attack is started or not.
[0030] 4) Activation bit field: This field is used to configure whether the Trojan is activated in the package activation mode. It uses a binary code, 0 means the Trojan is not activated, and 1 means the Trojan is activated.
[0031] 5) Attack target ID field. This field is used to set the attack target in a specific attack mode. When the destination field of the intercepted normal data packet is the same as the attack target ID field, it indicates that it is the attack target and the Trojan is activated to launch the attack; otherwise, the Trojan is not activated.
[0032] 6) Malicious node ID field. This field is used to replace the original destination field in the data packet when launching a black hole attack, so that the data packet is forwarded to the malicious node controlled by the attacker. If this field is set to an invalid value, the router will directly discard the data packet.
[0033] The hardware Trojan in each malicious router monitors the passing data packets in real time. Once a data packet is verified as a configuration data packet, the hardware Trojan will read the other fields after the configuration cmd field and update them in the corresponding configuration register. At this point, the attacker has completed the configuration of the hardware Trojan. Once the hardware Trojan is configured, it is ready to attack the passing data packets at any time. When a data packet passes through the hardware Trojan, the trigger module of the Trojan generates an activation signal according to the trigger mode. Once the activation signal is true, the functional module of the Trojan starts working and chooses to launch a black hole attack or a deep pit attack according to the attack mode. In a black hole attack, the original destination of the data packet is replaced with the malicious node ID; in a deep pit attack, the Credit parameter (the size of the free buffer of the router) output by the malicious router is tampered with to a larger value, thereby attracting the data packets of the surrounding routers to be forwarded to the malicious router.
[0034] like Figure 4 The figure shows the hardware Trojan attack workflow of the present invention, which specifically includes: after the hardware Trojan is ready, it will monitor the data packets passing through the malicious router where the Trojan is located in real time. Once the attacker needs to configure or activate the hardware Trojan, a configuration data packet will be sent to the malicious router. If the Trojan recognizes that the data packet is a configuration data packet, the parameter data of the configuration data packet will be updated to the configuration memory of the Trojan; if the Trojan recognizes that the data packet is a normal data packet, the trigger module will be started to generate an activation signal according to the set activation mode. If the activation signal is false, indicating that the Trojan should not attack the data packet, no modification will be made to the data packet, and the next data packet will continue to be monitored; if the activation signal is true, the corresponding attack module will be started according to the set attack mode to launch a black hole attack or a deep pit attack.
[0035] The above description is only a description of the preferred embodiments of the present invention, and is not intended to limit the scope of the present invention. Any changes or modifications made by a person skilled in the art in the field of the present invention based on the above disclosure shall fall within the scope of protection of the claims.
Claims
1. A hardware Trojan with enhanced concealment in a network-on-chip, characterized in that: include: The main body includes a trigger module, a black hole function module and a configuration module; the trigger module is used to monitor the data flow in real time and activate the hardware Trojan; the black hole function module is used to implement a black hole attack, which includes modifying the destination field in the data packet; the configuration module is used to receive parameters transmitted by the attacker, and update the parameters to the storage unit of the hardware Trojan, and input the parameters to the trigger module and the black hole function module; A deep pit generator, comprising a deep pit function module; the deep pit function module is activated by the trigger module to implement a deep pit attack, wherein the deep pit attack includes updating a trusted Credit signal; The hardware Trojan includes: comparator 1, comparator 2, configuration register 1, configuration register 2, configuration register 3, configuration register 4, configuration register 5, AND gate 1, AND gate 2, multiplexer 1, multiplexer 2 and multiplexer 3.
2. A hardware Trojan with enhanced concealment in a network on chip as claimed in claim 1, characterized in that: The specific connection structure of the hardware Trojan includes: the two input ends of the comparator 1 are respectively connected to the hardware Trojan built-in command cmd parameter and the bit where the configuration command cmd of the configuration data packet is located, and the output result of the comparator 1 is used as the control end signal of the configuration register 1, configuration register 2, configuration register 3, configuration register 4 and configuration register 5 in turn; the data input ends of the configuration register 1, configuration register 2, configuration register 3, configuration register 4 and configuration register 5 are connected to the bit where the trigger mode, attack mode, activation bit, attack target ID and malicious node ID of the configuration data packet are located in turn; the output end of the configuration register 1 is connected to the control end of the multiplexer 1; the output end bit0 of the configuration register 2 is connected to the input end 2 of the AND gate 1, and the output end bit1 is connected to the input end 2 of the AND gate 2; the output end of the configuration register 3 is connected to the input end of the multiplexer 1 The output end of the configuration register 4 is connected to the input end 1 of the comparator 2; the input end 2 of the comparator 2 is connected to the bit where the target address of the data packet is located, and the output end of the comparator 2 is connected to the input end 2 of the multiplexer 1; the output end of the configuration register 5 is connected to the input end 1 of the multiplexer 2; the input end 2 of the multiplexer 2 is connected to the bit where the target address of the data packet is located; the input end 1 of the AND gate 1 and the AND gate 2 is connected to the output end of the multiplexer 1 and outputs an activation signal; the output end of the AND gate 1 is connected to the control end of the multiplexer 2; the output end of the multiplexer 2 outputs the black hole attack result; the output end of the AND gate 2 is connected to the control end of the multiplexer 3; the two input ends of the multiplexer 3 are respectively connected to the fixed value built into the hardware Trojan and the original trusted Credit parameter, and the output end of the multiplexer 3 outputs the deep pit attack result.
3. A hardware Trojan with enhanced concealment in a network on chip as claimed in claim 2, characterized in that: The configuration module stores parameter data transmitted by the configuration data packet through configuration registers 1 to 5, and the parameter data includes trigger mode, attack mode, activation bit, attack target ID and malicious node ID. The cmd parameter of the configuration packet is verified through comparator 1. If a specific bit of the data packet is equal to the cmd parameter built into the hardware Trojan, it indicates that the data packet is a configuration data packet, and the hardware Trojan will read the other data after the configuration cmd parameter and store it in the configuration register.
4. A hardware Trojan with enhanced concealment in a network on chip as claimed in claim 2, characterized in that: The trigger module generates an activation signal through a multiplexer 1. According to different trigger modes, the trigger module selects different inputs as activation signals. The hardware Trojan includes four trigger modes, namely, sleep mode, continuous attack mode, specific attack mode and configuration package activation mode.
5. A hardware Trojan with enhanced concealment in a network on chip as claimed in claim 2, characterized in that: The black hole function module and the deep pit function module generate black hole attack results and deep pit attack results respectively through multiplexer 2 and multiplexer 3, and select to output original data or tampered data according to the different values in the activation signal and the attack mode. Only when the corresponding values in the activation signal and the attack mode are true, the black hole function module or the deep pit function module will launch an attack and tamper the data to the set value; otherwise, the original data will remain unchanged.
6. A method for attacking a hardware Trojan with enhanced concealment in a network on chip, using a hardware Trojan with enhanced concealment in a network on chip as claimed in any one of claims 1 to 5, characterized in that: include: When the hardware Trojan is ready, it will monitor the data packets passing through the malicious router where the hardware Trojan is located in real time; When the attacker needs to configure or activate the hardware Trojan, he sends a configuration data packet to the malicious router. If the hardware Trojan recognizes the data packet as a configuration data packet, it updates the parameter data of the configuration data packet to the configuration register of the hardware Trojan. If the hardware Trojan recognizes the data packet as a normal data packet, the trigger module is started to generate an activation signal according to the set activation mode; If the activation signal is false, it means that the hardware Trojan should not attack the data packet, so the data packet will not be modified and the next data packet will continue to be monitored; If the activation signal is true, the corresponding attack module is started according to the set attack mode, including launching a black hole attack or a deep pit attack.