Search

The security of hardware intellectual properties (IPs) has become a significant concern, as the opportunity for piracy, reverse engineering, and malicious modification is increasing. Hardware obfuscation has been studied as a potent method to protect against all these attack vectors. However, most of the existing obfuscation techniques have been successfully compromised, where many inherent functional or structural vulnerabilities in these techniques are utilized to reveal the obfuscation key or retrieve the original design. In this paper, we introduce LeGO, a learning-guided obfuscation framework that overcomes known vulnerabilities in a scalable and systematic manner, leading to a robust and lightweight locking mechanism. The proposed framework is guided by our security evaluation process that performs a thorough assessment of an obfuscated IP against various attacks and identifies the vulnerabilities. It then judiciously selects and applies a set of design modification steps or rules that can eliminate these vulnerabilities. Such a rule-based obfuscation process has the distinctive capability to address all existing as well as emerging attacks through the learning of appropriate design transformation steps that prevent these attacks. We present an efficient strategy to apply these rules on a design, while resolving any conflict. Our evaluation of the LeGO framework on a set of ISCAS85 and open-source IP benchmarks has shown promising results in terms of robustness against diverse attacks with an average of area, power and delay overhead of 39%, 45%, and 15%, respectively.

The emerging security threats in the integrated circuit supply chain do not only challenge the chip integrity, but also raise serious concerns on hardware intellectual property (IP) piracy. Hardware design obfuscation is a promising countermeasure to resist reverse engineering attacks and IP piracy. The majority of existing hardware obfuscation methods modify the original finite state machine (FSM) by adding additional state transitions and utilizing a key sequence to lock the transition from the nonfunctional states to the functional reset state. Those methods are effective to prevent attackers from entering the normal functional mode but they lack resilience if the FSM is already in the normal mode. This paper proposes to protect all the states with a low-cost state-deflection-based obfuscation method, which dynamically deflects state transitions from the original transition path to a black hole cluster if a wrong key is applied. Unlike other works that use static transitions between legal states to black hole states at the design time, this method utilizes a state rotation function (Rotatefunc) and selective register flipping function (Mapfunc) to dynamically control the state deflection paths. Hence, the difficulty of reverse engineering and thwarting register overwrite attacks is increased. Simulations performed on ISCAS’89 benchmark circuits show that the proposed method significantly reduces the difference of the net toggle activities between the correct and wrong key scenarios, and achieves up to 56% higher code coverage than the most efficient obfuscation method. Thanks to the dynamic deflection feature, on average, this method generates about 100 more unique state register patterns than other methods with moderate power increase. Moreover, the proposed method achieves the Hamming distance of primary outputs and state registers close to 50%.

Due to globalization of integrated circuit (IC) design flow, rogue elements in the supply chain can pirate ICs, overbuild ICs, and insert hardware Trojans. EPIC locks the design by randomly inserting additional gates; only a correct key makes the design to produce correct outputs. We demonstrate that an attacker can decipher the locked netlist, in a time linear to the number of keys, by sensitizing the key-bits to the output. We then develop techniques to fix this vulnerability and make an attacker’s effort truly exponential in the number of inserted keys. We introduce a new security metric and a method to deliver strong logic locking.

The increasing IC manufacturing cost encourages a business model where design houses outsource IC fabrication to remote foundries. Despite cost savings, this model exposes design houses to IC piracy as remote foundries can manufacture in excess to sell on the black market. Recent efforts in digital hardware security aim to thwart piracy by using XOR-based chip locking, cryptography, and active metering. To counter direct attacks and lower the exposure of unlocked circuits to the foundry, we introduce a multiplexor-based locking strategy that preserves test response allowing IC testing by an untrusted party before activation. We demonstrate a simple yet effective attack against a locked circuit that does not preserve test response, and validate the effectiveness of our locking strategy on IWLS 2005 benchmarks.

Hardware intellectual-property (IP) cores have emerged as an integral part of modern system-on-chip (SoC) designs. However, IP vendors are facing major challenges to protect hardware IPs from IP piracy. This paper proposes a novel design methodology for hardware IP protection using netlist-level obfuscation. The proposed methodology can be integrated in the SoC design and manufacturing flow to simultaneously obfuscate and authenticate the design. Simulation results for a set of ISCAS-89 benchmark circuits and the advanced-encryption-standard IP core show that high levels of security can be achieved at less than 5% area and power overhead under delay constraint.

Growing reverse-engineering attempts to steal or violate a design intellectual property (IP), or to identify the device technology in order to counterfeit integrated circuits (ICs), raise serious concerns in the IC design community. As the information derived from these practices can be used in a number of malicious ways, various active techniques have been proposed and deployed to protect IP, of which logic locking is a vital part. It allows inserting certain gates in a circuit’s data path to lock outputs to fixed logic values, if a wrong unlocking key is applied. This paper demonstrates that test points—industry-proven design-for-test technology used primarily to enhance the overall design testability–can also be reused in the mission mode to lock the circuit, and thus to improve the hardware security against IP piracy. In particular, it is shown that test points can facilitate the hiding of design functionality from adversaries. As a result, not only is the overall design testability improved, but also effective protection against piracy through unauthorized excess production and other forms of IP theft is ensured. Experimental results on industrial designs with test points demonstrate that the proposed scheme is effective in achieving a desired degree of hardware obfuscation.