Search

Training accurate deep learning (DL) models require large amounts of training data, significant work in labeling the data, considerable computing resources, and substantial domain expertise. In short, they are expensive to develop. Hence, protecting these models, which are valuable storehouses of intellectual properties (IP), against model stealing/cloning attacks is of paramount importance. Today’s mobile processors feature Neural Processing Units (NPUs) to accelerate the execution of DL models. DL models executing on NPUs are vulnerable to hyperparameter extraction via side-channel attacks and model parameter theft via bus monitoring attacks. This paper presents a novel solution to defend against DL IP theft in NPUs during model distribution and deployment/execution via lightweight, keyed model obfuscation scheme. Unauthorized use of such models results in inaccurate classification. In addition, we present an ideal end-to-end deep learning trusted system composed of: 1) model distribution via hardware root-of-trust and public-key cryptography infrastructure (PKI) and 2) model execution via low-latency memory encryption. We demonstrate that our proposed obfuscation solution achieves IP protection objectives without requiring specialized training or sacrificing the model’s accuracy. In addition, the proposed obfuscation mechanism preserves the output class distribution while degrading the model’s accuracy for unauthorized parties, covering any evidence of a hacked model.

Editor’s note : If you are designing or integrating hardware IP blocks into your designs, and you are using common global supply chains, then reading this overview article on how to protect your IP against reverse engineering, piracy, and malicious alteration attacks is a must. The authors give a comprehensive overview of current countermeasures that can be used at RTL, gate-, and layout-level to protect your design with a focus on combinational and sequential logic locking and a discussion on merits, overheads, and shortcomings of such techniques. —Jurgen Teich, FAU Erlangen

Hardware obfuscation is a technique that modifies the circuit to hide the functionality. Obfuscations through algorithmic modifications add protection in addition to circuit-level techniques, and their effects on the data paths can be analyzed and controlled at the architectural level. Many error-correcting coding and cryptography algorithms are based on finite field arithmetic. For the first time, this paper proposes a hardware obfuscation scheme achieved through varying finite field constructions and primitive element representations. Also the variations are effectively transformed to bit permuters controlled by obfuscation keys to achieve high level of security with very small complexity overheads. To illustrate the effectiveness, the proposed scheme is applied to obfuscate Reed-Solomon decoders, which are broadly used in communication and storage systems. For a (255, 239) RS decoder over finite field $GF(256)$GF(256), the proposed scheme achieves 1239 bits of independent obfuscation key with 4.4 percent area overhead, while yielding no penalty on the throughput and only one extra clock cycle of latency.

At different stages of the Integrated Circuit (IC) lifecycle there are attacks which threaten to compromise the integrity of the design through piracy, reverse engineering, hardware Trojan insertion, side channel analysis, and other physical attacks. Some of the most notable challenges in this field deal specifically with Intellectual Property (IP) theft and reverse engineering attacks. One method by which some of these concerns can be addressed is by introducing hardware obfuscation to the design in various forms. In this work we evaluate the effectiveness of a few different forms of netlist-level hardware obfuscation of a 16-bit substitution box component of a customizable cipher MK-3. These obfuscation methods were attacked using a satisfiability (SAT) attack, which is able to iteratively rule out classes of keys at once. This has been shown to be very effective against many forms of hardware obfuscation. A method to successfully defend against this attack is described in this paper. This method introduces a modified SIMON block cipher as a One-way Random Function (ORF) that is used to generate an obfuscation key. The S-box obfuscated using this 32-bit key and a round-reduced implementation of the SIMON cipher is shown to be secure against a SAT attack for at least 5 days.

A clear majority of electronic devices applications used in our daily life require a reliable, secure architecture, e.g., healthcare, social security cards, electronic meters, and smart homes. As a result, many studies are trying to develop appropriate solutions to tackle hardware security threats such as IC piracy, IC overbuilding, reverse engineering, counterfeiting, and tampering. Hardware obfuscation has been introduced as one of the leading robust, low-cost security solutions against different security threats, especially when combined with physical unclonable functions. Considering the inherent irreproducibility of PUFs, this method can provide a high-level security system. However, finding an applicable existent PUF or implementing a new PUF design that meets each hardware obfuscation requirements is not a trivial task. This study reviews and discusses hardware security systems based on PUFs inherited variations and the corresponding hardware obfuscation approaches.

The horizontal business model adopted by the semiconductor industry has resulted in a manufacturing process that has integrated various foreign entities focusing on individual production steps. However, serious trust issues have emerged with the internationalization of the semiconductor supply chain, and the trust concerns grow further with the proliferation of theft, reverse engineering (RE), and piracy of hardware intellectual property (IP). Unlike the software industry, the semiconductor supply chain cannot benefit from traditional cryptographic solutions due to the requirement of white-box accessibility to the hardware IP. Therefore, hardware obfuscation has originated as a potential countermeasure against dreaded supply chain attacks. The obfuscation process aims to hide the design intent and lock functionality by introducing structural and functional transformations to the IP, which increases the resistance against unauthorized use and potential exploitation of the design by an adversary. In this chapter, we investigate hardware obfuscation techniques that have been developed in the past decade and the limitations and challenges of these techniques. In particular, we explore the evolution of different techniques that are applicable at various supply chain stages of the semiconductor life cycle, the development of obfuscation benchmarks, and the research trends in the area of obfuscation. We also expand on the innovative attacks that have been developed to compromise the obfuscation techniques, as well as the countermeasures that are introduced to combat them. This chapter also sheds light on the lessons learned from the decade-long research on obfuscation by discussing the attack trends and unsolved challenges. Finally, we conclude by presenting a road map that aims to improve the existing solutions and provides improved security metrics for systematic evaluation.

Obfuscation is a promising solution for securing hardware intellectual property (IP) against various attacks, such as reverse engineering, piracy, and tampering. Due to the lack of standard benchmarks, proposed techniques by researchers and practitioners in the community are evaluated by existing benchmark suites such as ISCAS-85, ISCAS-89, and ITC-99. These open source benchmarks, though widely utilized, are not necessarily suitable for the purpose of evaluating hardware obfuscation techniques. In this context, we believe that it is important to establish a set of well-defined benchmarks, on which the effectiveness of new and existing obfuscation techniques and attacks on them can be compared. In this paper, we describe a set of such benchmarks obfuscated with some popular methods that we created to facilitate this need. These benchmarks have been made publicly available on Trust-Hub web portal. Moreover, we provide the first evaluation of several obfuscation approaches based on the metrics and existing attacks using this new suite. Finally, we discuss our observations and guidance for future work in hardware obfuscation and benchmarking.

It is important to protect the intellectual properties of logic circuits from reverse engineering. One of the countermeasures is logic obfuscation, which complicates the internal structures of logic circuits to prevent reverse engineering. A few researches have been conducted to simplify logic obfuscation using software obfuscation tools and high-level synthesis. However, it is not quantitatively evident whether the generated circuits are more complex than plain circuits. This paper discusses the three metrics of obfuscated netlists to evaluate the obfuscation methods proposed in previous studies. We confirmed that the obfuscated circuits are actually more complex than the original circuits using the proposed metrics.

There is a great variety of hardware Trojan detection and prevention approaches. However, state of art approaches cannot provide a full guarantee that an integrated circuit or complex electronic system is free of hardware Trojan. We introduced a reference monitor obfuscation approach on the base of formal transformations of structural system models. The approach ensures development of secure systems, operating in the presence of hardware Trojans. The reference monitor obfuscation ensures the main key reference monitor properties: must be non-bypassable and tamper-proof. This concept can be used as a prevention countermeasure against hardware Trojans at the following steps of development cycle of integrated circuit on the FPGA platform: prevention at design, prevention at fabrication, and prevention at post-fabrication. The paper demonstrates an implementation of reference monitor obfuscation approach by physical modeling on FPGA-based systems.

Intellectual property (IP) piracy and electronic counterfeiting have emerged as critical threats to the semiconductor industry in the current horizontal business model where the supply chain usually involves a large number of vendors. Hence, techniques that can protect integrated circuit (IC) against reverse engineering are demanded, especially for security-critical tasks. Hardware obfuscation is a broad category of techniques that could create ambiguity to the adversary by hiding the actual information from illegitimate users. This paper presents a novel hardware obfuscation design through reconfigurable finite field arithmetic units, which can be employed in various error correction and cryptographic algorithms. The effectiveness and efficiency of the proposed methods are verified by an obfuscated reformulated inversion-less Berlekamp-Massey (RiBM) Reed-Solomon decoder. Our experimental results show the hardware implementation of RiBM based Reed-Solomon decoder built using reconfigurable field multiplier designs. The proposed design provides only very low overhead.

To protect intellectual property, hardware obfuscation is necessary to conceal the implemented function. Besides logic-level approaches, hardware obfuscation can be done through algorithmic modifications. Prior algorithmic obfuscations address signal processing systems and those with variable data flow. This paper focuses on the obfuscation of systems based on finite field arithmetic, which are broadly adopted in digital communications. Netlists of hardware units with different field constructions are first analyzed to evaluate possible attacks. Taking into account the specifics of the computations in the Advanced Encryption Standard (AES) algorithm, optimized schemes are proposed to efficiently introduce obfuscation keys utilizing the variation of finite field construction. For an example pipelined fully-unrolled AES encryptor, the proposed scheme leads to 480 bits of obfuscation key with 3% area overhead without sacrificing the throughput. The proposed obfuscation method can be also extended to other algorithms involving finite field arithmetic.

The globalization of supply chain makes semiconductor chips susceptible to various security threats. Design obfuscation techniques have been widely investigated to thwart intellectual property (IP) piracy attacks. Key distribution among IP providers, system integration team, and end users remains as a challenging problem. This work proposes an orthogonal obfuscation method, which utilizes an orthogonal matrix to authenticate obfuscation keys, rather than directly examining each activation key. The proposed method hides the keys by using an orthogonal obfuscation algorithm to increasing the key retrieval time, such that the primary keys for IP cores will not be leaked. The simulation results show that the proposed method reduces the key retrieval time by 36.3% over the baseline. The proposed obfuscation methods have been successfully applied to ISCAS'89 benchmark circuits. Experimental results indicate that the orthogonal obfuscation only increases the area by 3.4% and consumes 4.7% more power than the baseline.1

Nowadays, integrated circuits (ICs) security grown as a primary responsibility at every stage of IC supply chain due to the globalized design, fabrication, test, deployment and monitoring of an IC. In this regard, Advanced Encryption Standard (AES) is widely accepted and supported in both the domain, software as well as hardware. To diminish the effect and cause of different threats, researchers identified that the hardware obfuscation based AES is a promising technique and a solution towards piracy and reverse engineering. This paper discusses about the design and simulation of 128-bit AES algorithm using active hardware obfuscation techniques. 128-bit AES is designed and simulated using Xilinx Vivado 2016.2. In this paper simulation results of 128-bit AES algorithm are analyzed with and without obfuscation techniques. Results shows that with obfuscation techniques 128 bit AES algorithm offer higher level of security and implementation flexibility with small area overhead and power overhead. The robustness of proposed algorithm is also analyzed in the form of throughput and efficiency. The authors also presented the power consumption and analyzed the area overhead of proposed algorithm with different xilinx 7 -series FPGAs.

IC piracy is a significant security threat, where malicious manufacturers can produce unauthorized extra chips and/or steal the information of a design through reverse engineering attempts. As a countermeasure, hardware obfuscation schemes usually withhold a part of the design (which thereafter constitutes the "key") by replacing it with configurable modules. Enforcing the configurable module to be filled in with the withheld key information enables a post-manufacturing activation of each authenticate chip, albeit with a a need to state the threat of a leaked common key. To ensure that each chip has a unique key, Physically Unclonable Functions (PUFs) have been proposed to be integrated with hardware obfuscation. Such a paradigm is constrained to use weak PUFs, because, to uniquely set the key (the content of the configurable module) for each chip, the designer needs to fully characterize the PUFs for all the chips. In this paper, we argue that a powerful attacker in the position of a manufacturer can fully characterize all the weak PUFs, and use any leaked key to break the obfuscation framework. This paper proposes a strong PUF-based hardware obfuscation scheme to effectively prevent IC piracy even in the case of a leaked key from some activated chip.

Hardware security is a matter of increasing importance in the modern world. With increasing threats of piracy and theft, it is needed to devise methodologies to mitigate these concerns. Obfuscating the design netlist is a popular method to achieve this to a significant extent. However, full security guarantee is not provided with the encryption approach. Under this scenario, a watermarking method complements the security guarantee by providing claims of IP authorship. In this paper, we present a unified methodology for circuit encryption and watermarking to enhance hardware security. Experiments on several ISCAS’85 benchmark circuits show that the proposed methodology has average 8.2% area overhead and 11.3% power overhead.

3D Integrated Circuit (3D-IC) is an emerging technology that can address many challenging problems threatening the security of the chip by split manufacturing [1]. One of the disadvantages of split manufacturing is the uncertainty in the reliability of the last foundry that is responsible for the complete bonding of tiers. In this work, we present an innovative approach that safeguard the outsourcing of the entire 3D IC manufacturing including the last bonding stage. The proposed technique not only obfuscates the design functionality but immunes the IC against Trojan insertion.

The globalized semiconductor supply chain make integrated circuits (ICs) potentially suffer from diverse security threats. Among different hardware attacks, Trojan horse insertion has emerged as a major security concern. To mitigate the hardware Trojan insertion happened in the late stage of IC supply chain, researchers recognize that hardware obfuscation is a promising technique. This chapter first reviews the state-of-the-art hardware obfuscation methods at different levels, and then summarizes the metrics that can be used to assess the effectiveness of hardware obfuscation. At the end of this chapter, future research directions for hardware obfuscation against Trojan insertion are discussed.

Due to the globalized semiconductor supply chain, integrated circuits suffer from hardware security attacks. Among various attacks, hardware Trojan insertions have emerged as a major security concern. An adversary modifies the original circuit to accomplish the malicious intentions through the hardware Trojan. Hardware obfuscation has been demonstrated as a promising technique to strengthen hardware implementation against hardware Trojan insertion in the late stage of the supply chain. This work reviews the state-of-the-art hardware obfuscation methods, with the special emphasis on the corresponding efforts made for hardware Trojan prevention and detection. Furthermore, we summarize the evaluation metrics utilized in literature to assess the effectiveness of hardware obfuscation methods. Future directions for hardware obfuscation against hardware Trojans are discussed in this work, as well.

In today’s Integrated Circuit (IC) production chains, a designer’s valuable Intellectual Property (IP) is transparent to diverse stakeholders and thus inevitably prone to piracy. To protect against this threat, numerous defenses based on the obfuscation of a circuit’s control path, i.e. Finite State Machine (FSM), have been proposed and are commonly believed to be secure. However, the security of these sequential obfuscation schemes is doubtful since realistic capabilities of reverse engineering and subsequent manipulation are commonly neglected in the security analysis. The contribution of our work is threefold: First, we demonstrate how high-level control path information can be automatically extracted from third-party, gate-level netlists. To this end, we extend state-of-the-art reverse engineering algorithms to deal with Field Programmable Gate Array (FPGA) gate-level netlists equipped with FSM obfuscation. Second, on the basis of realistic reverse engineering capabilities we carefully review the security of state-of-the-art FSM obfuscation schemes. We reveal several generic strategies that bypass allegedly secure FSM obfuscation schemes and we practically demonstrate our attacks for a several of hardware designs, including cryptographic IP cores. Third, we present the design and implementation of Hardware Nanomites, a novel obfuscation scheme based on partial dynamic reconfiguration that generically mitigates existing algorithmic reverse engineering., IACR Transactions on Cryptographic Hardware and Embedded Systems, Volume 2018, Issue 3

In the era of globalized Integrated Circuit (IC) design and manufacturing flow, a rising issue to the silicon industry is various attacks on hardware intellectual property (IP). As a measure to ensure security along the supply chain against IP piracy, tampering and reverse engineering, hardware obfuscation is considered a reliable defense mechanism. Sequential and combinational obfuscations are the primary classes of obfuscation, and multiple methods have been proposed in each type in recent years. This paper presents an overview of obfuscation techniques and a qualitative comparison of the two major types.

While the globalization of the semiconductor production process has accelerated innovation, lowered costs, and reduced time-to-market, it has also created grave trust issues among the different entities involved in the production process. Theft, reverse engineering, and piracy of silicon intellectual property (IP) are the realities that manufacturers and vendors of integrated circuits must face today. In order to combat these threats, obfuscation has emerged as a viable candidate for semiconductor or hardware IP protection. Obfuscation techniques aim at concealing or locking the underlying intellectual property of a semiconductor product, such as IP cores, gate-level designs, or layout, in order to prevent an untrusted party or adversary from reverse engineering and/or exploiting the design. In this chapter, we will review emerging techniques for hardware obfuscation . We will describe the semiconductor supply chain in detail and outline the specific threats associated with each stage in the supply chain. We will also introduce the field of software obfuscation and related concepts that predate hardware obfuscation. Lastly, we will introduce relevant metrics for implementing and evaluating the various hardware obfuscation techniques.

This chapter discusses the fundamental concepts of design and testing and their role in hardware obfuscation. It outlines the traditional design flow of integrated circuits and assesses the vulnerabilities associated with the verification techniques and testing structures that can expose the design details and help reverse-engineer the functionality. A survey of security enhancement schemes has been presented. Furthermore, different classifications of hardware obfuscation have been discussed that cover the associated vulnerabilities of key management in nonvolatile memories (NVMs). The review of nonvolatile memories, emerging technologies and hardware-based cryptographic primitives, physical unclonable functions (PUFs) and true random number generators (TRNGs) and their use in hardware obfuscation techniques has been deliberated.

Reverse engineering (RE) is one of the major security threats to the semiconductor industry due to the involvement of untrustworthy parties in an increasingly globalized chip manufacturing supply chain [1-5]. RE efforts have already been successful in extracting device level functionalities from an integrated circuit (IC) with very limited resources [6]. Camouflaging is an obfuscation method that can thwart such RE [7-9]. Existing work on IC camouflaging primarily uses fabrication techniques such as doping and dummy contacts to hide the circuit structure or build cells that look alike but have different functionalities. While promising these Si complementary metal oxide semiconductor (CMOS) based obfuscation techniques adds significant area overhead and are successfully decamouflaged by the Satisfiability solver (SAT)-based reverse engineering techniques [9-13]. Emerging solutions, such as polymorphic gates based on giant spin Hall effect (GSHE) are promising but adds delay overhead in hybrid CMOS-GSHE designs restricting the camouflaging to a maximum of 15% of all the gates in the circuit. Here, we harness the unique properties of two-dimensional (2D) transition metal dichalcogenides (TMDs) including MoS2, MoSe2, MoTe2, WS2, and WSe2 and their optically transparent transition metal oxides (TMOs) to demonstrate novel area efficient camouflaging solutions that are resilient to SAT-attack and automatic test pattern generation (ATPG) attacks. We show that resistors with resistance values differing by 8 orders of magnitude, diodes with variable turn-on voltages and reverse saturation currents, and field effect transistors (FETs) with adjustable conduction type, threshold voltages and switching characteristics can be optically camouflaged to look exactly similar by engineering TMO/TMD heterostructures allowing hardware obfuscation of both digital and analog circuits. Since this 2D heterostructure devices family is intrinsically camouflaged, NAND/NOR/AND/OR gates in the circuit can be obfuscated with significantly less area overhead allowing 100% logic obfuscation compared to only 5% for CMOS-based camouflaging. Finally, we demonstrate that the largest benchmarking circuit from ISCAS’85, comprised of more than 4000 logic gates when obfuscated with the CMOS-based technique are successfully decamouflaged by SAT-attack in less than 40 minutes; whereas, it renders to be invulnerable even in more than 10 hours, when camouflaged with 2D heterostructure devices thereby corroborating our hypothesis of high resilience against RE. Our approach of connecting unique material properties to innovative devices to secure circuits can be considered as one of its kind demonstrations, highlighting the benefits of cross-layer optimization.

While hardware obfuscation has been used in industry for many years, very few scientific papers discuss layout-level obfuscation. The main aim of this paper is to start a discussion about hardware obfuscation in the academic community and point out open research problems. In particular, we introduce a very flexible layout-level obfuscation tool that we use as a case study for hardware obfuscation. In this obfuscation tool, a small custom-made obfuscell is used in conjunction with a standard cell to build a new obfuscated standard cell library called Obfusgates. This standard cell library can be used to synthesize any HDL code with standard synthesis tools, e.g. Synopsis Design Compiler. However, only obfuscating the functionality of individual gates is not enough. Not only the functionality of individual gates, but also their connectivity, leaks important important information about the design. In our tool we therefore designed the obfuscation gates to include a large number of "dummy wires". Due to these dummy wires, the connectivity of the gates in addition to their logic functionality is obfuscated. We argue that this aspect of obfuscation is of great importance in practice and that there are many interesting open research questions related to this.

Reverse engineering of hardware IP block is a common practice for competitive purposes in the semiconductor industry. What is done with the information gathered is the deciding legal factor. Once this information gets into the hands of an attacker, it can be used to manufacture exact clones of the hardware device. In an attempt to prevent the illegal copies of the IP block from flooding the market, layout-level obfuscation based on switchable dopant is suggested for the hardware design. This approach can be integrated into the design and manufacturing flow using an obfuscation tool (ObfusTool) to obfuscate the functionality of the IP core. The ObfusTool is developed in a way to be flexible and adapt to different standard cell libraries and designs. It enables easy and accurate evaluation of the area, power and delay v/s obfuscation trades-offs across different design approaches for hardware obfuscation. The ObfusTool is linked to an obfuscation standard cell library which is based on a prototype design created with Obfuscells and 4-input NAND gate. The Obfuscell is a standard cell which is created with switchable functionality based on the assigned dopant configurations. The Obfuscell is combined with other logic gates to form a standard cell library, which can replace any number of existing gates in the IP block without altering it's functionality. A total of 160 different gates are realized using permutated combinations starting with 26 unique gate functions. This design library provide a high level of obfuscation in terms of the number of combinations an adversary has to go through increase to 2 2000 approximately based on the design under consideration. The connectivity of the design has been ignored by previous approaches, which we have addressed in this thesis. The connectivity of a design leaks important information related to inputs and outputs of a gate. We extend the basic idea of dopant-based hardware obfuscation by introducing "dummy wires". The addition of dummy wires not only obfuscates the functionality of the design but also it's connectivity. This greatly reduces the information leakage and complexity of the design increases. To an attacker the whole design appears as one big 'blob'.This also curbs the attempts of brute force attacks. The introduced obfuscation comes at a cost of area and power overhead on an average 5x, which varies across different design libraries.

Tampering and Reverse Engineering of a chip to extract the hardware Intellectual Property (IP) core or to inject malicious alterations is a major concern. First, offshore chip manufacturing allows the design secrets of the IP cores to be transparent to the foundry and other entities along the production chain. Second, small malicious modifications to the design may not be detectable after fabrication without anti-tamper mechanisms. Counterfeit Integrated Circuits (ICs) also have become an important security issue in recent years, in which counterfeit ICs that perform incorrectly or sub-par to the expected can lead to catastrophic consequences in safety and/or mission-critical applications, in addition to the tremendous economic toll they incur to the semiconductor industry. Some techniques have been developed in the past to improve the defense against such attacks but they tend to fall prey to the increasing power of the attacker. We present a new way to protect against tampering by a clever obfuscation of the design, which can be unlocked with a specific, dynamic path traversal. Hence, the functional mode of the controller is hidden with the help of obfuscated states, and the functional mode is made operational only on the formation of a specific interlocked Code-Word during state transition. A novel time-stamp is proposed that can provide the date at which the IC was manufactured for counterfeit detection. Furthermore, we propose a second layer of tamper resistance to the time-stamp circuit to make it even more difficult to modify. Results show that methods proposed offer higher levels of security with small area overhead. A side benefit is that any small alteration will be magnified via the obfuscated design proposed in these methods. Master of Science

Side Channel Analysis (SCA) is a method by which an adversary can gather information about a processor by examining the activity being done on a microchip though the environment surrounding the chip. Side Channel Analysis attacks use SCA to attack a microcontroller when it is processing cryptographic code, and can allow an attacker to gain secret information, like a crypto-algorithm's key. The purpose of this thesis is to test proposed dynamic hardware methods to increase the hardware security of a microprocessor such that the software code being run on the microprocessor can be made more secure without having to change the code. This thesis uses the Java Optimized Processor (JOP) to identify and _x SCA vulnerabilities to give a processor running RSA or AES code more protection against SCA attacks.

As the internet-of-things (IoT) era begins, there is a significant need for low-cost access control schemes that allow humans to activate and maintain IoT systems.Traditional biometric access control systems remain, however, vulnerable to physical attacks resulting in template theft/privacy, illegal access, etc. This paper aimed to address this by expanding on a proposal called BLOcKeR, which combines biometrics with two recent advances in hardware security—physically unclonable functions (PUFs) and hardware obfuscation. Hardware obfuscation is a technique to protect electronic hardware against access control circumvention attacks through locking mechanisms. A PUF is incorporated to tie the biometrics of the owner to the system. Combining these advances with biometrics, BLOcKeR protects a biometric system from physical attacks by locking its functionality and aims at ensuring successful activation of the locked system unlike the authentication /matching in biometric systems. In addition, unlike various existing approaches, BLOcKeR does not store the raw biometric of users while providing irreversibility, unlinkability, and revocability to the templates. We present a security analysis and experiments with more than 45,000 attack variants to evaluate BLOcKeR’s security against unauthorized access.

The security of hardware intellectual properties (IPs) has become a significant concern, as the opportunity for piracy, reverse engineering, and malicious modification is increasing. Hardware obfuscation has been studied as a potent method to protect against all these attack vectors. However, most of the existing obfuscation techniques have been successfully compromised, where many inherent functional or structural vulnerabilities in these techniques are utilized to reveal the obfuscation key or retrieve the original design. In this paper, we introduce LeGO, a learning-guided obfuscation framework that overcomes known vulnerabilities in a scalable and systematic manner, leading to a robust and lightweight locking mechanism. The proposed framework is guided by our security evaluation process that performs a thorough assessment of an obfuscated IP against various attacks and identifies the vulnerabilities. It then judiciously selects and applies a set of design modification steps or rules that can eliminate these vulnerabilities. Such a rule-based obfuscation process has the distinctive capability to address all existing as well as emerging attacks through the learning of appropriate design transformation steps that prevent these attacks. We present an efficient strategy to apply these rules on a design, while resolving any conflict. Our evaluation of the LeGO framework on a set of ISCAS85 and open-source IP benchmarks has shown promising results in terms of robustness against diverse attacks with an average of area, power and delay overhead of 39%, 45%, and 15%, respectively.

International audience; A digital Finite Impulse Response (FIR) filter is a ubiquitous block in digital signal processing applications and its behavior is determined by its coefficients. To protect filter coefficients from an adversary, efficient obfuscation techniques have been proposed, either by hiding them behind decoys or replacing them by key bits. In this article, we initially introduce a query attack that can discover the secret key of such obfuscated FIR filters, which could not be broken by existing prominent attacks. Then, we propose a first of its kind hybrid technique, including both hardware obfuscation and logic locking using a point function for the protection of parallel direct and transposed forms of digital FIR filters. Experimental results show that the hybrid protection technique can lead to FIR filters with higher security while maintaining the hardware complexity competitive or superior to those locked by prominent logic locking methods. It is also shown that the protected multiplier blocks and FIR filters are resilient to existing attacks. The results on different forms and realizations of FIR filters show that the parallel direct form FIR filter has a promising potential for a secure design.

Emerging nanoelectronic semiconductor devices have been quite promising in enhancing hardware-oriented security and trust. However, implementing hardware security primitives and methodologies requires large area overhead and power consumption. Furthermore, emerging new attack models and vulnerabilities are regularly evolving and cannot be adequately addressed by current CMOS technology. This paper for the first time presents a comprehensive review of numerous post-CMOS technologies based hardware security primitives and methodologies, particularly true random number generators, physically unclonable functions, sidechannel analysis countermeasures, and hardware obfuscation techniques. Various beyond-CMOS device technologies including tunneling FET (TFET), hybrid phase transition FET (HyperFET), carbon nanotube FET (CNTFET), silicon nanowire FET (SiNWFET), symmetrical tunneling FET (SymFET), phase-change memory (PCM), spin-transfer torque magnetic tunnel junction (STT-MTJ), resistive random access memory (RRAM) have been considered in this study. First, the basic principle of operation and unusual characteristics of nanoelectronic devices used for hardware security applications have been extensively discussed. Later, CMOS technology challenges and benefits of emerging nanotechnologies for the design of hardware security primitives and methodologies have been reported. Finally, different analyses have been presented to demonstrate the promising performance of post-CMOS devices over the current CMOS technology in different countermeasures. Additionally, challenges, future directions, and plans have been presented to achieve more research outcomes in this field.

Hardware reverse engineering is a powerful and universal tool for both security engineers and adversaries. From a defensive perspective, it allows for detection of intellectual property infringements and hardware Trojans, while it simultaneously can be used for product piracy and malicious circuit manipulations. From a designer's perspective, it is crucial to have an estimate of the costs associated with reverse engineering, yet little is known about this, especially when dealing with obfuscated hardware. The contribution at hand provides new insights into this problem, based on algorithms with sound mathematical underpinnings. Our contributions are threefold: First, we present the graph similarity problem for automating hardware reverse engineering. To this end, we improve several state-of-the-art graph similarity heuristics with optimizations tailored to the hardware context. Second, we propose a novel algorithm based on multiresolutional spectral analysis of adjacency matrices. Third, in three extensively evaluated case studies, namely (1) gate-level netlist reverse engineering, (2) hardware Trojan detection, and (3) assessment of hardware obfuscation, we demonstrate the practical nature of graph similarity algorithms.

Hardware intellectual properties (IPs) used in diverse electronic systems face several critical security issues during their life cycle, including piracy, reverse engineering, and extraction of design secrets. To combat these issues, pre-silicon hardware obfuscation or logic locking has emerged as a promising solution and has been an active research topic over the past decade. However, in parallel, a number of functional and structural attacks on obfuscation have been discovered by the research community to break the protection provided by the existing obfuscation schemes. These attacks have played a major role in enhancing the security of hardware obfuscation schemes. In this paper, we introduce a novel combined attack modality, referred to as SOMA, which relies on judiciously combining the existing attacks to produce a significantly more powerful one. We demonstrate that such an attack can expose hidden exploits and measure the level of security offered by a given obfuscation technique. SOMA creates a sequence of attacks, where the outcome of each attack is used to guide the next and concludes with a key-refinement measure to restore the functionality of a locked IP. We demonstrate that SOMA can easily break major existing locking schemes that are believed to be secure with an attack accuracy average of 94.88%.

Logic locking has emerged as a promising solution to protect integrated circuits against piracy and tampering. However, the security provided by existing logic locking techniques is often thwarted by Boolean satisfiability (SAT)-based oracle-guided attacks. Criteria for successful SAT attacks on locked circuits include: (i) the circuit under attack is fully combinational, or (ii) the attacker has scan chain access. To address the threat posed by SAT-based attacks, we adopt the dynamically obfuscated scan chain (DOSC) architecture and illustrate its resiliency against the SAT attacks when inserted into the scan chain of an obfuscated design. We demonstrate, both mathematically and experimentally, that DOSC exponentially increases the resiliency against key extraction by SAT attack and its variants. Our results show that the mathematical estimation of attack complexity correlates to the experimental results with an accuracy of 95% or better. Along with the formal proof, we model DOSC architecture to its equivalent combinational circuit and perform SAT attack to evaluate its resiliency empirically. Our experiments demonstrate that SAT attack on DOSC-inserted benchmark circuits timeout at minimal test time overhead, and while DOSC requires less than 1% area and power overhead.

We propose three orthogonal techniques to secure Register-Transfer-Level (RTL) Intellectual Property (IP). In the first technique, the key-based RTL obfuscation scheme is proposed at an early design phase during High-Level Synthesis (HLS). Given a control-dataflow graph, we identify operations on non-critical paths and leverage synthesis information during and after HLS to insert obfuscation logic. In the second approach, we propose a robust design lockout mechanism for a key-obfuscated RTL IP when an incorrect key is applied more than the allowed number of attempts. We embed comparators on obfuscation logic output to check if the applied key is correct or not and a finite-state machine checker to enforce design lockout. Once locked out, only an authorized user (designer) can unlock the locked IP. In the third technique, we design four variants of the obfuscating module to camouflage the RTL design. We analyze the security properties of obfuscation, design lockout, and camouflaging. We demonstrate the feasibility on four datapath-intensive IPs and one crypto core for 32-, 64-, and 128-bit key lengths under three design corners (best, typical, and worst) with reasonable area, power, and delay overheads on both ASIC and FPGA platforms.

With the advancement of system miniaturization and automation, Lab-on-a-Chip (LoC) technology has revolutionized traditional experimental procedures. Microfluidic Biochip (MFB) is an emerging branch of LoC with wide medical applications such as DNA sequencing, drug delivery, and point of care diagnostics. Due to the critical usage of MFBs, their security is of great importance. In this article, we exploit the vulnerabilities of two types of MFBs: Flow-based Microfluidic Biochip (FMFB) and Digital Microfluidic Biochip (DMFB). We propose a systematic framework for applying Reverse Engineering (RE) attacks and Hardware Trojan (HT) attacks on MFBs as well as for practical countermeasures against the proposed attacks. We evaluate the attacks and defense on various benchmarks where experimental results prove the effectiveness of our methods. Security metrics are defined to quantify the vulnerability of MFBs. The overhead and performance of the proposed attacks as well as countermeasures are also discussed.

In recent years, IC reverse engineering and IC fabrication supply chain security have grown to become significant economic and security threats for designers, system integrators, and end customers. Many of the existing logic locking and obfuscation techniques have shown to be vulnerable to attack once the attacker has access to the design netlist either through reverse engineering or through an untrusted fabrication facility. We introduce soft embedded FPGA redaction, a hardware obfuscation approach that allows the designer substitute security-critical IP blocks within a design with a synthesizable eFPGA fabric. This method fully conceals the logic and the routing of the critical IP and is compatible with standard ASIC flows for easy integration and process portability. To demonstrate eFPGA redaction, we obfuscate a RISC-V control path and a GPS P-code generator. We also show that the modified netlists are resilient to SAT attacks with moderate VLSI overheads. The secure RISC-V design has 1.89x area and 2.36x delay overhead while the GPS design has 1.39x area and negligible delay overhead when implemented on an industrial 22nm FinFET CMOS process.

In recent years, IC reverse engineering and IC fabrication supply chain security have grown to become significant economic and security threats for designers, system integrators, and end customers. Many of the existing logic locking and obfuscation techniques have shown to be vulnerable to attack once the attacker has access to the design netlist either through reverse engineering or through an untrusted fabrication facility. We introduce soft embedded FPGA redaction, a hardware obfuscation approach that allows the designer substitute security-critical IP blocks within a design with a synthesizable eFPGA fabric. This method fully conceals the logic and the routing of the critical IP and is compatible with standard ASIC flows for easy integration and process portability. To demonstrate eFPGA redaction, we obfuscate a RISC-V control path and a GPS P-code generator. We also show that the modified netlists are resilient to SAT attacks with moderate VLSI overheads. The secure RISC-V design has 1.89x area and 2.36x delay overhead while the GPS design has 1.39x area and negligible delay overhead when implemented on an industrial 22nm FinFET CMOS process.