Search

With the recent introduction of techniques to restrict scan chain access, a new class of deobfuscation problems emerge, in which the threat model, although similar to deobfuscation of a logic locked circuit, forms a novel class of attack. In this paper, the concept of a logic restricted circuit is generalized and defined. Next, a novel type of SAT-based attack is proposed for the new class of deobfuscation problems, described as a 2-stage SAT-attack. A SAT-attack resilience measure is developed to quantify the security strength of a logic restricted circuit against a SAT-based attack. Finally, the proposed SAT-resilience framework is applied to compare and evaluate effectiveness of example logic restriction schemes.

In recent years, IC reverse engineering and IC fabrication supply chain security have grown to become significant economic and security threats for designers, system integrators, and end customers. Many of the existing logic locking and obfuscation techniques have shown to be vulnerable to attack once the attacker has access to the design netlist either through reverse engineering or through an untrusted fabrication facility. We introduce soft embedded FPGA redaction, a hardware obfuscation approach that allows the designer substitute security-critical IP blocks within a design with a synthesizable eFPGA fabric. This method fully conceals the logic and the routing of the critical IP and is compatible with standard ASIC flows for easy integration and process portability. To demonstrate eFPGA redaction, we obfuscate a RISC-V control path and a GPS P-code generator. We also show that the modified netlists are resilient to SAT attacks with moderate VLSI overheads. The secure RISC-V design has 1.89x area and 2.36x delay overhead while the GPS design has 1.39x area and negligible delay overhead when implemented on an industrial 22nm FinFET CMOS process.

The protection of Intellectual Property (IP) has emerged as one of the most important issues in the hardware design industry. Most VLSI design companies are now fabless and need to protect their IP from being illegally distributed. One of the main approach to address this has been through logic locking. Logic locking prevents IPs from being reversed engineered as well as overbuilding the hardware circuit by untrusted foundries. One of the main problem with existing logic locking techniques is that the foundry has full access to the entire design including the logic locking mechanism. Because of the importance of this topic, continuous more robust locking mechanisms are proposed and equally fast new methods to break them appear. One alternative approach is to lock a circuit through omission. The main idea is to selectively map a portion of the IP onto an embedded FPGA (eFPGA). Because the foundry does not have access to the bitstream, the circuit cannot be used until programmed by the legitimate user. One of the main problems with this approach is the large overhead in terms of area and power, as well as timing degradation. Area is especially a concern for price sensitive applications. To address this, in this work we presents a method to map portions of a design onto a Coarse Grained Runtime Reconfigurable Architecture (CGRRA) such that multiple parts of a design can be hidden onto the CGRRA, substantially amortizing the area overhead introduced by the CGRRA.

An Intellectual Property (IP) in Very Large Scale Integrated (VLSI) is a reusable logic unit or functionality or a cell or a layout design that is developed with the creative or innovative idea of licensing to multiple vendors which can be used in their design. Due to globalization of Integrated circuit (IC) design flow, dishonest people in the supply chain can pirate IC's, overbuild IC's, counterfeiting and insert hardware Trojans. Looking into these issues, security of such devices becomes a major challenging job. This paper gives the survey of various methods presented by researchers to secure the innovated design from the third party. The paper is concluded with a need for research in machine learning or deep learning based methodologies for hardware security in IC/IP.

Logic obfuscation yields hardware security against various threats, such as Intellectual Property (IP) piracy and reverse engineering. Evolving Boolean satisfiability (SAT) attacks have challenged the hardware security assurance rendered by various obfuscation methods. Recent works have centered on using re-configurable components such as Look-Up-Tables (LUTs) to enhance resiliency against attacks. Resiliency against SAT-attack is guaranteed when the size of LUT (number of inputs) is large. However, this incurs significant power, area and performance overheads. To address this challenge, this work proposes logic encryption based on customized LUT to make this practical. We propose two variants of the customized LUT based obfuscation: LUT+MUX based obfuscation, securing the design through routing obfuscation by MUX(multiplexer) and logic obfuscation of LUTs; and LUT+LUT based obfuscation, benefiting from LUT based obfuscation reinforced with additional logic/routing obfuscation. We evaluate the hardware security and overheads of the proposed two variants of customized LUT-based obfuscation on various benchmarks. Proposedcustomized LUT-based obfuscation breaks the security, power, and area trade-offs. The proposed solution is shown to be robust against SAT-attacks and power analysis-based side-channel attacks with8×reduced area and 3×reduced power on an average compared tostate-of-the-art LUT-based obfuscation.

In the era of globalized Integrated Circuit (IC) design and manufacturing flow, a rising issue to the silicon industry is various attacks on hardware intellectual property (IP). As a measure to ensure security along the supply chain against IP piracy, tampering and reverse engineering, hardware obfuscation is considered a reliable defense mechanism. Sequential and combinational obfuscations are the primary classes of obfuscation, and multiple methods have been proposed in each type in recent years. This paper presents an overview of obfuscation techniques and a qualitative comparison of the two major types.

Circuit camouflage technologies can be integrated into standard logic cell developments using traditional CAD tools. Camouflaged logic cells are integrated into a typical design flow using standard front end and back end models. Camouflaged logic cells obfuscate a circuit's function by introducing subtle cell design changes at the GDS level. The logic function of a camouflaged logic cell is extremely difficult to determine through silicon imaging analysis preventing netlist extraction, clones and counterfeits. The application of circuit camouflage as part of a customer's design flow can protect hardware IP from reverse engineering. Camouflage fill techniques further inhibit Trojan circuit insertion by completely filling the design with realistic circuitry that does not affect the primary design function. All unused silicon appears to be functional circuitry, so an attacker cannot find space to insert a Trojan circuit. The integration of circuit camouflage techniques is compatible with standard chip design flows and EDA tools, and ICs using such techniques have been successfully employed in high-attack commercial and government segments. Protected under issued and pending patents.

Due to globalization of Integrated Circuit (IC) design flow, rogue elements in the supply chain can pirate ICs, overbuild ICs, and insert hardware trojans. EPIC [1] obfuscates the design by randomly inserting additional gates; only a correct key makes the design to produce correct outputs. We demonstrate that an attacker can decipher the obfuscated nctlist, in a time linear to the number of keys, by sensitizing the key values to the output. We then develop techniques to fix this vulnerability and make obfuscation truly exponential in the number of inserted keys.

Malicious hardware Trojan circuitry inserted in safety-critical applications is a major threat to national security. In this work, we propose a novel application of a key-based obfus-cation technique to achieve security against hardware Trojans. The obfuscation scheme is based on modifying the state transition function of a given circuit by expanding its reachable state space and enabling it to operate in two distinct modes — the normal mode and the obfuscated mode. Such a modification obfuscates the rareness of the internal circuit nodes, thus making it difficult for an adversary to insert hard-to-detect Trojans. It also makes some inserted Trojans benign by making them activate only in the obfuscated mode. The combined effect leads to higher Trojan detectability and higher level of protection against such attack. Simulation results for a set of benchmark circuits show that the scheme is capable of achieving high levels of security at modest design overhead. Categories and Subject Descriptors B.6.1 [Logic Design]: Design Styles-sequential circuits; K.6.5 [Management of Computing and Information Systems]: Security and Protection-physical security General Terms Design, Security

As semiconductor manufacturing requires greater capital investments, the use of contract foundries has grown dramatically, increasing exposure to mask theft and unauthorized excess production. While only recently studied, IC piracy has now become a major challenge for the electronics and defense industries [6].We propose a novel comprehensive technique to end piracy of integrated circuits (EPIC). It requires that every chip be activated with an external key, which can only be generated by the holder of IP rights, and cannot be duplicated. EPIC is based on (i) automatically-generated chip IDs, (ii) a novel combinational locking algorithm, and (iii) innovative use of public-key cryptography. Our evaluation suggests that the overhead of EPIC on circuit delay and power is negligible, and the standard flows for verification and test do not require change. In fact, major required components have already been integrated into several chips in production. We also use formal methods to evaluate combinational locking and computational attacks. A comprehensive protocol analysis concludes that EPIC is surprisingly resistant to various piracy attempts.