Search

Editor’s note : If you are designing or integrating hardware IP blocks into your designs, and you are using common global supply chains, then reading this overview article on how to protect your IP against reverse engineering, piracy, and malicious alteration attacks is a must. The authors give a comprehensive overview of current countermeasures that can be used at RTL, gate-, and layout-level to protect your design with a focus on combinational and sequential logic locking and a discussion on merits, overheads, and shortcomings of such techniques. —Jurgen Teich, FAU Erlangen

Hardware obfuscation is a technique that modifies the circuit to hide the functionality. Obfuscations through algorithmic modifications add protection in addition to circuit-level techniques, and their effects on the data paths can be analyzed and controlled at the architectural level. Many error-correcting coding and cryptography algorithms are based on finite field arithmetic. For the first time, this paper proposes a hardware obfuscation scheme achieved through varying finite field constructions and primitive element representations. Also the variations are effectively transformed to bit permuters controlled by obfuscation keys to achieve high level of security with very small complexity overheads. To illustrate the effectiveness, the proposed scheme is applied to obfuscate Reed-Solomon decoders, which are broadly used in communication and storage systems. For a (255, 239) RS decoder over finite field $GF(256)$GF(256), the proposed scheme achieves 1239 bits of independent obfuscation key with 4.4 percent area overhead, while yielding no penalty on the throughput and only one extra clock cycle of latency.

Obfuscation is a promising solution for securing hardware intellectual property (IP) against various attacks, such as reverse engineering, piracy, and tampering. Due to the lack of standard benchmarks, proposed techniques by researchers and practitioners in the community are evaluated by existing benchmark suites such as ISCAS-85, ISCAS-89, and ITC-99. These open source benchmarks, though widely utilized, are not necessarily suitable for the purpose of evaluating hardware obfuscation techniques. In this context, we believe that it is important to establish a set of well-defined benchmarks, on which the effectiveness of new and existing obfuscation techniques and attacks on them can be compared. In this paper, we describe a set of such benchmarks obfuscated with some popular methods that we created to facilitate this need. These benchmarks have been made publicly available on Trust-Hub web portal. Moreover, we provide the first evaluation of several obfuscation approaches based on the metrics and existing attacks using this new suite. Finally, we discuss our observations and guidance for future work in hardware obfuscation and benchmarking.

It is important to protect the intellectual properties of logic circuits from reverse engineering. One of the countermeasures is logic obfuscation, which complicates the internal structures of logic circuits to prevent reverse engineering. A few researches have been conducted to simplify logic obfuscation using software obfuscation tools and high-level synthesis. However, it is not quantitatively evident whether the generated circuits are more complex than plain circuits. This paper discusses the three metrics of obfuscated netlists to evaluate the obfuscation methods proposed in previous studies. We confirmed that the obfuscated circuits are actually more complex than the original circuits using the proposed metrics.

There is a great variety of hardware Trojan detection and prevention approaches. However, state of art approaches cannot provide a full guarantee that an integrated circuit or complex electronic system is free of hardware Trojan. We introduced a reference monitor obfuscation approach on the base of formal transformations of structural system models. The approach ensures development of secure systems, operating in the presence of hardware Trojans. The reference monitor obfuscation ensures the main key reference monitor properties: must be non-bypassable and tamper-proof. This concept can be used as a prevention countermeasure against hardware Trojans at the following steps of development cycle of integrated circuit on the FPGA platform: prevention at design, prevention at fabrication, and prevention at post-fabrication. The paper demonstrates an implementation of reference monitor obfuscation approach by physical modeling on FPGA-based systems.

As a result of the increased use of contract foundries, internet protocol (IP) theft, excess production and reverse engineering are major concerns for the electronics and defense industries. Hardware obfuscation and IP locking can be used to make a design secure by replacing a part of the circuit with a key-locked module. In order to ensure each chip has unique keys, previous work has proposed using physical unclonable functions (PUF) to lock the circuit. However, these designs are area intensive. In this work, we propose a strong PUF-based hardware obfuscation scheme to uniquely lock each chip.

Intellectual property (IP) piracy and electronic counterfeiting have emerged as critical threats to the semiconductor industry in the current horizontal business model where the supply chain usually involves a large number of vendors. Hence, techniques that can protect integrated circuit (IC) against reverse engineering are demanded, especially for security-critical tasks. Hardware obfuscation is a broad category of techniques that could create ambiguity to the adversary by hiding the actual information from illegitimate users. This paper presents a novel hardware obfuscation design through reconfigurable finite field arithmetic units, which can be employed in various error correction and cryptographic algorithms. The effectiveness and efficiency of the proposed methods are verified by an obfuscated reformulated inversion-less Berlekamp-Massey (RiBM) Reed-Solomon decoder. Our experimental results show the hardware implementation of RiBM based Reed-Solomon decoder built using reconfigurable field multiplier designs. The proposed design provides only very low overhead.

To protect intellectual property, hardware obfuscation is necessary to conceal the implemented function. Besides logic-level approaches, hardware obfuscation can be done through algorithmic modifications. Prior algorithmic obfuscations address signal processing systems and those with variable data flow. This paper focuses on the obfuscation of systems based on finite field arithmetic, which are broadly adopted in digital communications. Netlists of hardware units with different field constructions are first analyzed to evaluate possible attacks. Taking into account the specifics of the computations in the Advanced Encryption Standard (AES) algorithm, optimized schemes are proposed to efficiently introduce obfuscation keys utilizing the variation of finite field construction. For an example pipelined fully-unrolled AES encryptor, the proposed scheme leads to 480 bits of obfuscation key with 3% area overhead without sacrificing the throughput. The proposed obfuscation method can be also extended to other algorithms involving finite field arithmetic.

The globalization of supply chain makes semiconductor chips susceptible to various security threats. Design obfuscation techniques have been widely investigated to thwart intellectual property (IP) piracy attacks. Key distribution among IP providers, system integration team, and end users remains as a challenging problem. This work proposes an orthogonal obfuscation method, which utilizes an orthogonal matrix to authenticate obfuscation keys, rather than directly examining each activation key. The proposed method hides the keys by using an orthogonal obfuscation algorithm to increasing the key retrieval time, such that the primary keys for IP cores will not be leaked. The simulation results show that the proposed method reduces the key retrieval time by 36.3% over the baseline. The proposed obfuscation methods have been successfully applied to ISCAS'89 benchmark circuits. Experimental results indicate that the orthogonal obfuscation only increases the area by 3.4% and consumes 4.7% more power than the baseline.1

Nowadays, integrated circuits (ICs) security grown as a primary responsibility at every stage of IC supply chain due to the globalized design, fabrication, test, deployment and monitoring of an IC. In this regard, Advanced Encryption Standard (AES) is widely accepted and supported in both the domain, software as well as hardware. To diminish the effect and cause of different threats, researchers identified that the hardware obfuscation based AES is a promising technique and a solution towards piracy and reverse engineering. This paper discusses about the design and simulation of 128-bit AES algorithm using active hardware obfuscation techniques. 128-bit AES is designed and simulated using Xilinx Vivado 2016.2. In this paper simulation results of 128-bit AES algorithm are analyzed with and without obfuscation techniques. Results shows that with obfuscation techniques 128 bit AES algorithm offer higher level of security and implementation flexibility with small area overhead and power overhead. The robustness of proposed algorithm is also analyzed in the form of throughput and efficiency. The authors also presented the power consumption and analyzed the area overhead of proposed algorithm with different xilinx 7 -series FPGAs.

IC piracy is a significant security threat, where malicious manufacturers can produce unauthorized extra chips and/or steal the information of a design through reverse engineering attempts. As a countermeasure, hardware obfuscation schemes usually withhold a part of the design (which thereafter constitutes the "key") by replacing it with configurable modules. Enforcing the configurable module to be filled in with the withheld key information enables a post-manufacturing activation of each authenticate chip, albeit with a a need to state the threat of a leaked common key. To ensure that each chip has a unique key, Physically Unclonable Functions (PUFs) have been proposed to be integrated with hardware obfuscation. Such a paradigm is constrained to use weak PUFs, because, to uniquely set the key (the content of the configurable module) for each chip, the designer needs to fully characterize the PUFs for all the chips. In this paper, we argue that a powerful attacker in the position of a manufacturer can fully characterize all the weak PUFs, and use any leaked key to break the obfuscation framework. This paper proposes a strong PUF-based hardware obfuscation scheme to effectively prevent IC piracy even in the case of a leaked key from some activated chip.

Obfuscation is a technique for protecting hardware intellectual property (IP) blocks against reverse engineering, piracy, and malicious modifications. Current obfuscation efforts mainly focus on functional locking of a design to prevent black-box usage. They do not directly address hiding design intent through structural transformations, which is an important objective of obfuscation. We note that current obfuscation techniques incorporate only: (1) local, and (2) predictable changes in circuit topology. In this paper, we present SAIL, a structural attack on obfuscation using machine learning (ML) models that exposes a critical vulnerability of these methods. Through this attack, we demonstrate that the gate-level structure of an obfuscated design can be retrieved in most parts through a systematic set of steps. The proposed attack is applicable to all forms of logic obfuscation, and significantly more powerful than existing attacks, e.g., SAT-based attacks, since it does not require the availability of golden functional responses (e.g. an unlocked IC). Evaluation on benchmark circuits show that we can recover an average of around 84% (up to 95%) transformations introduced by obfuscation. We also show that this attack is scalable, flexible, and versatile., 6 pages, 6 figures, 8 tables

3D Integrated Circuit (3D-IC) is an emerging technology that can address many challenging problems threatening the security of the chip by split manufacturing [1]. One of the disadvantages of split manufacturing is the uncertainty in the reliability of the last foundry that is responsible for the complete bonding of tiers. In this work, we present an innovative approach that safeguard the outsourcing of the entire 3D IC manufacturing including the last bonding stage. The proposed technique not only obfuscates the design functionality but immunes the IC against Trojan insertion.

The globalized semiconductor supply chain make integrated circuits (ICs) potentially suffer from diverse security threats. Among different hardware attacks, Trojan horse insertion has emerged as a major security concern. To mitigate the hardware Trojan insertion happened in the late stage of IC supply chain, researchers recognize that hardware obfuscation is a promising technique. This chapter first reviews the state-of-the-art hardware obfuscation methods at different levels, and then summarizes the metrics that can be used to assess the effectiveness of hardware obfuscation. At the end of this chapter, future research directions for hardware obfuscation against Trojan insertion are discussed.

Due to the globalized semiconductor supply chain, integrated circuits suffer from hardware security attacks. Among various attacks, hardware Trojan insertions have emerged as a major security concern. An adversary modifies the original circuit to accomplish the malicious intentions through the hardware Trojan. Hardware obfuscation has been demonstrated as a promising technique to strengthen hardware implementation against hardware Trojan insertion in the late stage of the supply chain. This work reviews the state-of-the-art hardware obfuscation methods, with the special emphasis on the corresponding efforts made for hardware Trojan prevention and detection. Furthermore, we summarize the evaluation metrics utilized in literature to assess the effectiveness of hardware obfuscation methods. Future directions for hardware obfuscation against hardware Trojans are discussed in this work, as well.

In today’s Integrated Circuit (IC) production chains, a designer’s valuable Intellectual Property (IP) is transparent to diverse stakeholders and thus inevitably prone to piracy. To protect against this threat, numerous defenses based on the obfuscation of a circuit’s control path, i.e. Finite State Machine (FSM), have been proposed and are commonly believed to be secure. However, the security of these sequential obfuscation schemes is doubtful since realistic capabilities of reverse engineering and subsequent manipulation are commonly neglected in the security analysis. The contribution of our work is threefold: First, we demonstrate how high-level control path information can be automatically extracted from third-party, gate-level netlists. To this end, we extend state-of-the-art reverse engineering algorithms to deal with Field Programmable Gate Array (FPGA) gate-level netlists equipped with FSM obfuscation. Second, on the basis of realistic reverse engineering capabilities we carefully review the security of state-of-the-art FSM obfuscation schemes. We reveal several generic strategies that bypass allegedly secure FSM obfuscation schemes and we practically demonstrate our attacks for a several of hardware designs, including cryptographic IP cores. Third, we present the design and implementation of Hardware Nanomites, a novel obfuscation scheme based on partial dynamic reconfiguration that generically mitigates existing algorithmic reverse engineering., IACR Transactions on Cryptographic Hardware and Embedded Systems, Volume 2018, Issue 3

In the era of globalized Integrated Circuit (IC) design and manufacturing flow, a rising issue to the silicon industry is various attacks on hardware intellectual property (IP). As a measure to ensure security along the supply chain against IP piracy, tampering and reverse engineering, hardware obfuscation is considered a reliable defense mechanism. Sequential and combinational obfuscations are the primary classes of obfuscation, and multiple methods have been proposed in each type in recent years. This paper presents an overview of obfuscation techniques and a qualitative comparison of the two major types.

While the globalization of the semiconductor production process has accelerated innovation, lowered costs, and reduced time-to-market, it has also created grave trust issues among the different entities involved in the production process. Theft, reverse engineering, and piracy of silicon intellectual property (IP) are the realities that manufacturers and vendors of integrated circuits must face today. In order to combat these threats, obfuscation has emerged as a viable candidate for semiconductor or hardware IP protection. Obfuscation techniques aim at concealing or locking the underlying intellectual property of a semiconductor product, such as IP cores, gate-level designs, or layout, in order to prevent an untrusted party or adversary from reverse engineering and/or exploiting the design. In this chapter, we will review emerging techniques for hardware obfuscation . We will describe the semiconductor supply chain in detail and outline the specific threats associated with each stage in the supply chain. We will also introduce the field of software obfuscation and related concepts that predate hardware obfuscation. Lastly, we will introduce relevant metrics for implementing and evaluating the various hardware obfuscation techniques.

This chapter discusses the fundamental concepts of design and testing and their role in hardware obfuscation. It outlines the traditional design flow of integrated circuits and assesses the vulnerabilities associated with the verification techniques and testing structures that can expose the design details and help reverse-engineer the functionality. A survey of security enhancement schemes has been presented. Furthermore, different classifications of hardware obfuscation have been discussed that cover the associated vulnerabilities of key management in nonvolatile memories (NVMs). The review of nonvolatile memories, emerging technologies and hardware-based cryptographic primitives, physical unclonable functions (PUFs) and true random number generators (TRNGs) and their use in hardware obfuscation techniques has been deliberated.

Hardware reverse engineering is a powerful and universal tool for both security engineers and adversaries. From a defensive perspective, it allows for detection of intellectual property infringements and hardware Trojans, while it simultaneously can be used for product piracy and malicious circuit manipulations. From a designer's perspective, it is crucial to have an estimate of the costs associated with reverse engineering, yet little is known about this, especially when dealing with obfuscated hardware. The contribution at hand provides new insights into this problem, based on algorithms with sound mathematical underpinnings. Our contributions are threefold: First, we present the graph similarity problem for automating hardware reverse engineering. To this end, we improve several state-of-the-art graph similarity heuristics with optimizations tailored to the hardware context. Second, we propose a novel algorithm based on multiresolutional spectral analysis of adjacency matrices. Third, in three extensively evaluated case studies, namely (1) gate-level netlist reverse engineering, (2) hardware Trojan detection, and (3) assessment of hardware obfuscation, we demonstrate the practical nature of graph similarity algorithms.

Hardware intellectual properties (IPs) used in diverse electronic systems face several critical security issues during their life cycle, including piracy, reverse engineering, and extraction of design secrets. To combat these issues, pre-silicon hardware obfuscation or logic locking has emerged as a promising solution and has been an active research topic over the past decade. However, in parallel, a number of functional and structural attacks on obfuscation have been discovered by the research community to break the protection provided by the existing obfuscation schemes. These attacks have played a major role in enhancing the security of hardware obfuscation schemes. In this paper, we introduce a novel combined attack modality, referred to as SOMA, which relies on judiciously combining the existing attacks to produce a significantly more powerful one. We demonstrate that such an attack can expose hidden exploits and measure the level of security offered by a given obfuscation technique. SOMA creates a sequence of attacks, where the outcome of each attack is used to guide the next and concludes with a key-refinement measure to restore the functionality of a locked IP. We demonstrate that SOMA can easily break major existing locking schemes that are believed to be secure with an attack accuracy average of 94.88%.

Logic locking has emerged as a promising solution to protect integrated circuits against piracy and tampering. However, the security provided by existing logic locking techniques is often thwarted by Boolean satisfiability (SAT)-based oracle-guided attacks. Criteria for successful SAT attacks on locked circuits include: (i) the circuit under attack is fully combinational, or (ii) the attacker has scan chain access. To address the threat posed by SAT-based attacks, we adopt the dynamically obfuscated scan chain (DOSC) architecture and illustrate its resiliency against the SAT attacks when inserted into the scan chain of an obfuscated design. We demonstrate, both mathematically and experimentally, that DOSC exponentially increases the resiliency against key extraction by SAT attack and its variants. Our results show that the mathematical estimation of attack complexity correlates to the experimental results with an accuracy of 95% or better. Along with the formal proof, we model DOSC architecture to its equivalent combinational circuit and perform SAT attack to evaluate its resiliency empirically. Our experiments demonstrate that SAT attack on DOSC-inserted benchmark circuits timeout at minimal test time overhead, and while DOSC requires less than 1% area and power overhead.

We propose three orthogonal techniques to secure Register-Transfer-Level (RTL) Intellectual Property (IP). In the first technique, the key-based RTL obfuscation scheme is proposed at an early design phase during High-Level Synthesis (HLS). Given a control-dataflow graph, we identify operations on non-critical paths and leverage synthesis information during and after HLS to insert obfuscation logic. In the second approach, we propose a robust design lockout mechanism for a key-obfuscated RTL IP when an incorrect key is applied more than the allowed number of attempts. We embed comparators on obfuscation logic output to check if the applied key is correct or not and a finite-state machine checker to enforce design lockout. Once locked out, only an authorized user (designer) can unlock the locked IP. In the third technique, we design four variants of the obfuscating module to camouflage the RTL design. We analyze the security properties of obfuscation, design lockout, and camouflaging. We demonstrate the feasibility on four datapath-intensive IPs and one crypto core for 32-, 64-, and 128-bit key lengths under three design corners (best, typical, and worst) with reasonable area, power, and delay overheads on both ASIC and FPGA platforms.

With the advancement of system miniaturization and automation, Lab-on-a-Chip (LoC) technology has revolutionized traditional experimental procedures. Microfluidic Biochip (MFB) is an emerging branch of LoC with wide medical applications such as DNA sequencing, drug delivery, and point of care diagnostics. Due to the critical usage of MFBs, their security is of great importance. In this article, we exploit the vulnerabilities of two types of MFBs: Flow-based Microfluidic Biochip (FMFB) and Digital Microfluidic Biochip (DMFB). We propose a systematic framework for applying Reverse Engineering (RE) attacks and Hardware Trojan (HT) attacks on MFBs as well as for practical countermeasures against the proposed attacks. We evaluate the attacks and defense on various benchmarks where experimental results prove the effectiveness of our methods. Security metrics are defined to quantify the vulnerability of MFBs. The overhead and performance of the proposed attacks as well as countermeasures are also discussed.

This paper proposes a novel technique for hardware obfuscation termed dynamic functional obfuscation . Hardware obfuscation refers to a set of countermeasures used against IC counterfeiting and illegal overproduction. Traditionally, obfuscation encrypts semiconductor circuits using key inputs which must be set to a correct value to operate the circuit correctly. By keeping the key values secret during the manufacturing process, any attempt by unauthorized parties to overproduce chips or pirate designs is thwarted. The proposed dynamic technique differs from existing fixed obfuscation schemes as the obfuscating signals change over time. This results in inconsistent circuit behavior upon input of incorrect key, where the chip operates correctly sometimes and fails sometimes. The advantage of dynamic obfuscation is that it results in stronger obfuscation by increasing the time complexity of deciphering the correct key using brute-force attack, even with shorter keys. Moreover, the dynamic nature of these circuits also makes them resistant to reverse engineering and SAT solver-based attacks. To achieve dynamic obfuscation, ideas from hardware Trojan literature and sequentially triggered counters are utilized. A demonstration of obfuscation on sequential circuits implementing fast Fourier transform (FFT) algorithm and Ethernet IP shows low overall area and power overheads of less than 1%. Security in terms of time to attack for the FFT circuit (for a key size of 30 bits and a system operating at 100 MHz) is increased to 1 021,055 years using dynamic obfuscation compared with only 5.36 s using fixed obfuscation schemes. For the Ethernet IP core, time to attack of dynamic obfuscation with a key size of 32 bits is 1 046,423, 135 years compared with 21.47s with fixed obfuscation. It is also shown that for a key size of $K$ bits, the lower bound for time to attack using brute-force is proportional to $K 2^{K}$ and $K 2^{2K}$ for the proposed design using one and two random number generators, respectively.

Over the last decade attacks have repetitively demonstrated that bitstream protection for SRAM-based FPGAs is a persistent problem without a satisfying solution in practice. Hence, real-world hardware designs are prone to intellectual property infringement and malicious manipulation as they are not adequately protected against reverse-engineering.In this work, we first review state-of-the-art solutions from industry and academia and demonstrate their ineffectiveness with respect to reverse-engineering and design manipulation. We then describe the design and implementation of novel hardware obfuscation primitives based on the intrinsic structure of FPGAs. Based on our primitives, we design and implement LifeLine, a hardware design protection mechanism for FPGAs using hardware/software co-obfuscated cryptography. We show that LifeLine offers effective protection for a real-world adversary model, requires minimal integration effort for hardware designers, and retrofits to already deployed (and so far vulnerable) systems.

Hardware obfuscation is widely used in practice to counteract reverse engineering. In recent years, low-level obfuscation via camouflaged gates has been increasingly discussed in the scientific community and industry. In contrast to classical high-level obfuscation, such gates result in recovery of an erroneous netlist. This technology has so far been regarded as a purely defensive tool. We show that low-level obfuscation is in fact a double-edged sword that can also enable stealthy malicious functionalities.In this work, we present Doppelganger, the first generic design-level obfuscation technique that is based on low-level camouflaging. Doppelganger obstructs central control modules of digital designs, e.g., Finite State Machines (FSMs) or bus controllers, resulting in two different design functionalities: an apparent one that is recovered during reverse engineering and the actual one that is executed during operation. Notably, both functionalities are under the designer’s control.In two case studies, we apply Doppelganger to a universal cryptographic coprocessor. First, we show the defensive capabilities by presenting the reverse engineer with a different mode of operation than the one that is actually executed. Then, for the first time, we demonstrate the considerable threat potential of low-level obfuscation. We show how an invisible, remotely exploitable key-leakage Trojan can be injected into the same cryptographic coprocessor just through obfuscation. In both applications of Doppelganger, the resulting design size is indistinguishable from that of an unobfuscated design, depending on the choice of encodings.

The emerging security threats in the integrated circuit supply chain do not only challenge the chip integrity, but also raise serious concerns on hardware intellectual property (IP) piracy. Hardware design obfuscation is a promising countermeasure to resist reverse engineering attacks and IP piracy. The majority of existing hardware obfuscation methods modify the original finite state machine (FSM) by adding additional state transitions and utilizing a key sequence to lock the transition from the nonfunctional states to the functional reset state. Those methods are effective to prevent attackers from entering the normal functional mode but they lack resilience if the FSM is already in the normal mode. This paper proposes to protect all the states with a low-cost state-deflection-based obfuscation method, which dynamically deflects state transitions from the original transition path to a black hole cluster if a wrong key is applied. Unlike other works that use static transitions between legal states to black hole states at the design time, this method utilizes a state rotation function (Rotatefunc) and selective register flipping function (Mapfunc) to dynamically control the state deflection paths. Hence, the difficulty of reverse engineering and thwarting register overwrite attacks is increased. Simulations performed on ISCAS’89 benchmark circuits show that the proposed method significantly reduces the difference of the net toggle activities between the correct and wrong key scenarios, and achieves up to 56% higher code coverage than the most efficient obfuscation method. Thanks to the dynamic deflection feature, on average, this method generates about 100 more unique state register patterns than other methods with moderate power increase. Moreover, the proposed method achieves the Hamming distance of primary outputs and state registers close to 50%.

With the recent introduction of techniques to restrict scan chain access, a new class of deobfuscation problems emerge, in which the threat model, although similar to deobfuscation of a logic locked circuit, forms a novel class of attack. In this paper, the concept of a logic restricted circuit is generalized and defined. Next, a novel type of SAT-based attack is proposed for the new class of deobfuscation problems, described as a 2-stage SAT-attack. A SAT-attack resilience measure is developed to quantify the security strength of a logic restricted circuit against a SAT-based attack. Finally, the proposed SAT-resilience framework is applied to compare and evaluate effectiveness of example logic restriction schemes.

In modern Integrated Circuits (IC) design flow, from specification to chip fabrication, various security threats are emergent. These range from malicious modifications in the design, to the Electronic Design Automation (EDA) tools, during layout or fabrication, or to the packaging. Of particular concern are modifications made to third-party IP cores and commercial off-the-shelf (COTS) chips where no Register Transfer Level (RTL) code or golden models are available. While chip level reverse engineering techniques can help rebuild circuit gate-level netlist from fabricated chips, there still lacks a netlist reverse engineering tool which can recover the full functionality of the rebuilt netlist. Toward this direction, we develop a tool, named Reverse Engineering Finite State Machine (REFSM), that helps end-users reconstruct a high-level description of the control logic from a flattened netlist. We demonstrate that REFSM effectively recovers circuit control logic from netlists with varying degrees of complexity. Experimental results also show that the REFSM can easily identify malicious logic from a flattened (or even obfuscated) netlist. Supported by REFSM, another tool, called Reverse Engineering Hardware Obfuscation for Protection (REHOP), is developed to enhance gate-level netlist security without learning the RTL code.

The separation of manufacturing and design processes in the integrated circuit industry to tackle the ever increasing circuit complexity and time to market issues has brought with it some major security challenges. Chief among them is IP piracy by untrusted parties. Hardware obfuscation which locks the functionality and modifies the structure of an IP core to protect it from malicious modifications or piracy has been proposed as a solution. In this paper, we develop an efficient hardware obfuscation method, called Mystic (Mystifying IP Cores), to protect IP cores from reverse engineering, IP overproduction, and IP piracy. The key idea behind Mystic is to add additional state transitions to the original/functional FSM (Finite State Machine) that are taken only when incorrect keys are applied to the circuit. Using the proposed Mystic obfuscation approach, the underlying functionality of the IP core is locked and normal FSM transitions are only available to authorized chip users. The synthesis results of ITC99 circuit benchmarks for ASIC 45nm technology reveal that the Mystic protection method imposes on average 5.14% area overhead, 5.21% delay overhead, and 8.06% power consumption overheads while it exponentially lowers the probability that an unauthorized user will gain access to or derive the chip functionality.

Ahstract-Various attacks on hardware intellectual properties (IPs) have been successful in obtaining design information that can be used to reverse engineer a system, create counterfeits, or insert hardware Trojans. Key-based hardware obfuscation is an attractive solution that helps prevent such attacks. In this paper, for the first time, we propose a key error tolerant obfuscation approach that achieves graceful degradation in output Quality of Service (QoS) as the bit error rate (BER) in obfuscation key increases. The approach, which we refer to it as, “Quality Obfuscation”, is applicable to a large variety of IPs, including digital signal processing (DSP) and approximating computing IPs, which are resilient to output QoS degradation. We present a complete obfuscation framework that can be adapted to any error tolerance rate. To demonstrate its robustness, we obfuscate several common DSP IP blocks and observe the performance under various percentages of bit-flips in the key. We show that our approach provides controllability of system quality, as well as the strong protection at low overhead, e.g., average 15% area and 5.9% power overhead to tolerate 10% BER.

The protection of Intellectual Property (IP) has emerged as one of the most important issues in the hardware design industry. Most VLSI design companies are now fabless and need to protect their IP from being illegally distributed. One of the main approach to address this has been through logic locking. Logic locking prevents IPs from being reversed engineered as well as overbuilding the hardware circuit by untrusted foundries. One of the main problem with existing logic locking techniques is that the foundry has full access to the entire design including the logic locking mechanism. Because of the importance of this topic, continuous more robust locking mechanisms are proposed and equally fast new methods to break them appear. One alternative approach is to lock a circuit through omission. The main idea is to selectively map a portion of the IP onto an embedded FPGA (eFPGA). Because the foundry does not have access to the bitstream, the circuit cannot be used until programmed by the legitimate user. One of the main problems with this approach is the large overhead in terms of area and power, as well as timing degradation. Area is especially a concern for price sensitive applications. To address this, in this work we presents a method to map portions of a design onto a Coarse Grained Runtime Reconfigurable Architecture (CGRRA) such that multiple parts of a design can be hidden onto the CGRRA, substantially amortizing the area overhead introduced by the CGRRA.

To reduce the cost of ICs and to meet the market's demand, a considerable portion of manufacturing supply chain, including silicon fabrication, packaging and testing may be pushed offshore. Utilizing a global IC manufacturing supply chain, and inclusion of non-trusted parties in the supply chain has raised concerns over security and trust related challenges including those of overproduction, counterfeiting, IP piracy, and Hardware Trojans to name a few. To reduce the risk of IC manufacturing in an untrusted and globally distributed supply chain, the researchers have proposed various locking and obfuscation mechanisms for hiding the functionality of the ICs during the manufacturing, that requires the activation of the IP after fabrication using the key value(s) that is only known to the IP/IC owner. At the same time, many such proposed obfuscation and locking mechanisms are broken with attacks that exploit the inherent vulnerabilities in such solutions. The past decade of research in this area, has resulted in many such defense and attack solutions. In this paper, we review a decade of research on hardware obfuscation from an attacker perspective, elaborate on attack and defense lessons learned, and discuss future directions that could be exploited for building stronger defenses.

Effective resistance to intellectual property (IP) piracy, overproduction and reverse engineering are becoming more and more necessary in the integrated circuit (IC) supply chain. To protect the hardware, the obfuscation methodology hides the original function by adding a large number of redundant states. However, existing hardware obfuscation approaches have hardware overhead and efficiency of obfuscation limitations. This paper proposed a novel methodology for IP security using the minimum spanning tree finite state machine (MST-FSM) obfuscation. In the minimum spanning tree (MST) algorithm, the Hamming distance defines the cost of obfuscated states. The Kruskal algorithm optimizes the connection relationship of obfuscated states by computing the Hamming distance of the MST-FSM. The proposed MST-FSM is automatically generated and embedded in the hardware IP with the self-building program. Finally, the MST-FSM is applied on the itc99 benchmark circuits and encryption standard IP cores. Compared with other state-of-the-arts, the obfuscation potency is improved by 3.57%, and the average hardware cost is decreased by about 6.01%.

Widespread outsourcing of integrated circuits fabrication increases the vulnerability to security threats. In this paper, we address approach that incorporates hardware design obfuscation scheme to protect a design against various forms of attacks. Hardware obfuscation is a technique by which an integrated circuit is modified to intentionally conceal its functionality and schematic. We consider hardware security through the reference monitor obfuscation. We obscure the connectivity of reference monitor so that an attacker cannot gain its functionality and original structure.

Logic obfuscation yields hardware security against various threats, such as Intellectual Property (IP) piracy and reverse engineering. Evolving Boolean satisfiability (SAT) attacks have challenged the hardware security assurance rendered by various obfuscation methods. Recent works have centered on using re-configurable components such as Look-Up-Tables (LUTs) to enhance resiliency against attacks. Resiliency against SAT-attack is guaranteed when the size of LUT (number of inputs) is large. However, this incurs significant power, area and performance overheads. To address this challenge, this work proposes logic encryption based on customized LUT to make this practical. We propose two variants of the customized LUT based obfuscation: LUT+MUX based obfuscation, securing the design through routing obfuscation by MUX(multiplexer) and logic obfuscation of LUTs; and LUT+LUT based obfuscation, benefiting from LUT based obfuscation reinforced with additional logic/routing obfuscation. We evaluate the hardware security and overheads of the proposed two variants of customized LUT-based obfuscation on various benchmarks. Proposedcustomized LUT-based obfuscation breaks the security, power, and area trade-offs. The proposed solution is shown to be robust against SAT-attacks and power analysis-based side-channel attacks with8×reduced area and 3×reduced power on an average compared tostate-of-the-art LUT-based obfuscation.

This is the first work augmenting hardware attacks mounted on obfuscated circuits by incorporating deep recurrent neural network (D-RNN). Logic encryption obfuscation has been used for thwarting counterfeiting, overproduction, and reverse engineering but vulnerable to attacks. There have been efficient schemes, e.g., satisfiability-checking (SAT) based attack, which can potentially compromise hardware obfuscation circuits. Nevertheless, not only there exist countermeasures against such attacks in the state-of-the-art (including the recent delay+logic locking (DLL) scheme in DAC'17), but the sheer amount of time/resources to mount the attack could hinder its efficacy. In this paper, we propose a deep RNN-oriented approach, called BOCANet, to (i) compromise the obfuscated hardware at least an order-of magnitude more efficiently (>20X faster with relatively high success rate) compared to existing attacks; (ii) attack such locked hardware even when the resources to the attacker are only limited to insignificant number of I/O pairs (< 0.5\%) to reconstruct the secret key; and (iii) break a number of experimented benchmarks (ISCAS-85 c423, c1355, c1908, and c7552) successfully.

This paper proposes a novel technique to functional encryption of integrated circuits (ICs) termed as hybrid obfuscation. Functional encryption or hardware obfuscation refers to a set of countermeasures used to protect circuits against attacks and illegal use during manufacturing at untrusted global foundries. The goal of encryption is achieved at the design house by functional modifications to the design and embedding secret keys. These keys are only programmed onto the chip once they are received from the foundry. Because the untrusted foundry does not have access to the key, it cannot sell excess parts as the chip won't function correctly without the key. By combining existing techniques of obfuscation known as fixed obfuscation and dynamic obfuscation, the hybrid obfuscation technique achieves the goals of functional encryption. An analysis of security measures shows that the hybrid obfuscation improves the security of a design by times compared to fixed obfuscation, where K is the key size in bits. Also, the hybrid obfuscation reduces area overhead by 40% and power overhead by 30% for a key size of 30 bits compared to the dynamic obfuscation. Thus, the hybrid obfuscation technique offers a solution which is between that of fixed and dynamic obfuscation.

Hardware obfuscation has been proposed as a hardware security measure against reverse engineering, intellectual property (IP) piracy and integrated circuits (IC) overbuilding. In this paper, we present a novel method of obfuscation using a hierarchical approach. In the design flow, IP vendors obfuscate their designs using a set of keys and provide these keys to the design house. The design house then integrates all the IPs and adds its own keys to create a complete obfuscated system. This prevents both misuse of IPs and illegal use of ICs since only secure parties have access to the correct keys. The obfuscation at each level is performed using a mode-based approach in which the design can operate in meaningful and non-meaningful modes. The design is functionally correct in only one mode. An attacker needs to work through different levels of the design to correctly decipher its operation and correct working mode. Since each of the IPs can work in multiple meaningful modes, the attack becomes more difficult as the number of IPs increases. These ideas are demonstrated using a convolution architecture with fast Fourier transform (FFT) blocks. With only about 13% area and 15% power overhead over an unobfuscated design, it is shown that the proposed design has the flexibility to be obfuscated with different key sizes and overheads depending on the level of security.

Due to globalization of integrated circuit (IC) design flow, rogue elements in the supply chain can pirate ICs, overbuild ICs, and insert hardware Trojans. EPIC locks the design by randomly inserting additional gates; only a correct key makes the design to produce correct outputs. We demonstrate that an attacker can decipher the locked netlist, in a time linear to the number of keys, by sensitizing the key-bits to the output. We then develop techniques to fix this vulnerability and make an attacker’s effort truly exponential in the number of inserted keys. We introduce a new security metric and a method to deliver strong logic locking.

A number of studies of hardware security aim to thwart piracy, overbuilding, and reverse engineering (RE) by obfuscating and/or camouflaging. However, these techniques incur high overheads, and integrated circuit (IC) camouflaging cannot provide any protection for the gate-level netlist of the third party intellectual property (IP) core or the single large monolithic IC. In order to circumvent these weaknesses, this brief elaborately analyzes these hardware security techniques and proposes a practical logic obfuscation method with low overheads to prevent an adversary from RE both the gate-level netlist and the layout-level geometry of IP/IC and protect IP/IC from piracy and overbuilding. Experimental evaluations demonstrate the low area, power, and zero performance overhead of the proposed obfuscation technique.

The manufacturing of integrated circuits (IC) outside of the design houses makes it possible for the adversary to easily perform a reverse engineering attack against intellectual property (IP)/IC. The aim of this attack can be the IP piracy, overproduction, counterfeiting or inserting hardware Trojan (HT) throughout the supply chain of the IC. Preventing hardware Trojan insertion is a significant issue in the context of hardware security (HS) and has not been considered in most of the previous logic encryption methods. To eliminate this problem, in this paper an Anti-Trojan insertion algorithm is presented. The idea is based on the fact that reducing the signals with low-observability (LO) and low-controllability (LC) can prevent HT insertion significantly. The security of logic encryption methods depends on the algorithm and the encryption key. However, the security of these methods has been compromised by SAT attacks over recent years. SAT attacks, can decode the correct key from most logic encryption techniques. In this article, by using the PUF-based encryption, the applied key in the encryption is randomized and SAT attack cannot be performed. Based on the output of PUF, a unique encryption has been made for each chip that preventing from counterfeiting and IP piracy.

The risk of code reverse-engineering is particularly acute for embedded processors which often have limited available resources to protect program information. Previous efforts involving code obfuscation provide some additional security against reverse- engineering of programs, but the security benefits are typically limited and not quantifiable. Hence, new approaches to code protection and creation of associated metrics are highly desirable. This paper has two main contributions. We propose the first hybrid diversification approach for protecting embedded software and we provide statistical metrics to evaluate the protection. Diversification is achieved by combining hardware obfuscation at the microarchitecture level and the use of software-level obfuscation techniques tailored to embedded systems. Both measures are based on a compiler which generates obfuscated programs, and an embedded processor implemented in an FPGA with a randomized Instruction Set Architecture (ISA) encoding to execute the hybrid obfuscated program. We employ a fine-grained, hardware-enforced access control mechanism for information exchange with the processor and hardware-assisted booby traps to actively counteract manipulation attacks. It is shown that our approach is effective against a wide variety of possible information disclosure attacks in case of a physically present adversary. Moreover, we propose a novel statistical evaluation methodology that provides a security metric for hybrid-obfuscated programs.

Logic obfuscation is widely followed in intellectual property cores and chip designs as hardware protection mechanism against design security threats such as reverse engineering (RE), piracy, cloning, overbuilding, etc. In general, sequential obfuscation has two modes of operation such as obfuscated and functional modes. Finite state machines (FSM) are being used to implement the mode control. When a specific sequence of input vectors is applied during power up for user authentication, the circuit will enter into functional mode. Otherwise, FSM remains in obfuscated mode and do not perform the intended functionality. In general, hardware obfuscation technique is applicable to all programmable logic devices. However, we applied the structural modification based netlist obfuscation methodology to field programmable gate array devices. The software implementation of sequential obfuscation is performed for a set of ISCAS'89 benchmark circuits using Libero IDE v9.1 on Actel device. As simulation/ structural analysis are the conventional methods to perform RE, we aimed to achieve a high percentage of simulation / structural mismatch during RE. We presented two scenarios of obfuscation: 1) For better structural mismatch during RE, insertion of obfuscation cells at different numbers of high fanout (HF) nets with minimum initialization sequence length (L). As per the designer's area constraint, the total number of nets to be obfuscated is chosen. 2) For better functional simulation mismatch during RE, FSM with different L values is included in the design with a minimum number of obfuscation cells. The initialization sequence length is decided concerning the system clock cycle (i.e. delay constraint). Based on the control signals derived from FSM, the values at HF obfuscated nets are decided. That is, the circuit executes the required functionality only in the functional mode. Hence, the simulation/ structural RE complexity of PLDs is improved. This paper discusses the simulation results of above-discussed scenarios using area, delay and power measurements.

In today's diversified semiconductor supply-chain, protecting intellectual property (IP) and maintaining manufacturing integrity are important concerns. Circuit obfuscation techniques such as logic encryption and IC camouflaging can potentially defend against a majority of supply-chain threats such as stealthy malicious design modification, IP theft, overproduction, and cloning. Recently, a Boolean Satisfiability (SAT) based attack, namely the SAT attack has been able to deobfuscate almost all traditional circuit obfuscation schemes, and as a result, a number of defense solutions have been proposed in literature. All these defenses are based on the implicit assumption that the attacker needs a perfect deobfuscation accuracy which may not be true in many practical cases. Therefore, in this paper by relaxing the exactness constraint on deobfuscation, we propose the AppSAT attack, an approximate deobfuscation algorithm based on the SAT attack and random testing. We show how the AppSAT attack can deobfuscate 68 out of the 71 benchmark circuits that were obfuscated with state-of-the-art SAT attack defenses with an accuracy of, n being the number of inputs. AppSAT shows that with current SAT attack defenses there will be a trade-off between exact-attack resiliency and approximation resiliency.

Device scaling has increased interconnect power and delay to an extent that it is presenting a bottleneck to further performance gain. 3D/2.5D integration technology emerges as a viable option to improve chip performance in a direction orthogonal to costly device scaling. While the technology was originally proposed to enhance performance, it has unlocked new opportunities to thwart security threats in a global IC supply chain. Various obfuscation techniques based on 3D/2.5D IC technology have been proposed to protect IC designs from being pirated or tampered during outsourced fabrication. This chapter presents the current state of 3D/2.5D IC-based obfuscation techniques and highlights potential security opportunities and challenges of this technology in hardware intellectual property (IP) protection.

Intellectual property theft by reverse engineering leads to loss of revenue and threatens security of integrated circuits. A number of design obfuscation techniques been proposed to counter IC reverse engineering. Most such techniques rely on functional misdirection at gate or module level but, do not prevent leakage of visual information about design characteristics from the physical layout. For example, capitalizing on relative difference in sizes among various functional units and their pin counts, an attacker may still be able to hypothesize about function of a unit, irrespective of any obfuscation performed on them. Hence, we propose meta-obfuscation techniques to harden other obfuscation mechanisms against physical information leakage. Our aim is to add complexity in the visual domain so that the physical characteristics of a design do not have notable correlation to its functionality. We explore various metrics to quantify the quality of the proposed meta-obfuscation and apply them in design automation. Experimental results show improvement in metrics used and also, highlight relevant overheads for meta-obfuscation.

Logic locking is an Intellectual Property (IP) protection technique that thwarts IP piracy, hardware Trojans, reverse engineering, and IC overproduction. Researchers have taken multiple attempts in breaking logic locking techniques and recovering its secret key. A Boolean Satisfiability (SAT) based attack has been recently presented that breaks all the existing combinational logic locking techniques. In this paper, we develop a lightweight countermeasure against this and other attacks that aim at gradually pruning the key search space. Our proposed logic locking technique, referred to as SARLock, maximizes the required number of distinguishing input patterns to recover the secret key. SARLock thwarts the SAT attack by rendering the attack effort exponential in the number of bits in the secret key, while its overhead grows only linearly.

Logic locking is a technique that has been proposed to protect outsourced IC designs from piracy and counterfeiting by untrusted foundries. A locked IC preserves the correct functionality only when a correct key is provided. Recently, the security of logic locking is threatened by a new attack called SAT attack, which can decipher the correct key of most logic locking techniques within a few hours [12] even for a reasonably large number of keys. This attack iteratively solves SAT formulas which progressively eliminate the incorrect keys till the circuit unlocked. In this paper, we present a circuit block (referred to as Anti-SAT block) to thwart the SAT attack. We show that the number of SAT attack iterations to reveal the correct key in a circuit comprising an Anti-SAT block is an exponential function of the key-size thereby making the SAT attack computationally infeasible. Through our experiments, we illustrate the effectiveness of our approach to securing modern chips fabricated in untrusted foundries.