Search

The security of hardware intellectual properties (IPs) has become a significant concern, as the opportunity for piracy, reverse engineering, and malicious modification is increasing. Hardware obfuscation has been studied as a potent method to protect against all these attack vectors. However, most of the existing obfuscation techniques have been successfully compromised, where many inherent functional or structural vulnerabilities in these techniques are utilized to reveal the obfuscation key or retrieve the original design. In this paper, we introduce LeGO, a learning-guided obfuscation framework that overcomes known vulnerabilities in a scalable and systematic manner, leading to a robust and lightweight locking mechanism. The proposed framework is guided by our security evaluation process that performs a thorough assessment of an obfuscated IP against various attacks and identifies the vulnerabilities. It then judiciously selects and applies a set of design modification steps or rules that can eliminate these vulnerabilities. Such a rule-based obfuscation process has the distinctive capability to address all existing as well as emerging attacks through the learning of appropriate design transformation steps that prevent these attacks. We present an efficient strategy to apply these rules on a design, while resolving any conflict. Our evaluation of the LeGO framework on a set of ISCAS85 and open-source IP benchmarks has shown promising results in terms of robustness against diverse attacks with an average of area, power and delay overhead of 39%, 45%, and 15%, respectively.

As the internet-of-things (IoT) era begins, there is a significant need for low-cost access control schemes that allow humans to activate and maintain IoT systems.Traditional biometric access control systems remain, however, vulnerable to physical attacks resulting in template theft/privacy, illegal access, etc. This paper aimed to address this by expanding on a proposal called BLOcKeR, which combines biometrics with two recent advances in hardware security—physically unclonable functions (PUFs) and hardware obfuscation. Hardware obfuscation is a technique to protect electronic hardware against access control circumvention attacks through locking mechanisms. A PUF is incorporated to tie the biometrics of the owner to the system. Combining these advances with biometrics, BLOcKeR protects a biometric system from physical attacks by locking its functionality and aims at ensuring successful activation of the locked system unlike the authentication /matching in biometric systems. In addition, unlike various existing approaches, BLOcKeR does not store the raw biometric of users while providing irreversibility, unlinkability, and revocability to the templates. We present a security analysis and experiments with more than 45,000 attack variants to evaluate BLOcKeR’s security against unauthorized access.

We propose three orthogonal techniques to secure Register-Transfer-Level (RTL) Intellectual Property (IP). In the first technique, the key-based RTL obfuscation scheme is proposed at an early design phase during High-Level Synthesis (HLS). Given a control-dataflow graph, we identify operations on non-critical paths and leverage synthesis information during and after HLS to insert obfuscation logic. In the second approach, we propose a robust design lockout mechanism for a key-obfuscated RTL IP when an incorrect key is applied more than the allowed number of attempts. We embed comparators on obfuscation logic output to check if the applied key is correct or not and a finite-state machine checker to enforce design lockout. Once locked out, only an authorized user (designer) can unlock the locked IP. In the third technique, we design four variants of the obfuscating module to camouflage the RTL design. We analyze the security properties of obfuscation, design lockout, and camouflaging. We demonstrate the feasibility on four datapath-intensive IPs and one crypto core for 32-, 64-, and 128-bit key lengths under three design corners (best, typical, and worst) with reasonable area, power, and delay overheads on both ASIC and FPGA platforms.

Editor’s note : If you are designing or integrating hardware IP blocks into your designs, and you are using common global supply chains, then reading this overview article on how to protect your IP against reverse engineering, piracy, and malicious alteration attacks is a must. The authors give a comprehensive overview of current countermeasures that can be used at RTL, gate-, and layout-level to protect your design with a focus on combinational and sequential logic locking and a discussion on merits, overheads, and shortcomings of such techniques. —Jurgen Teich, FAU Erlangen

With the advancement of system miniaturization and automation, Lab-on-a-Chip (LoC) technology has revolutionized traditional experimental procedures. Microfluidic Biochip (MFB) is an emerging branch of LoC with wide medical applications such as DNA sequencing, drug delivery, and point of care diagnostics. Due to the critical usage of MFBs, their security is of great importance. In this article, we exploit the vulnerabilities of two types of MFBs: Flow-based Microfluidic Biochip (FMFB) and Digital Microfluidic Biochip (DMFB). We propose a systematic framework for applying Reverse Engineering (RE) attacks and Hardware Trojan (HT) attacks on MFBs as well as for practical countermeasures against the proposed attacks. We evaluate the attacks and defense on various benchmarks where experimental results prove the effectiveness of our methods. Security metrics are defined to quantify the vulnerability of MFBs. The overhead and performance of the proposed attacks as well as countermeasures are also discussed.

At different stages of the Integrated Circuit (IC) lifecycle there are attacks which threaten to compromise the integrity of the design through piracy, reverse engineering, hardware Trojan insertion, side channel analysis, and other physical attacks. Some of the most notable challenges in this field deal specifically with Intellectual Property (IP) theft and reverse engineering attacks. One method by which some of these concerns can be addressed is by introducing hardware obfuscation to the design in various forms. In this work we evaluate the effectiveness of a few different forms of netlist-level hardware obfuscation of a 16-bit substitution box component of a customizable cipher MK-3. These obfuscation methods were attacked using a satisfiability (SAT) attack, which is able to iteratively rule out classes of keys at once. This has been shown to be very effective against many forms of hardware obfuscation. A method to successfully defend against this attack is described in this paper. This method introduces a modified SIMON block cipher as a One-way Random Function (ORF) that is used to generate an obfuscation key. The S-box obfuscated using this 32-bit key and a round-reduced implementation of the SIMON cipher is shown to be secure against a SAT attack for at least 5 days.

A clear majority of electronic devices applications used in our daily life require a reliable, secure architecture, e.g., healthcare, social security cards, electronic meters, and smart homes. As a result, many studies are trying to develop appropriate solutions to tackle hardware security threats such as IC piracy, IC overbuilding, reverse engineering, counterfeiting, and tampering. Hardware obfuscation has been introduced as one of the leading robust, low-cost security solutions against different security threats, especially when combined with physical unclonable functions. Considering the inherent irreproducibility of PUFs, this method can provide a high-level security system. However, finding an applicable existent PUF or implementing a new PUF design that meets each hardware obfuscation requirements is not a trivial task. This study reviews and discusses hardware security systems based on PUFs inherited variations and the corresponding hardware obfuscation approaches.

Hardware intellectual properties (IPs) used in diverse electronic systems face several critical security issues during their life cycle, including piracy, reverse engineering, and extraction of design secrets. To combat these issues, pre-silicon hardware obfuscation or logic locking has emerged as a promising solution and has been an active research topic over the past decade. However, in parallel, a number of functional and structural attacks on obfuscation have been discovered by the research community to break the protection provided by the existing obfuscation schemes. These attacks have played a major role in enhancing the security of hardware obfuscation schemes. In this paper, we introduce a novel combined attack modality, referred to as SOMA, which relies on judiciously combining the existing attacks to produce a significantly more powerful one. We demonstrate that such an attack can expose hidden exploits and measure the level of security offered by a given obfuscation technique. SOMA creates a sequence of attacks, where the outcome of each attack is used to guide the next and concludes with a key-refinement measure to restore the functionality of a locked IP. We demonstrate that SOMA can easily break major existing locking schemes that are believed to be secure with an attack accuracy average of 94.88%.

Logic locking aims to protect the intellectual property (IP) of integrated circuit (IC) designs throughout the globalized supply chain. The SAIL attack, based on tailored machine learning (ML) models, circumvents combinational logic locking with high accuracy and is amongst the most potent attacks as it does not require a functional IC acting as an oracle. In this work, we propose UNSAIL, a logic locking technique that inserts key-gate structures with the specific aim to confuse ML models like those used in SAIL. More specifically, UNSAIL serves to prevent attacks seeking to resolve the structural transformations of synthesis-induced obfuscation, which is an essential step for logic locking. Our approach is generic; it can protect any local structure of key-gates against such ML-based attacks in an oracle-less setting. We develop a reference implementation for the SAIL attack and launch it on both traditionally locked and UNSAIL-locked designs. In SAIL, a change-prediction model is used to determine which key-gate structures to restore using a reconstruction model. Our study on benchmarks ranging from the ISCAS-85 and ITC-99 suites to the OpenRISC Reference Platform System-on-Chip (ORPSoC) confirms that UNSAIL degrades the accuracy of the change-prediction model and the reconstruction model by an average of 20.13 and 17 percentage points (pp) respectively. When the aforementioned models are combined, which is the most powerful scenario for SAIL, UNSAIL reduces the attack accuracy of SAIL by an average of 11pp. We further demonstrate that UNSAIL thwarts other oracle-less attacks, i.e., SWEEP and the redundancy attack, indicating the generic nature and strength of our approach. Detailed layout-level evaluations illustrate that UNSAIL incurs minimal area and power overheads of 0.26% and 0.61%, respectively, on the million-gate ORPSoC design., IEEE Transactions on Information Forensics and Security (TIFS)

Hardware obfuscation is widely used in practice to counteract reverse engineering. In recent years, low-level obfuscation via camouflaged gates has been increasingly discussed in the scientific community and industry. In contrast to classical high-level obfuscation, such gates result in recovery of an erroneous netlist. This technology has so far been regarded as a purely defensive tool. We show that low-level obfuscation is in fact a double-edged sword that can also enable stealthy malicious functionalities.In this work, we present Doppelganger, the first generic design-level obfuscation technique that is based on low-level camouflaging. Doppelganger obstructs central control modules of digital designs, e.g., Finite State Machines (FSMs) or bus controllers, resulting in two different design functionalities: an apparent one that is recovered during reverse engineering and the actual one that is executed during operation. Notably, both functionalities are under the designer’s control.In two case studies, we apply Doppelganger to a universal cryptographic coprocessor. First, we show the defensive capabilities by presenting the reverse engineer with a different mode of operation than the one that is actually executed. Then, for the first time, we demonstrate the considerable threat potential of low-level obfuscation. We show how an invisible, remotely exploitable key-leakage Trojan can be injected into the same cryptographic coprocessor just through obfuscation. In both applications of Doppelganger, the resulting design size is indistinguishable from that of an unobfuscated design, depending on the choice of encodings.

Securing intellectual property (IP) blocks have become a huge concern for the designers due to increasing attacks at different stages of the design. This wide array of attacks from IP piracy, counterfeiting, reverse engineering to overproduction has prompted designers to look into protection mechanisms to limit unauthorized access to the actual design. Logic locking/obfuscation is such a technique that protects designs from unauthorized usages by embedding locking keys into the design that are unknown to adversaries. However, the majority of the proposed locking techniques work at the gate-level of the design, and it has been shown that the correct keys can be successfully retrieved through various adversarial attacks such as SAT attacks, removal attacks, and reverse engineering. In this chapter, we propose a locking technique at a higher level of abstraction and show that using high-level synthesis, this technique is far more resilient towards different attacks and provides better control in terms of performance parameters to the designer compared to other techniques. The key element of this technique is locking the design at higher levels of abstractions (i.e., C/C++) when the designers have a better understanding of the design’s critical functions/information. In the next step, a high-level synthesis (HLS) tool is used to automatically generate locked RTL modules from an untimed C/C++ description. The proposed framework is dependent on HLS. As a result, design security also depends on a secure HLS process. For this purpose, we also provide a detailed security assessment on the HLS process and show potential vulnerabilities during its translation. We also present some verification approaches to address these vulnerabilities to secure the design and provide a robust framework for IP protection.

It is important to protect the intellectual properties of logic circuits from reverse engineering. One of the countermeasures is logic obfuscation, which complicates the internal structures of logic circuits to prevent reverse engineering. A few researches have been conducted to simplify logic obfuscation using software obfuscation tools and high-level synthesis. However, it is not quantitatively evident whether the generated circuits are more complex than plain circuits. This paper discusses the three metrics of obfuscated netlists to evaluate the obfuscation methods proposed in previous studies. We confirmed that the obfuscated circuits are actually more complex than the original circuits using the proposed metrics.

The horizontal business model adopted by the semiconductor industry has resulted in a manufacturing process that has integrated various foreign entities focusing on individual production steps. However, serious trust issues have emerged with the internationalization of the semiconductor supply chain, and the trust concerns grow further with the proliferation of theft, reverse engineering (RE), and piracy of hardware intellectual property (IP). Unlike the software industry, the semiconductor supply chain cannot benefit from traditional cryptographic solutions due to the requirement of white-box accessibility to the hardware IP. Therefore, hardware obfuscation has originated as a potential countermeasure against dreaded supply chain attacks. The obfuscation process aims to hide the design intent and lock functionality by introducing structural and functional transformations to the IP, which increases the resistance against unauthorized use and potential exploitation of the design by an adversary. In this chapter, we investigate hardware obfuscation techniques that have been developed in the past decade and the limitations and challenges of these techniques. In particular, we explore the evolution of different techniques that are applicable at various supply chain stages of the semiconductor life cycle, the development of obfuscation benchmarks, and the research trends in the area of obfuscation. We also expand on the innovative attacks that have been developed to compromise the obfuscation techniques, as well as the countermeasures that are introduced to combat them. This chapter also sheds light on the lessons learned from the decade-long research on obfuscation by discussing the attack trends and unsolved challenges. Finally, we conclude by presenting a road map that aims to improve the existing solutions and provides improved security metrics for systematic evaluation.

Obfuscation is a promising solution for securing hardware intellectual property (IP) against various attacks, such as reverse engineering, piracy, and tampering. Due to the lack of standard benchmarks, proposed techniques by researchers and practitioners in the community are evaluated by existing benchmark suites such as ISCAS-85, ISCAS-89, and ITC-99. These open source benchmarks, though widely utilized, are not necessarily suitable for the purpose of evaluating hardware obfuscation techniques. In this context, we believe that it is important to establish a set of well-defined benchmarks, on which the effectiveness of new and existing obfuscation techniques and attacks on them can be compared. In this paper, we describe a set of such benchmarks obfuscated with some popular methods that we created to facilitate this need. These benchmarks have been made publicly available on Trust-Hub web portal. Moreover, we provide the first evaluation of several obfuscation approaches based on the metrics and existing attacks using this new suite. Finally, we discuss our observations and guidance for future work in hardware obfuscation and benchmarking.

Security in daily transactions, not only in the financial sector, but also in various upcoming Industrial smart application areas needs a generic solution, out of the cat and mouse race, where frequently vulnerabilities are pointed out and a quick patch is fabricated to resolve the issue temporarily. An impromptu solution to this protracted issue will not be enough to solve on the long run, thus dedicated researchers have been putting efforts to their best for finding the real problem by asking the right questions. Through this paper authors have attempted to trace the current issues in handling decentralised ledger system using blockchain technology and discussed state of the art management in auditing hardware obfuscation techniques.

An Intellectual Property (IP) in Very Large Scale Integrated (VLSI) is a reusable logic unit or functionality or a cell or a layout design that is developed with the creative or innovative idea of licensing to multiple vendors which can be used in their design. Due to globalization of Integrated circuit (IC) design flow, dishonest people in the supply chain can pirate IC's, overbuild IC's, counterfeiting and insert hardware Trojans. Looking into these issues, security of such devices becomes a major challenging job. This paper gives the survey of various methods presented by researchers to secure the innovated design from the third party. The paper is concluded with a need for research in machine learning or deep learning based methodologies for hardware security in IC/IP.

As a result of the increased use of contract foundries, internet protocol (IP) theft, excess production and reverse engineering are major concerns for the electronics and defense industries. Hardware obfuscation and IP locking can be used to make a design secure by replacing a part of the circuit with a key-locked module. In order to ensure each chip has unique keys, previous work has proposed using physical unclonable functions (PUF) to lock the circuit. However, these designs are area intensive. In this work, we propose a strong PUF-based hardware obfuscation scheme to uniquely lock each chip.

Logic obfuscation yields hardware security against various threats, such as Intellectual Property (IP) piracy and reverse engineering. Evolving Boolean satisfiability (SAT) attacks have challenged the hardware security assurance rendered by various obfuscation methods. Recent works have centered on using re-configurable components such as Look-Up-Tables (LUTs) to enhance resiliency against attacks. Resiliency against SAT-attack is guaranteed when the size of LUT (number of inputs) is large. However, this incurs significant power, area and performance overheads. To address this challenge, this work proposes logic encryption based on customized LUT to make this practical. We propose two variants of the customized LUT based obfuscation: LUT+MUX based obfuscation, securing the design through routing obfuscation by MUX(multiplexer) and logic obfuscation of LUTs; and LUT+LUT based obfuscation, benefiting from LUT based obfuscation reinforced with additional logic/routing obfuscation. We evaluate the hardware security and overheads of the proposed two variants of customized LUT-based obfuscation on various benchmarks. Proposedcustomized LUT-based obfuscation breaks the security, power, and area trade-offs. The proposed solution is shown to be robust against SAT-attacks and power analysis-based side-channel attacks with8×reduced area and 3×reduced power on an average compared tostate-of-the-art LUT-based obfuscation.

Ahstract-Various attacks on hardware intellectual properties (IPs) have been successful in obtaining design information that can be used to reverse engineer a system, create counterfeits, or insert hardware Trojans. Key-based hardware obfuscation is an attractive solution that helps prevent such attacks. In this paper, for the first time, we propose a key error tolerant obfuscation approach that achieves graceful degradation in output Quality of Service (QoS) as the bit error rate (BER) in obfuscation key increases. The approach, which we refer to it as, “Quality Obfuscation”, is applicable to a large variety of IPs, including digital signal processing (DSP) and approximating computing IPs, which are resilient to output QoS degradation. We present a complete obfuscation framework that can be adapted to any error tolerance rate. To demonstrate its robustness, we obfuscate several common DSP IP blocks and observe the performance under various percentages of bit-flips in the key. We show that our approach provides controllability of system quality, as well as the strong protection at low overhead, e.g., average 15% area and 5.9% power overhead to tolerate 10% BER.

A number of studies of hardware security aim to thwart piracy, overbuilding, and reverse engineering (RE) by obfuscating and/or camouflaging. However, these techniques incur high overheads, and integrated circuit (IC) camouflaging cannot provide any protection for the gate-level netlist of the third party intellectual property (IP) core or the single large monolithic IC. In order to circumvent these weaknesses, this brief elaborately analyzes these hardware security techniques and proposes a practical logic obfuscation method with low overheads to prevent an adversary from RE both the gate-level netlist and the layout-level geometry of IP/IC and protect IP/IC from piracy and overbuilding. Experimental evaluations demonstrate the low area, power, and zero performance overhead of the proposed obfuscation technique.

Hardware security is a matter of increasing importance in the modern world. With increasing threats of piracy and theft, it is needed to devise methodologies to mitigate these concerns. Obfuscating the design netlist is a popular method to achieve this to a significant extent. However, full security guarantee is not provided with the encryption approach. Under this scenario, a watermarking method complements the security guarantee by providing claims of IP authorship. In this paper, we present a unified methodology for circuit encryption and watermarking to enhance hardware security. Experiments on several ISCAS’85 benchmark circuits show that the proposed methodology has average 8.2% area overhead and 11.3% power overhead.

To reduce the cost of ICs and to meet the market's demand, a considerable portion of manufacturing supply chain, including silicon fabrication, packaging and testing may be pushed offshore. Utilizing a global IC manufacturing supply chain, and inclusion of non-trusted parties in the supply chain has raised concerns over security and trust related challenges including those of overproduction, counterfeiting, IP piracy, and Hardware Trojans to name a few. To reduce the risk of IC manufacturing in an untrusted and globally distributed supply chain, the researchers have proposed various locking and obfuscation mechanisms for hiding the functionality of the ICs during the manufacturing, that requires the activation of the IP after fabrication using the key value(s) that is only known to the IP/IC owner. At the same time, many such proposed obfuscation and locking mechanisms are broken with attacks that exploit the inherent vulnerabilities in such solutions. The past decade of research in this area, has resulted in many such defense and attack solutions. In this paper, we review a decade of research on hardware obfuscation from an attacker perspective, elaborate on attack and defense lessons learned, and discuss future directions that could be exploited for building stronger defenses.

Effective resistance to intellectual property (IP) piracy, overproduction and reverse engineering are becoming more and more necessary in the integrated circuit (IC) supply chain. To protect the hardware, the obfuscation methodology hides the original function by adding a large number of redundant states. However, existing hardware obfuscation approaches have hardware overhead and efficiency of obfuscation limitations. This paper proposed a novel methodology for IP security using the minimum spanning tree finite state machine (MST-FSM) obfuscation. In the minimum spanning tree (MST) algorithm, the Hamming distance defines the cost of obfuscated states. The Kruskal algorithm optimizes the connection relationship of obfuscated states by computing the Hamming distance of the MST-FSM. The proposed MST-FSM is automatically generated and embedded in the hardware IP with the self-building program. Finally, the MST-FSM is applied on the itc99 benchmark circuits and encryption standard IP cores. Compared with other state-of-the-arts, the obfuscation potency is improved by 3.57%, and the average hardware cost is decreased by about 6.01%.

The manufacturing of integrated circuits (IC) outside of the design houses makes it possible for the adversary to easily perform a reverse engineering attack against intellectual property (IP)/IC. The aim of this attack can be the IP piracy, overproduction, counterfeiting or inserting hardware Trojan (HT) throughout the supply chain of the IC. Preventing hardware Trojan insertion is a significant issue in the context of hardware security (HS) and has not been considered in most of the previous logic encryption methods. To eliminate this problem, in this paper an Anti-Trojan insertion algorithm is presented. The idea is based on the fact that reducing the signals with low-observability (LO) and low-controllability (LC) can prevent HT insertion significantly. The security of logic encryption methods depends on the algorithm and the encryption key. However, the security of these methods has been compromised by SAT attacks over recent years. SAT attacks, can decode the correct key from most logic encryption techniques. In this article, by using the PUF-based encryption, the applied key in the encryption is randomized and SAT attack cannot be performed. Based on the output of PUF, a unique encryption has been made for each chip that preventing from counterfeiting and IP piracy.

Widespread outsourcing of integrated circuits fabrication increases the vulnerability to security threats. In this paper, we address approach that incorporates hardware design obfuscation scheme to protect a design against various forms of attacks. Hardware obfuscation is a technique by which an integrated circuit is modified to intentionally conceal its functionality and schematic. We consider hardware security through the reference monitor obfuscation. We obscure the connectivity of reference monitor so that an attacker cannot gain its functionality and original structure.

Obfuscation is a technique for protecting hardware intellectual property (IP) blocks against reverse engineering, piracy, and malicious modifications. Current obfuscation efforts mainly focus on functional locking of a design to prevent black-box usage. They do not directly address hiding design intent through structural transformations, which is an important objective of obfuscation. We note that current obfuscation techniques incorporate only: (1) local, and (2) predictable changes in circuit topology. In this paper, we present SAIL, a structural attack on obfuscation using machine learning (ML) models that exposes a critical vulnerability of these methods. Through this attack, we demonstrate that the gate-level structure of an obfuscated design can be retrieved in most parts through a systematic set of steps. The proposed attack is applicable to all forms of logic obfuscation, and significantly more powerful than existing attacks, e.g., SAT-based attacks, since it does not require the availability of golden functional responses (e.g. an unlocked IC). Evaluation on benchmark circuits show that we can recover an average of around 84% (up to 95%) transformations introduced by obfuscation. We also show that this attack is scalable, flexible, and versatile., 6 pages, 6 figures, 8 tables

The separation of manufacturing and design processes in the integrated circuit industry to tackle the ever increasing circuit complexity and time to market issues has brought with it some major security challenges. Chief among them is IP piracy by untrusted parties. Hardware obfuscation which locks the functionality and modifies the structure of an IP core to protect it from malicious modifications or piracy has been proposed as a solution. In this paper, we develop an efficient hardware obfuscation method, called Mystic (Mystifying IP Cores), to protect IP cores from reverse engineering, IP overproduction, and IP piracy. The key idea behind Mystic is to add additional state transitions to the original/functional FSM (Finite State Machine) that are taken only when incorrect keys are applied to the circuit. Using the proposed Mystic obfuscation approach, the underlying functionality of the IP core is locked and normal FSM transitions are only available to authorized chip users. The synthesis results of ITC99 circuit benchmarks for ASIC 45nm technology reveal that the Mystic protection method imposes on average 5.14% area overhead, 5.21% delay overhead, and 8.06% power consumption overheads while it exponentially lowers the probability that an unauthorized user will gain access to or derive the chip functionality.

IC piracy is a significant security threat, where malicious manufacturers can produce unauthorized extra chips and/or steal the information of a design through reverse engineering attempts. As a countermeasure, hardware obfuscation schemes usually withhold a part of the design (which thereafter constitutes the "key") by replacing it with configurable modules. Enforcing the configurable module to be filled in with the withheld key information enables a post-manufacturing activation of each authenticate chip, albeit with a a need to state the threat of a leaked common key. To ensure that each chip has a unique key, Physically Unclonable Functions (PUFs) have been proposed to be integrated with hardware obfuscation. Such a paradigm is constrained to use weak PUFs, because, to uniquely set the key (the content of the configurable module) for each chip, the designer needs to fully characterize the PUFs for all the chips. In this paper, we argue that a powerful attacker in the position of a manufacturer can fully characterize all the weak PUFs, and use any leaked key to break the obfuscation framework. This paper proposes a strong PUF-based hardware obfuscation scheme to effectively prevent IC piracy even in the case of a leaked key from some activated chip.

The increasing IC manufacturing cost encourages a business model where design houses outsource IC fabrication to remote foundries. Despite cost savings, this model exposes design houses to IC piracy as remote foundries can manufacture in excess to sell on the black market. Recent efforts in digital hardware security aim to thwart piracy by using XOR-based chip locking, cryptography, and active metering. To counter direct attacks and lower the exposure of unlocked circuits to the foundry, we introduce a multiplexor-based locking strategy that preserves test response allowing IC testing by an untrusted party before activation. We demonstrate a simple yet effective attack against a locked circuit that does not preserve test response, and validate the effectiveness of our locking strategy on IWLS 2005 benchmarks.

This is the first work augmenting hardware attacks mounted on obfuscated circuits by incorporating deep recurrent neural network (D-RNN). Logic encryption obfuscation has been used for thwarting counterfeiting, overproduction, and reverse engineering but vulnerable to attacks. There have been efficient schemes, e.g., satisfiability-checking (SAT) based attack, which can potentially compromise hardware obfuscation circuits. Nevertheless, not only there exist countermeasures against such attacks in the state-of-the-art (including the recent delay+logic locking (DLL) scheme in DAC'17), but the sheer amount of time/resources to mount the attack could hinder its efficacy. In this paper, we propose a deep RNN-oriented approach, called BOCANet, to (i) compromise the obfuscated hardware at least an order-of magnitude more efficiently (>20X faster with relatively high success rate) compared to existing attacks; (ii) attack such locked hardware even when the resources to the attacker are only limited to insignificant number of I/O pairs (< 0.5\%) to reconstruct the secret key; and (iii) break a number of experimented benchmarks (ISCAS-85 c423, c1355, c1908, and c7552) successfully.

Due to the globalized semiconductor supply chain, integrated circuits suffer from hardware security attacks. Among various attacks, hardware Trojan insertions have emerged as a major security concern. An adversary modifies the original circuit to accomplish the malicious intentions through the hardware Trojan. Hardware obfuscation has been demonstrated as a promising technique to strengthen hardware implementation against hardware Trojan insertion in the late stage of the supply chain. This work reviews the state-of-the-art hardware obfuscation methods, with the special emphasis on the corresponding efforts made for hardware Trojan prevention and detection. Furthermore, we summarize the evaluation metrics utilized in literature to assess the effectiveness of hardware obfuscation methods. Future directions for hardware obfuscation against hardware Trojans are discussed in this work, as well.

In the era of globalized Integrated Circuit (IC) design and manufacturing flow, a rising issue to the silicon industry is various attacks on hardware intellectual property (IP). As a measure to ensure security along the supply chain against IP piracy, tampering and reverse engineering, hardware obfuscation is considered a reliable defense mechanism. Sequential and combinational obfuscations are the primary classes of obfuscation, and multiple methods have been proposed in each type in recent years. This paper presents an overview of obfuscation techniques and a qualitative comparison of the two major types.

In today's diversified semiconductor supply-chain, protecting intellectual property (IP) and maintaining manufacturing integrity are important concerns. Circuit obfuscation techniques such as logic encryption and IC camouflaging can potentially defend against a majority of supply-chain threats such as stealthy malicious design modification, IP theft, overproduction, and cloning. Recently, a Boolean Satisfiability (SAT) based attack, namely the SAT attack has been able to deobfuscate almost all traditional circuit obfuscation schemes, and as a result, a number of defense solutions have been proposed in literature. All these defenses are based on the implicit assumption that the attacker needs a perfect deobfuscation accuracy which may not be true in many practical cases. Therefore, in this paper by relaxing the exactness constraint on deobfuscation, we propose the AppSAT attack, an approximate deobfuscation algorithm based on the SAT attack and random testing. We show how the AppSAT attack can deobfuscate 68 out of the 71 benchmark circuits that were obfuscated with state-of-the-art SAT attack defenses with an accuracy of, n being the number of inputs. AppSAT shows that with current SAT attack defenses there will be a trade-off between exact-attack resiliency and approximation resiliency.

The multinational, distributed, and multistep nature of integrated circuit (IC) production supply chain has introduced hardware-based vulnerabilities. Existing literature in hardware security assumes ad hoc threat models, defenses, and metrics for evaluation, making it difficult to analyze and compare alternate solutions. This paper systematizes the current knowledge in this emerging field, including a classification of threat models, state-of-the-art defenses, and evaluation metrics for important hardware-based attacks.

While the globalization of the semiconductor production process has accelerated innovation, lowered costs, and reduced time-to-market, it has also created grave trust issues among the different entities involved in the production process. Theft, reverse engineering, and piracy of silicon intellectual property (IP) are the realities that manufacturers and vendors of integrated circuits must face today. In order to combat these threats, obfuscation has emerged as a viable candidate for semiconductor or hardware IP protection. Obfuscation techniques aim at concealing or locking the underlying intellectual property of a semiconductor product, such as IP cores, gate-level designs, or layout, in order to prevent an untrusted party or adversary from reverse engineering and/or exploiting the design. In this chapter, we will review emerging techniques for hardware obfuscation . We will describe the semiconductor supply chain in detail and outline the specific threats associated with each stage in the supply chain. We will also introduce the field of software obfuscation and related concepts that predate hardware obfuscation. Lastly, we will introduce relevant metrics for implementing and evaluating the various hardware obfuscation techniques.

Hardware obfuscation techniques have been studied in preventing reverse engineering and piracy issues. One branch of these techniques is permutation-based obfuscation. In this chapter, permutation-based obfuscation is presented at both the chip level and board level. Prior to providing the implementation details, several implementation-related topics are discussed. These topics consist of the difference between the chip-level and board-level designs as well as the introduction of a general obfuscation implementation flow. Besides the flow, this chapter also provides methodologies for evaluating the obfuscation performance. Finally, potential attacks on permutation-based obfuscation are discussed along with their corresponding countermeasures.

The risk of code reverse-engineering is particularly acute for embedded processors which often have limited available resources to protect program information. Previous efforts involving code obfuscation provide some additional security against reverse- engineering of programs, but the security benefits are typically limited and not quantifiable. Hence, new approaches to code protection and creation of associated metrics are highly desirable. This paper has two main contributions. We propose the first hybrid diversification approach for protecting embedded software and we provide statistical metrics to evaluate the protection. Diversification is achieved by combining hardware obfuscation at the microarchitecture level and the use of software-level obfuscation techniques tailored to embedded systems. Both measures are based on a compiler which generates obfuscated programs, and an embedded processor implemented in an FPGA with a randomized Instruction Set Architecture (ISA) encoding to execute the hybrid obfuscated program. We employ a fine-grained, hardware-enforced access control mechanism for information exchange with the processor and hardware-assisted booby traps to actively counteract manipulation attacks. It is shown that our approach is effective against a wide variety of possible information disclosure attacks in case of a physically present adversary. Moreover, we propose a novel statistical evaluation methodology that provides a security metric for hybrid-obfuscated programs.

This chapter discusses the fundamental concepts of design and testing and their role in hardware obfuscation. It outlines the traditional design flow of integrated circuits and assesses the vulnerabilities associated with the verification techniques and testing structures that can expose the design details and help reverse-engineer the functionality. A survey of security enhancement schemes has been presented. Furthermore, different classifications of hardware obfuscation have been discussed that cover the associated vulnerabilities of key management in nonvolatile memories (NVMs). The review of nonvolatile memories, emerging technologies and hardware-based cryptographic primitives, physical unclonable functions (PUFs) and true random number generators (TRNGs) and their use in hardware obfuscation techniques has been deliberated.

This book introduces readers to various threats faced during design and fabrication by todays integrated circuits (ICs) and systems. The authors discuss key issues, including illegal manufacturing of ICs or IC Overproduction, insertion of malicious circuits, referred as Hardware Trojans, which cause in-field chip/system malfunction, and reverse engineering and piracy of hardware intellectual property (IP). The authors provide a timely discussion of these threats, along with techniques for IC protection based on hardware obfuscation, which makes reverse-engineering an IC design infeasible for adversaries and untrusted parties with any reasonable amount of resources. This exhaustive study includes a review of the hardware obfuscation methods developed at each level of abstraction (RTL, gate, and layout) for conventional IC manufacturing, new forms of obfuscation for emerging integration strategies (split manufacturing, 2.5D ICs, and 3D ICs), and on-chip infrastructure needed for secure exchange of obfuscation keys- arguably the most critical element of hardware obfuscation.

Intellectual property theft by reverse engineering leads to loss of revenue and threatens security of integrated circuits. A number of design obfuscation techniques been proposed to counter IC reverse engineering. Most such techniques rely on functional misdirection at gate or module level but, do not prevent leakage of visual information about design characteristics from the physical layout. For example, capitalizing on relative difference in sizes among various functional units and their pin counts, an attacker may still be able to hypothesize about function of a unit, irrespective of any obfuscation performed on them. Hence, we propose meta-obfuscation techniques to harden other obfuscation mechanisms against physical information leakage. Our aim is to add complexity in the visual domain so that the physical characteristics of a design do not have notable correlation to its functionality. We explore various metrics to quantify the quality of the proposed meta-obfuscation and apply them in design automation. Experimental results show improvement in metrics used and also, highlight relevant overheads for meta-obfuscation.

Logic locking is an Intellectual Property (IP) protection technique that thwarts IP piracy, hardware Trojans, reverse engineering, and IC overproduction. Researchers have taken multiple attempts in breaking logic locking techniques and recovering its secret key. A Boolean Satisfiability (SAT) based attack has been recently presented that breaks all the existing combinational logic locking techniques. In this paper, we develop a lightweight countermeasure against this and other attacks that aim at gradually pruning the key search space. Our proposed logic locking technique, referred to as SARLock, maximizes the required number of distinguishing input patterns to recover the secret key. SARLock thwarts the SAT attack by rendering the attack effort exponential in the number of bits in the secret key, while its overhead grows only linearly.

An effective technique to combat IC piracy is to render infringement impractical by making physical tampering unprofitable and attacks computationally infeasible. EPIC accomplishes this using a novel low-overhead combinational chip-locking system and a chip-activation protocol based on public-key cryptography.

Hardware metering to prevent IC piracy is a challenging and important problem. The authors propose a combinational locking scheme based on intelligent placement of the barriers throughout the design in which the objective is to maximize the effectiveness of the barriers and to minimize the overhead.

Hardware intellectual-property (IP) cores have emerged as an integral part of modern system-on-chip (SoC) designs. However, IP vendors are facing major challenges to protect hardware IPs from IP piracy. This paper proposes a novel design methodology for hardware IP protection using netlist-level obfuscation. The proposed methodology can be integrated in the SoC design and manufacturing flow to simultaneously obfuscate and authenticate the design. Simulation results for a set of ISCAS-89 benchmark circuits and the advanced-encryption-standard IP core show that high levels of security can be achieved at less than 5% area and power overhead under delay constraint.

System-on-Chip (SoC) designs rely heavily on reusable and pre-verified hardware intellectual property (IP) cores. Recent trends of IP piracy and reverse-engineering, and malicious circuit modifications (“hardware Trojans”) in remote fabrication facilities, are major concerns. In this chapter, we propose a comprehensive secure SoC design flow based on the principle of design obfuscation that can provide effective protection against IP piracy as well as hardware Trojan attacks. We present the overall approach and illustrate the obfuscation process with an example. We provide a brief survey of related work on hardware obfuscation and then present two variations of obfuscation, which differ in the level of protection and the complexity of implementation. The first approach is based on extraction and modification of the state transition from the gate-level synthesized design, such that normal operation is possible only on the successful application of a correct initialization sequence. Optionally, an obfuscated register transfer level (RTL) design can be generated by de-compilation of the obfuscated netlist. In the second approach, a register transfer level IP is obfuscated by manipulating its control and data flow graphs. The proposed approaches are scalable, and can be integrated in the SoC design and manufacturing flow to benefit all parties associated with the design flow, while minimally affecting the end-user experience.

While hardware obfuscation has been used in industry for many years, very few scientific papers discuss layout-level obfuscation. The main aim of this paper is to start a discussion about hardware obfuscation in the academic community and point out open research problems. In particular, we introduce a very flexible layout-level obfuscation tool that we use as a case study for hardware obfuscation. In this obfuscation tool, a small custom-made obfuscell is used in conjunction with a standard cell to build a new obfuscated standard cell library called Obfusgates. This standard cell library can be used to synthesize any HDL code with standard synthesis tools, e.g. Synopsis Design Compiler. However, only obfuscating the functionality of individual gates is not enough. Not only the functionality of individual gates, but also their connectivity, leaks important important information about the design. In our tool we therefore designed the obfuscation gates to include a large number of "dummy wires". Due to these dummy wires, the connectivity of the gates in addition to their logic functionality is obfuscated. We argue that this aspect of obfuscation is of great importance in practice and that there are many interesting open research questions related to this.

International audience; Hardware piracy is a threat that is becoming more and more serious these last years. The different types of threats include mask theft, illegal overproduction, as well as the insertion of malicious alterations to a circuit, referred to as Hardware Trojans. To protect circuits from overproduction, circuits can be encrypted so that only authorized users can use the circuits. In this paper, we propose an encryption technique that also helps thwarting Hardware Trojan insertion. Assuming that an attacker will attach a Hardware Trojan to signals with low controllability in order to make it stealthy, the principle of the encryption is to minimize the number of signals with low controllability.

Obfuscation is a technique which makes design less intelligible in order to prevent or increase reverse engineering effort. In this paper, a new approach to hardware obfuscation by inserting constant value generators (CVGs) is proposed. A CVG is a circuit that generates the same fixed logic value but will not be minimized by the synthesizer. CVGs can be used to create new logic primitives, embed watermarks and introduce fictive interdependencies in the circuit. They help to hide actual design performance information by tricking the synthesizer tools to generate deceiving delay reports through the false paths. Accepted version

Due to globalization of Integrated Circuit (IC) design flow, rogue elements in the supply chain can pirate ICs, overbuild ICs, and insert hardware trojans. EPIC [1] obfuscates the design by randomly inserting additional gates; only a correct key makes the design to produce correct outputs. We demonstrate that an attacker can decipher the obfuscated nctlist, in a time linear to the number of keys, by sensitizing the key values to the output. We then develop techniques to fix this vulnerability and make obfuscation truly exponential in the number of inserted keys.

Malicious hardware Trojan circuitry inserted in safety-critical applications is a major threat to national security. In this work, we propose a novel application of a key-based obfus-cation technique to achieve security against hardware Trojans. The obfuscation scheme is based on modifying the state transition function of a given circuit by expanding its reachable state space and enabling it to operate in two distinct modes — the normal mode and the obfuscated mode. Such a modification obfuscates the rareness of the internal circuit nodes, thus making it difficult for an adversary to insert hard-to-detect Trojans. It also makes some inserted Trojans benign by making them activate only in the obfuscated mode. The combined effect leads to higher Trojan detectability and higher level of protection against such attack. Simulation results for a set of benchmark circuits show that the scheme is capable of achieving high levels of security at modest design overhead. Categories and Subject Descriptors B.6.1 [Logic Design]: Design Styles-sequential circuits; K.6.5 [Management of Computing and Information Systems]: Security and Protection-physical security General Terms Design, Security