Search

This is the first work that incorporates recent advancements in "explainability" of machine learning (ML) to build a routing obfuscator called ObfusX. We adopt a recent metric---the SHAP value---which explains to what extent each layout feature can reveal each unknown connection for a recent ML-based split manufacturing attack model. The unique benefits of SHAP-based analysis include the ability to identify the best candidates for obfuscation, together with the dominant layout features which make them vulnerable. As a result, ObfusX can achieve better hit rate (97% lower) while perturbing significantly fewer nets when obfuscating using a via perturbation scheme, compared to prior work. When imposing the same wirelength limit using a wire lifting scheme, ObfusX performs significantly better in performance metrics (e.g., 2.4 times more reduction on average in percentage of netlist recovery).

Modern physical design flows highly depend on design space exploration to find the commercial tools’ clock tree synthesis (CTS) parameters that lead to optimized clock trees. However, such exploration is often time-consuming and computationally inefficient. In this paper, we overcome this drawback by proposing a novel framework named GAN-CTS, which utilizes conditional generative adversarial network (GAN) to predict and optimize CTS outcomes. Our framework is built upon three sequential learning stages. First, to precisely characterize distinct designs, we leverage transfer learning to extract netlist features directly from placement images. Second, we perform regression learning using various methods to predict the target CTS outcomes and demonstrate that the proposed multitask learning approach achieves better accuracy than the metamodeling method adopted by previous works. To fully benefit from the predictions made by our framework, we further quantitatively interpret the importance of each CTS input parameter subject to various design objectives through attribution-based learning. Finally, generative adversarial learning is leveraged to optimize the target clock metrics with the guidance provided by the pre-trained regression model. To substantiate the generality of our framework, we perform validations on four unseen netlists that are not utilized in the training process. Experimental results conducted on real-world designs demonstrate that our framework (1) achieves an average prediction error of 3%, (2) improves the commercial tool’s auto-generated clock tree by 20.7% in clock power, 21.5% in clock wirelength, 36.1% in the worst skew, and (3) reaches an F1-score of 0.93 in the classification task of determining successful and failed CTS runs.

This work introduces a generic, machine learning (ML)-based platform for functional reverse engineering (RE) of circuits. Our proposed platform GNN-RE leverages the notion of graph neural networks (GNNs) to (i) represent and analyze flattened/ unstructured gate-level netlists, (ii) automatically identify the boundaries between the modules or sub-circuits implemented in such netlists and (iii) classify the sub-circuits based on their functionalities. For GNNs in general, each graph node is tailored to learn about its own features and its neighboring nodes, which is a powerful approach for the detection of any kind of sub-graphs of interest. For GNN-RE, in particular, each node represents a gate and is initialized with a feature vector that reflects on the functional and structural properties of its neighboring gates. GNN-RE also learns the global structure of the circuit, which facilitates identifying the boundaries between subcircuits in a flattened netlist. Initially, to provide high-quality data for training of GNN-RE, we deploy a comprehensive dataset of foundational designs/components with differing functionalities, implementation styles, bit-widths, and interconnections. GNN-RE is then tested on the unseen shares of this custom dataset, as well as the EPFL benchmarks, the ISCAS-85 benchmarks, and the 74X series benchmarks. GNN-RE achieves an average accuracy of 98:82% in terms of mapping individual gates to modules, all without any manual intervention or post-processing. We also release our code and source data 1.

The rapid growth of the globalized integrated circuit (IC) supply chain has drawn the attention of numerous malicious actors that try to exploit it for profit. One of the most prominent targets of such parties is the third-party intellectual property (3PIP) vendors and their circuit designs. With the increasing number of transactions between vendors and system integrators, the threat of IP reuse and piracy has become a significant consideration for the IC industry. What is more, the correctness of 3PIP designs should be verified before integration, imposing another challenge for 3PIP vendors since they have to prove the functionality of their designs to system integrators while protecting the privacy of the circuit implementations. To eliminate this deadlock, we utilize the cryptographic technique of “zero-knowledge proofs” to enable 3PIP vendors to convince system integrators about various functional properties of a circuit (e.g., area, power, frequency) without disclosing its netlist (i.e., in zero-knowledge). Our approach comprises a circuit compiler that transforms arbitrary netlists into a zero knowledge-friendly format and a library of modules that provide cryptographic guarantees for various properties of the netlist while hiding the actual gates. We evaluate our method using combinational and sequential circuits from the ISCAS and ITC benchmark suites.

Malicious alteration in an IC design is generally referred to as Hardware Trojans (HT). The involvement of multiple entities in the VLSI design cycle has made the process of HT detection very challenging. This paper presents a novel method for the detection of HT at the gate level of abstraction. A path retrace algorithm detects the nets added/deleted by an adversary along with its location. The netlists of the genuine circuit (design netlist) and the Trojan inserted circuit are used by the algorithm to detect the malicious nets in the circuit. This method utilizes testability analysis as the metric for segregating malicious nets in the compromised circuit netlist. Netlist of the fabricated IC, which is obtained through reverse engineering and the design netlist of the original circuit are used to determine the testability parameters such as controllability and observability of the nets. Based on the variation in testability metrics of a signal in the original circuit, the path retrace algorithm identifies the malicious gates inserted into the original circuit. In addition, the algorithm also helps to isolate the Trojan circuit and comprehend its functional implication on the original design. Using the list of malicious gates and compromised circuit netlist, it is possible to identify the Trojan nets inserted by the adversary. This technique is more effective in detecting functional Trojans as compared to techniques employing reverse engineered images as it is design parameter independent and impervious to noise.

In this work, we advance the security promise of split manufacturing through judicious handling of interconnects. First, we study the cost-security trade-offs underlying for split manufacturing, which are limiting its adoption. Next, aiming to resolve these concerns, we propose three effective and efficient strategies to dedicatedly lift nets to higher metal layers. Towards this end, we design custom “elevating cells” and devise procedures for routing blockages. All our techniques are employed in a commercial-grade computer-aided design (CAD) framework. For our security analysis, we leverage various state-of-the-art attacks (network flow-based attack, routing-congestion-aware attack, and deep learning-based attack), established metrics (CCR, OER, and HD), and advanced metrics (percentage of netlist recovery and mutual information). Our extensive experiments show that our scheme provides superior protection. Simultaneously, we induce reasonably low and controllable overheads on power and performance, without any silicon area costs. Besides, we support higher split layers, which helps to alleviate concerns on the practicality of split manufacturing.

Numerous machine learning (ML), and more recently, deep learning (DL) based approaches, have been proposed to tackle scalability issues in electronic design automation, including those in integrated circuit (IC) test. This paper examines state-of-the-art DL for IC test and highlights two critical unaddressed challenges. The first challenge involves identifying fit-for-purpose statistical metrics to train and evaluate ML model performance and usefulness in IC test. Our work shows that current metrics do not reflect how well ML models have learned to generalize and perform in the domain-specific context. From this insight, we propose and evaluate alternative metrics that better capture a model’s likely usefulness in the IC test problem. The second challenge is to choose an appropriate input abstraction so as to enable an ML model to learn robust and reliable features. We investigate how well DL for IC test techniques generalize by exploring their robustness to perturbations that alter a netlist’s structure but do not alter its functionality. This paper provides insights into challenges via empirical evaluation of the state-ofthe- art and offers guidance for future work.

While logic locking is a promising defense to protect hardware designs, many attacks have been shown to undermine its security by retrieving the secret key. All the powerful attacks rely on a working chip, i.e., an oracle, and in particular, heavily use the test access. The proposed technique DisORC turns the oracle into a dishonest one whenever a potential attack is detected. DisORC works on the premise that structural testing of chips need not be performed with the correct functionality. We implement this capability by adding circuitry around a logic-locked design that reconfigures its functionality upon detecting access to scan chains. Any attempt to access scan chains disconnects the secret key from the circuit, and clears all of its traces, isolating and securing it. We also pair this defense with a truly random logic locking (TRLL) scheme that makes random decisions in inserting key gates and retaining signal polarities without relying on any logic synthesis technique to perform bubble pushing. Any netlist analysis-based attack, known or anticipated, will then learn nothing useful to infer the key values. The combined defense DisORC + TRLL thwarts oracle-based and netlist analysis-based attacks while delivering sufficient corruption levels at the outputs. We also show that the proposed defense is cost effective and can be integrated into the design flow easily. The proposed logic locking defense provides protection against untrusted foundry, testing facility, end users, and any combination of them colluding together.

With the rise of Approximate Computing as an energy-efficient design paradigm that is amenable to error-tolerant applications, different Approximate Logic Synthesis (ALS) techniques have been reported in the literature to generate approximate circuits from accurate implementations automatically. One ALS technique focuses on performing structural netlist transformations. The gate-level netlist representation of a circuit is simplified to reduce the circuit area and power consumption while producing a defined error level at the output. However, currently, there is no framework or tool available to test and explore existing netlist transformation techniques for ALS. This limits the proposal of novel approaches and their corresponding comparison against state-of-the-art contributions. In this brief, we present AxLS, an open-source framework for ALS techniques based on netlist transformations. We validate our framework’s functionality by implementing a reported ALS technique and one proposed, using open-source circuit synthesis and simulation tools, and generating approximate arithmetic circuits from accurate RTL descriptions.

This article focuses on thwarting reverse-engineering attacks and intellectual property (IP) theft by leveraging charge-recycling adiabatic circuits. The adiabatic circuit operation has recently received attention for the Internet-of-Things (IoT) applications due to high energy efficiency and enhanced security characteristics. Such applications typically consist of resource-constrained designs and are often deployed in the field, making them particularly vulnerable to malicious attacks. PhaseCamouflage is a circuit obfuscation technique that leverages the inherent phase differences (PDs) in power supply voltage of adiabatic logic gates and exhibits strong resistance against structural/removal attacks. The proposed method relies on inserting camouflaged PDs in the power supply voltage of subsequent logic gates while still producing a functional netlist. PhaseCamouflage is a unique logic obfuscation technique with low overhead, particularly applicable to pervasive computing applications where both efficiency and security are of primary concern.

Development of accurate Real-Time systems with power electronic converters is a challenging task due to its high switching frequency and the time varying circuit topology. This paper explains the strategies to implement power electronic circuit models in real time, by exploiting the parallel and distributed computing nature of FPGA, with three-phase-three-level diode-clamped inverter as a case study. A generic multiport decomposition technique is applied to improve parallelism and to reduce the size of the matrix for the computation. Also, by developing a PySpice based utility, which pre-computes all the system matrices from the given netlist, implementation is made more adaptable to different partitions and circuit variations. Target circuit is implemented in C/C++ language, converted to VHDL and implemented on ZedBoard (XC7Z020) using Xilinx Vivado tools. With this generalized approach, a latency of less than $5\mu\mathrm{s}$ is achieved with reasonable utilization of resources, on FPGA. Real-Time performance of the implemented inverter model with Sine-Pulse-Width-Modulation technique is verified by connecting in loop with the induction motor model for its speed control. A latency of $6.65\mu\mathrm{s}$ is achieved within each simulation time step for the closed loop control of induction motor which is sufficient for the wide range of variable frequency drive applications.

In this work, we present an Asynchronous Static Timing Analysis (ASTA) EDA methodology for cyclic, Asynchronous Control Circuits. Our methodology operates using Graph-based Analysis (GBA) principles, as conventional synchronous GBA STA, is fast, and pessimistically computes Critical Cycle(s), instead of Critical Paths, without cycle cutting. Our ASTA flow supports industrial Timing Libraries, Verilog input and multiple PVT corners. Gate timing arc delay/slew computation, input/output environment constraints, and path delay propagation, are implemented based on GBA STA principles. To perform ASTA, both gate-level netlist and a graph-based Event Model, Marked Graph (MG) or PeTri Net (PTnet), is required. The pair is used to construct the Event Timing Graph (ETG), an MG with annotated netlist extracted delays, for Event Model Transition to Transition (T2T) arcs. ETG delays are computed automatically, based on cyclic equilibrium slews, and GBA critical path identification between relevant T2T netlist gate pins. GBA T2T paths may be manually overridden. As GBA is non-functional, we illustrate a mapping between an Event Model, where choice places may be allowed, and the ETG, where places are collapsed to their corresponding timing annotated T2T arcs. The resultant ETG is live and 1-bounded, making it suitable for Period analysis using Burns Primal-Dual Algorithm. Our methodology has been successfully tested on 23 asynchronous benchmarks, and validated via timing simulation. We compare results against an industrial, synchronous STA tool with cycle cutting, and illustrate significant timing errors, when synchronous STA is used for delay annotation, as well as a 50% delta in Critical Cycle Delay.

A popular countermeasure against IP piracy is to obfuscate the Finite State Machine (FSM) which is assumed to be the heart of a digital system. Most of the existing FSM obfuscation strategies rely on additionally introduced set of obfuscation mode state-transitions to protect the original state-transitions of the FSM. Although these methods assume that it is difficult to extract the FSM behavior from the flattened gate-level netlist, some recent reverse engineering attacks could successfully break the defense of these schemes. The capability of differentiating obfuscation mode state-transitions from normal mode state-transitions makes these attacks powerful. As a countermeasure against these attacks, we propose a new strategy that offers a key-based obfuscation to each state-transition of the FSM. We use a special class of non-group additive cellular automata (CA), called D1 ∗ CA, and it's counterpart D1∗CAdual to obfuscate each state-transition of the FSM. Each state-transition has its own customized key, which must be configured correctly in order to get correct state-transition behavior from the synthesized FSM. A second layer of protection to the state-transition logic enhances the security of the proposed scheme. An in-depth security analysis of the proposed easily testable key-controlled FSM synthesis scheme demonstrates its ability to thwart the majority of the state-of-the-art attacks, such as FSM reverse engineering, SAT, and circuit unrolling attacks. Thus, the proposed scheme can be used for IP protection of the digital designs. Experimentations on various IWLS′93 benchmark FSM designs show that the average area, power, and delay overheads our proposed multi-bit key-based obfuscated FSM design are 56.43%, 6.87%, and 23.41% while considering the FSMs as standalone circuits. However, experimentation on the Amber23 processor core shows these overheads drastically reduce (reported area, power, and delay overheads values are 0.0025%, 0.44%, and 0%, respectively) while compared with respect to the entire design.

Integrated circuit (IC) camouflaging is a promising defense against so-called IC extraction attacks that seek to reverse engineer the netlist of a packaged IC using delayering and imaging techniques. Camouflaging works by hiding the Boolean functionality of selected gates in the netlist from reverse engineering, albeit at the cost of increased gate area and power. The intuitive security claim then is that the attacker cannot infer the netlist’s exact Boolean functionality. This paper describes a powerful class of attacks on IC camouflaging referred to as SAT attacks; the attacks use the input/output (I/O) behavior of a functional camouflaged IC along with the Boolean satisfiability (SAT)-based inference to reverse the Boolean functionalities of camouflaged gates. The SAT attack is rooted in a foundational complexity theory mindset and is shown to defeat defenses that previously claimed to secure against even the most determined adversaries. This paper then highlights the subsequent impact of the SAT attack in terms of new SAT-resilient defenses that emerged, their vulnerability to enhancements of the SAT attack, and implications of the attack on provably secure defense mechanisms.

We present a machine learning (ML) framework to improve the use of computing resources in the FPGA compilation step of a commercial FPGA-based logic emulation flow. Our ML models enable highly accurate predictability of the final place and route design qualities, runtime, and optimal mapping parameters. We identify key compilation features that may require aggressive compilation efforts using our ML models. Experiments based on our large-scale database from an industry’s emulation system show that our ML models help reduce the total number of jobs required for a given netlist by 33%. Moreover, our job scheduling algorithm based on our ML model reduces the overall time to completion of concurrent compilation runs by 24%. In addition, we propose a new method to compute “recommendations” from our ML model to perform re-partitioning of difficult partitions. Tested on a large-scale industry system on chip design, our recommendation flow provides additional 15% compile time savings for the entire system on chip. To exploit our ML model inside the time-critical multi-FPGA partitioning step, we implement it in an optimized multi-threaded representation.

This article proposes an automatically placed and routed methodology for asynchronous single flux quantum (SFQ) circuits using passive transmission line lines and utilizing a commercial electronic design automation (EDA) tool, Cadence Innovus. At the cell level, dual rail SFQ asynchronous cells were developed to be implemented in the place and route methodology. Scripts were written that could convert any single rail netlist synthesized from behavioral Verilog using an EDA tool (such as Design Vision) containing single rail cells into dual rail asynchronous cells. Then, automatic placement and routing using Innovus was achieved through specific cell layout design choices that allowed the finished circuit design layout to pass checks by layout vs schematic and design rule check. Finally, back annotation was performed by reincorporating transmission line lengths from place and route stage in analog simulation to verify correct functionality of the design. As an example, a 4-b arithmetic logic unit design is used to illustrate the various stages of the methodology.

The productivity achieved when developing applications on high-performance reconfigurable heterogeneous computing (HPRHC) systems is increased by using the Open Computing Language (OpenCL). However, the hardware produced by OpenCL compilers in field-programmable gate arrays (FPGAs) can result in severe performance bottlenecks that are challenging to solve. The problem is compounded by the fact that the generated netlist details are disorganized, making them mostly unreadable and only partially visible to designers. This paper proposes an in-FPGA instrumentation method and a new framework for extracting the FPGA-cycle-accurate timing performances of OpenCL-based designs. The results clearly show that the chosen execution model for OpenCL-based designs strongly affects the timing performance when it is not properly implemented. Our framework is implemented on an HPRHC platform that contains a CPU and two Arria10 FPGAs, and it is evaluated with a wide variety of benchmarks with different complexities. After testing on the reported benchmarks, the average logic overhead for one inserted instrument is 0.2 % of the total amount of adaptive look-up tables (ALUTs) and 0.1 % of the total registers in an FPGA. This resource utilization is between 1.5 and six times lower than those reported in the best previously published works. The scalability of the framework is also evaluated by inserting up to 50 instruments. The experimental results show that the average logic utilization per instrument is 0.19 % of the ALUTs and 0.17 % of the registers in the FPGA when 50 instruments are inserted.

The significant rise in the cost of manufacturing nanoscale integrated circuits (ICs) has led the majority of IC design companies to outsource the fabrication of their products to other companies, often located in different countries. The multinational nature of the hardware supply chain has led to a host of security threats, including IP piracy, IC overproduction, and Trojan insertion. To combat these, researchers have proposed logic locking techniques to protect the intellectual properties of the design and increase the difficulty of malicious modification of its functionality. However, the adoption of logic locking approaches has been rather slow due to the lack of integration with the IC production process and the lack of efficacy of existing algorithms. This work automates the logic locking process by developing software using Python that performs the locking on a gate-level netlist, which can be integrated with the existing digital synthesis tools. Analysis of the latest logic locking algorithms has demonstrated that the SFLL-HD algorithm is one of the most secure and versatile when trading-off levels of protection against different types of attacks and was thus selected for implementation. The presented tool can also be expanded to incorporate the latest locking mechanisms to keep up with the fast-paced development in this field. The paper also presents a case study to demonstrate the functionality of the tool and how it could be used to explore the design space and compare different locking solutions.

Simulation-based fault injection is an approach, which is usually conducted in the design phase to evaluate the reliability of circuits. However, this approach is frequently time-consuming, especially for large designs. This paper explores the possibilities of applying machine learning (ML) as enhancement to the fault injection to reduce the runtime of the fault verification. The proposed approach separates the target gates for fault injection into two subsets. Standard simulation-based fault injection is only performed for first subset to get the result of fault propagation in the circuit, and enables machine learning process. Based on such partial classical fault injection campaign, a dataset is built to train and validate machine learning models that are able to predict the fault injection result of the remaining gates. The machine learning approach is based on a set of relevant features that could be easily extracted based on the netlist. The dataset in this study, used to validate the approach, is obtained from the ADC digital core. We have evaluated this netlist and provided ML-driven assessment whether the fault injection in some gate will propagate to primary outputs. We have evaluated several machine learning models with different loss functions. The best prediction accuracy is 95% and achieved by a 4 layer neural network with weighted Cross Entropy.

With the globalization of the semiconductor industry, hardware Trojans(HTs) are an emergent security threat in modern integrated circuit(IC) production. Research is now being conducted into designing more accurate and efficient methods to detect HTs. Recently, a number of ML-based HT detection approaches have been proposed; however, most of them still use knowledge-driven approaches to design features and often use engineering intuition to carefully craft the detection model to improve accuracy. Therefore, in this work, we propose a data-driven HT detection system based on gate-level netlists. The system consists of four main parts: 1)Information extraction from netlist block; 2)Natural language processing(NLP) for translating netlist information; 3)DL-based HT detection model; 4)HT component final voter. In the experiments, both a long short-term memory networks(LSTM) model and convolutional neural network(CNN) model are used as our detection models. We performed the experiments on the HT benchmarks from Trust-hub and evaluated different parameter settings in the training procedure. The experimental results show that the proposed HT detection system can achieve 79.29% TPR, 99.97% TNR, 87.75% PPV and 99.94% NPV for combinational Trojan detection and 93.46% TPR, 99.99% TNR, 98.92% PPV and 99.92% NPV for sequential Trojan detection after voting-based optimization using the LEDA library-based HT benchmarks.

As the economic process of integrated circuit (IC) process proceeds, various supply chain components will copy ICs to introduce hardware Trojans, and overbuild ICs. A variety of hardware security studies have been conducted in order to prevent piracy, reverse engineering, and overbuilding through obfuscation. Obfuscating the design by arbitrarily inserting extra gates; solely an accurate key makes the design provide correct outputs. A hacker can decrypt the obfuscated design in an exceeding time rectilinear to the number of keys by observing the key values to the output. Nevertheless, these approaches provoke high overheads, and design obfuscation cannot give any security for the netlist of the third-party IP core (Intellectual Property). To avoid these vulnerabilities of hardware security approaches, this research work proposes a sensible logic obfuscation technique with low overheads to prevent a mortal from RE both the gate-level netlist and therefore the layout of IC and shield IC from piracy, and we then evolve techniques to mend this weakness and build obfuscation exponential within the range of inserted keys by designing the circuit through state diagrams in mentor graphics HDL designer tool.

With the prevalence of deep learning (DL) in many applications, researchers are investigating different ways of optimizing FPGA architecture and CAD to achieve better quality-of-results (QoR) on DL-based workloads. In this optimization process, benchmark circuits are an essential component; the QoR achieved on a set of benchmarks is the main driver for architecture and CAD design choices. However, current academic benchmark suites are inadequate, as they do not capture any designs from the DL domain. This work presents a new suite of DL acceleration benchmark circuits for FPGA architecture and CAD research, called Koios. This suite of 19 circuits covers a wide variety of accelerated neural networks, design sizes, implementation styles, abstraction levels, and numerical precisions. These designs are larger, more data parallel, more heterogeneous, more deeply pipelined, and utilize more FPGA architectural features compared to existing open-source benchmarks. This enables researchers to pin-point architectural inefficiencies for this class of workloads and optimize CAD tools on more realistic benchmarks that stress the CAD algorithms in different ways. In this paper, we describe the designs in our benchmark suite, present results of running them through the Verilog-to-Routing (VTR) flow using a recent FPGA architecture model, and identify key insights from the resulting metrics. On average, our benchmarks have 3.7x more netlist primitives, 1.8x and 4.7x higher DSP and BRAM densities, and 1.7x higher frequency with 1.9x more near-critical paths compared to the widely-used VTR suite. Finally, we present two example case studies showing how architectural exploration for DL-optimized FPGAs can be performed using our new benchmark suite.

Usage of smart devices has tremendously grown with the advent of Internet of Things (IoT). Like software, Integrated Circuit (IC) being the core component of hardware is also highly un-trusted. Outsourcing of ICs to off-shore foundries makes Hardware threats inevitable in IC design. Hardware threats are of five types, namely Intellectual Property (IP) piracy, IC over-building, counterfeiting, reverse engineering, and Hardware Trojan [2]. One of the most sought-after hardware security breaches is Hardware Trojan insertion. Many methods have been proposed in the last decade for Hardware Trojan detection. Recently, machine learning techniques are used to perform efficient Hardware Trojan detection. Prevailing machine learning approaches based on circuit learning achieve good performance but face some critical challenges. The most pertinent challenges being the complex feature extraction, time-consuming training process, and compromised performance metrics due to high data imbalance in the training dataset. The proposed work aims to overcome the aforementioned challenges. The work proposes a voting ensemble method, which detects Hardware Trojans from the gate-level netlist. Firstly, 15 generic features are extracted from the circuit netlist, which leverages the rich circuit knowledge present in synthesis reports. An ensemble of Random Forest Classifiers is trained and soft voting is performed to get the final prediction. The Random Forest Classifiers are class-weighted and are so configured to handle the effect of data imbalance. Finally, testing of the model is performed using Leave-One-Out Cross Validation. Experimental results on Trust-Hub circuits show that the proposed methodology achieves 99.73% accuracy, 98.25% recall, 96.81% precision, 97.44% F-measure, and 99.97% ROC-AUC score on an average of 16 circuits under test (CUT).

As the Integrated circuits (IC) production has been increased, the insertion of malicious hardware units is common. These malicious hardware units are called the hardware trojans. Third-party vendors are responsible for hardware trojan insertion in the circuits. In this paper, a technique which detect the circuits which are affected with the hardware trojan or not is explored. The usage of supervised machine learning technique, the random forest algorithm, helps us to detect the presence of the malicious hardware Trojans. This technique uses five features which are extracted from the circuits using the Gate level netlist. These features are identified for each nets of the circuits. Thus, by using the random forest classifier for the categorization, the true positive (TP), false positive (FP), true negative (TN), false negative (FP) can also be obtained. Also, the parameters like precision, recall, accuracy and f-measure are calculated for the ISCAS'85 benchmark circuits. The computed results report an increase in accuracy.

This paper mainly described about design and synthesis of 16-bit Karatsuba multiplier using Square root carry select adder (SRCSA) circuit. The Carry look ahead adder (CLA), Carry save adder (CSA) and SRCSA are modelled using Verilog HDL. The functional verification of all the adders is carried out in Cadence NClaunch tool. All the adders are synthesized in Cadence Genus tool. The power, timings and area reports can be generated in the synthesis flow. The comparative analysis done between CLA, CSA and SRCSA. Later choose SRCSA for the multiplier. The Karatsuba multiplier is designed using the Verilog HDL. The functional verification of the multiplier circuit is carried using Verilog (RTL file) and test bench in NCLaunch tool from cadence. The synthesis of multiplier circuit is carried in Genus tool from Cadence, it converts the RTL file to gate-level netlist. During synthesis, reported the power is 193385.696 nW, Delay is 3409ps and area is 2795.508nm2. All process has been carried out using the 180nm technology.

In this paper, it speaks about design of AHB-Lite and its implementation from RTL to GDSII. Cadence NC Launch tool is used for simulation. Input to NC Launch tool is Verilog file. Later gate level synthesis is carried out using cadence genus tool. Input to the cadence genus tool are i) verified Verilog file ii) .sdc file (synopsis design constraint file) iii) .lib file (library file).Output from cadence genus tool are gate level net list file and. sdc file (design constraint file). These both steps are of frontend part of design. And, in backend part of design cadence innovus tool is used. Reports for timing, area and power are calculated at all these steps of operations. At, last GDSII file is generated. All these process are carried out using 180nm technology cadence tool. Advanced High-performance-Lite bus operations like read and write will be designed, simulated and synthesized. Later, the physical implementation of Advanced High-performance-Lite will be implemented on Cadence Innovus tool. Optimization is carried out all steps of design in terms of power, timing and area. After doing post CTS, there will be more optimization. One have obtained optimized results for slack 2.019ps, power 62.6nW and area 442747.1664µm2.

This paper mainly described about physical implementation of 8-bit Square-root-carry-select-adder (SRCSA) circuit. The SRCSA is designed using the Verilog HDL and implemented from RTL to GDSII. The functional verification of the SRCSA circuit is carried using Verilog (RTL file) and test bench in NCLaunch tool from cadence. The synthesis of SRCSA circuit is carried in Genus tool from Cadence, it's convert the RTL file to gate-level netlist. In back end design, physical implementation is carried out on Innovus tool from cadence. Later GDSII file can be generated. The reports are generated on power, area and timing during synthesis flow and physical implementation flow. After optimization during the physical implementation reported the power is 146.6mW, timing is 11593ps and area is 3389.6016um2. All process has been carried out using the 180nm technology.

Due to the rapid growth in the information and telecommunications industries, an untrusted vendor might compromise the complicated supply chain by inserting hardware Trojans (HTs). Although hardware Trojan detection methods at gate-level netlists employing machine learning have been developed, the training dataset is insufficient. In this paper, we propose a data augmentation method for machine-learning-based hardware Trojan detection. Our proposed method replaces a gate in a hardware Trojan circuit with logically equivalent gates. The experimental results demonstrate that our proposed method successfully enhances the classification performance with all the classifiers in terms of the true positive rates (TPRs).

Hardware manipulations pose a serious threat to numerous systems, ranging from a myriad of smart-X devices to military systems. In many attack scenarios an adversary merely has access to the low-level, potentially obfuscated gate-level netlist. In general, the attacker possesses minimal information and faces the costly and time-consuming task of reverse engineering the design to identify security-critical circuitry, followed by the insertion of a meaningful hardware Trojan. These challenges have been considered only in passing by the research community. The contribution of this work is threefold: First, we present $\sf {HAL}$HAL, a comprehensive reverse engineering and manipulation framework for gate-level netlists. $\sf {HAL}$HAL allows automating defensive design analysis (e.g., including arbitrary Trojan detection algorithms with minimal effort) as well as offensive reverse engineering and targeted logic insertion. Second, we present a novel static analysis Trojan detection technique $\sf {ANGEL}$ANGEL which considerably reduces the false-positive detection rate of the detection technique $\sf {FANCI}$FANCI. Furthermore, we demonstrate that $\sf {ANGEL}$ANGEL is capable of automatically detecting Trojans obfuscated with $\sf {DeTrust}$DeTrust. Third, we demonstrate how a malicious party can semi-automatically inject hardware Trojans into third-party designs. We present reverse engineering algorithms to disarm and trick cryptographic self-tests, and subtly leak cryptographic keys without any a priori knowledge of the design's internal workings.

Intellectual property protection techniques face a challenging task in countering a physical attack by reverse engineering the netlist of an embedded integrated circuit. An attacker can extract sensitive information with image tools by processing microphotographs at low metal layers of delayered chips. We propose a low performance and zero-area impact method to obfuscate circuits by using a current digital design flow with a layout standard cell generator to obtain different physical versions of the same logic cell. Results indicate that timing and power overhead, introduced by the obfuscation method, can be mitigated. After applying the method to a set of benchmark circuits and a 32-bit RISC-based microprocessor, results show a 40%–50% average obfuscation with zero area penalty and less than 2% timing and power penalty for system level blocks. Considering that most attacks direct reverse engineering to key cryptographic functions, experimental obfuscation results indicate a timing penalty of 4% with a strong obfuscation level for a synthesized key establishment core.

The polymorphic gates are the circuit cells that deliver different functions with the different external input, supply voltage or temperature. It is an effective method to resist the reverse engineering attacks, for the attackers cannot distinguish the correct function based on the netlist of the circuit. The researchers have found out that the RRAM based Look-Up Table (LUT) has higher performance and less area, comparing with the CMOS based counterparts. However, the attackers can tell the functions of the previous proposed RRAM based LUTs by measuring the resistance states of the RRAM cells. This work proposes an RRAM based polymorphic gate, which implements 16 basic logic functions with 8 RRAM cells in 4 working cycles. Furthermore, the multi-input LUT scheme is proposed based on the polymorphic gate. It is difficult for the attackers to distinguish the circuit function, because the function of the LUT is determined by the applied voltages and the resistance states of the RRAM devices, and the n-input LUT circuit is implemented with the constant area regardless of the number of inputs.

As recently studied, field-programmable gate arrays (FPGAs) suffer from growing Hardware Trojan (HT) attacks, and many techniques, e.g., register-transfer level (RTL) code-based analyzing, have been presented to detect HTs on FPGAs. However, for most of the FPGA end users, they can only obtain bitstream, rather than the RTL code. Therefore, we present a new FPGA reverse engineering tool-chain. It can precisely transform the FPGA bitstream to an RTL code and therefore assists in HT detection. In detail, we first construct an integrated database involving the FPGA architecture information and the bitstream mapping information. Then, we build two tools, namely, bitstream reversal tool (BRT) and netlist reversal tool (NRT). They can be combined together to retrieve the RTL code from the FPGA bitstream in moderate time. To demonstrate the effectiveness of our tool-chain, we evaluate it qualitatively and quantitatively by using two benchmarks (ISCAS'85 and ISCAS'89) and three real applications (8051 core, 68HC08, and AES). Our tool-chain is comprehensive since it covers all the reverse engineering stages, from bitstream to netlist and from netlist to code, without any support from other tools. Moreover, it rebuilds the netlist with a 100% correct rate and retrieves RTL code, which is exactly, functionally equivalent to the original one for all our benchmarks. To the best of our knowledge, it is the first tool that can perform integrated, precise reverse engineering for FPGAs, paving the way for the netlist-/code-based HT detection.

The lack of open-source memory compilers in academia typically causes significant delays in research and design implementations. This paper presents an open-source memory compiler that is directly integrated within the Cadence Virtuoso environment using physical verification tools provided by Mentor Graphics (Calibre). It facilitates the entire memory generation process from netlist generation to layout implementation, and physical implementation verification. To the best of our knowledge, this is the first open-source memory compiler that has been developed specifically to automate Resistive Random Access Memory (RRAM) generation. RRAM holds the promise of achieving high speed, high density and non-volatility. A novel RRAM architecture, additionally is proposed, and a number of generated RRAM arrays are evaluated to identify their worst case control line parasitics and worst case settling time across the memristors of their cells. The total capacitance of lines SEL, N and P is 5.83 fF/cell, 3.31 fF/cell and 2.48 fF/cell respectively, while the total calculated resistance for SEL is 1.28 Ohm/cell and 0.14 Ohm/cell for both N and P lines., 4 pages

Nowadays malicious vendors can easily insert hardware Trojans into integrated circuit chips as the entire integrated chip supply chain involves numerous design houses and manufacturers on a global scale. It is thereby becoming a necessity to expose any possible hardware Trojans, if they ever exist in a chip. A typical Trojan circuit is made of a trigger and a payload that are interconnected with a trigger net. As trigger net can be viewed as the signature of a hardware Trojan, in this paper, we propose a gate-level hardware Trojan detection method and model that can be applied to screen the entire chip for trigger nets. In specific, we extract the trigger-net features for each net from known netlists and use the machine learning method to train multiple detection models according to the trigger modes. The detection models are used to identify suspicious trigger nets from the netlist of the integrated circuit under detection, and score each net in terms of suspiciousness value. By flagging the top 2% suspicious nets with the highest suspiciousness values, we shall be able to detect majority hardware Trojans, with an average accuracy rate of 96%.

Answer Set Programming (ASP) is proposed as a compact and versatile approach to circuit analysis. By the example of upsets in registers we demonstrate how to perform reliability analysis in less than 200 lines of code. By an efficient problem encoding we achieve an input data format similar to a Verilog netlist so that extensive preprocessing is avoided. No development of algorithms is required as the analysis relies on elaborate and highly optimized ASP solvers. Exemplary results for a wide range of circuits are presented and potential optimizations are pointed out.

FPGAs have been used in the cloud since several years, for workloads such as machine learning, database processes and security tasks. As for other cloud services, a highly desired feature is virtualization in which multiple tenants share a single FPGA to increase utilization and by that efficiency. By solely using standard FPGA logic in the untrusted tenant, on-chip logic sensors have recently been proposed, allowing remote power analysis side-channel and covert channel attacks on the victim tenant. However, such sensors are implemented by unusual circuit constructions, such as ring oscillators or delay lines, which might be easily detected by bitstream and/or netlist checking. In this paper we show that such structural checking methods are not universal solutions as the attacks can make use of “benign-looking” circuits. We demonstrate this by showing a successful Correlation Power Analysis attack on the Advanced Encryption Standard.

Recent routability research has exploited a machine learning (ML)-based modeling methodologies to consider various routability factors that are derived from placement solution. These factors are very related to the circuit characteristics (e.g., pin density, routing congestion, demand of routing resources, etc), and lack of circuit benchmarks in training can lead to poor predictability for ‘unseen’ circuit designs. In this paper, we propose a machine learning (ML) framework for early routability prediction modeling. The method includes a new artificial netlist generator (ANG) that generates an artificial gate-level netlist from the user-specified topology characteristics of synthetic circuit, even with real world circuit-like. In this framework, we exploit that ANG that supports obtaining ground truths for use in training ML-based model, the training dataset that have a wide range of topological characteristics provides strong ability to inference noisy, previous-unseen data. Compared to a design-specific training dataset [4] that is used for routability prediction modeling, we increase the test accuracy of binary classification (‘pass' or ‘fail’) on timing, DRC and routability by 6.3%, 8.6% and 6.6%, and reduce the generalization error [12] by as much as 87% compared to design-specific training dataset [4].

This paper contributes to the automatic abstraction of analog circuits at transistor level. Specifically, this paper targets neuronal networks (NNs). As these circuits consist of millions of repeated neurons, simulation as well as verification routines are prohibitively time consuming. However, these netlists usually consist of repeated arrangement of neurons, which can be individually considered as subsystems. Starting with a neuron described as a Spice netlist, an abstraction methodology is presented that automatically generates an accurate behavioral model as a hybrid automaton (HA) in SystemC-AMS/Verilog- A while still preserving the internal voltages and currents of the subsystem. The abstracted model can replace the neuron in simulation as well as in verification routines with significant speedup factors while still achieving high accuracy.

In top-down analog and mixed-signal design, a key problem is to ensure that the netlist or physical design does not contain unanticipated behaviors. Mismatches between netlist level circuit descriptions and high level behavioral models need to be captured at all stages of the design process for accuracy of system level simulation as well as fast convergence of the design. To support the above, we present a guided test generation algorithm that explores the input stimulus space and generates new stimuli which are likely to excite differences between the model and its netlist description. Subsequently, a recurrent neural network (RNN) based learning model is used to learn divergent model and netlist behaviors and absorb them into the model to minimize these differences. The process is repeated iteratively and in each iteration, a Bayesian optimization algorithm is used to find optimal RNN hyperparameters to maximize behavior learning. The result is a circuit-accurate behavioral model that is also much faster to simulate than a circuit simulator. In addition, another sub-goal is to perform design bug diagnosis to track the source of observed behavioral anomalies down to individual modules or small levels of circuit detail. An optimization-based diagnosis approach using Volterra learning kernels that is easily integrated into circuit simulators is proposed. Results on representative circuits are presented.

This paper presents a novel implementation of a digital-based Operational Transconductance Amplifier (OTA) which has been recently introduced in the technical literature as a fully digital alternative to the conventional differential pair to implement low voltage analog amplifiers and comparators. The proposed implementation does not make use of resistors, floating gate resistors nor C-Muller elements and is made up of only digital gates usually available in the standard cell libraries. The resulting analog circuit schematic can be described using structural VHDL or Verilog languages and is suitable to be integrated in an automatic synthesis and place and route flow for digital circuits. The proposed digital-based amplifier has been implemented in a commercial 130 nm CMOS process by using an automatic place and route flow for layout generation starting from the Verilog netlist. Post layout simulations are presented to show the performance of the proposed circuit and compare it against the state of the art.

Many beyond-CMOS technologies, based on different switching mechanisms, are arising. Field-coupled technologies are the most promising as they can guarantee an extremely low-power consumption and combine logic and memory into the same device. However, circuit-level explorations, like layout verification and analysis of the circuit performance, considering the constraints of the target technology, cannot be done using existing tools. Here, we propose a methodology to take on this challenge. We present function and connection detection (FUNCODE), an algorithm that can detect element connections, functions, and errors of custom layouts and generate its corresponding very high-speed integrated circuits hardware description language netlist. It is proposed for in-plane and perpendicular nanomagnetic logic as a case study. FUNCODE netlists, which take into account the physical behavior of the technology, were verified using circuits with increasing complexity, from 6 up to 1400 gates with a number of layout elements varying from 200 to 2.3e6.

Modern FPGAs are equipped with the possibility of Partial Reconfiguration (PR) which along with other benefits can be used to enhance the security of cryptographic implementations. This feature requires development of alternative designs to be exchanged during run-time. In this work, we propose dynamically alterable circuits by exploring netlist randomization which can be utilized with PR as a countermeasure against physical attacks, in particular side-channel attacks. The proposed approach involves modification of an AES implementation at the netlist level in order to create circuit variants which are functionally identical but structurally different. In preliminary experiments, power traces of these variants have been shuffled to replicate the effect of partial reconfiguration. With these dynamic circuits, our experimental results show an increase in the resistance against power side-channel attacks by a factor of \({\sim }12.6\) on a Xilinx ZYNQ UltraScale+ device.

An exhaustive set of radio frequency (RF) amplifier design examples is presented in this chapter that include classes A, B, AB, C, D, E, F, G, and H. For each amplifier class, a C computer language executable accepts designer-supplied parameters (e.g., bi-junction transistor collector-emitter voltage and amplifier load target output power), computes the values for the amplifier circuit passive components (capacitor, inductor, resistor), and finally formats the results as a text SPICE (Simulation Program with Integrated Circuit Emphasis) input format netlist. SPICE, the gold-standard electrical/electronic circuit simulator, uses its transient analysis feature to simulate and analyze the fresh generated netlist. Any available open-source or proprietary SPICE simulator may be used – in this case the latest version of Ngspice, version 31. The power and flexibility of the SPICE simulator are demonstrated by integrating the electronics industry standard load and source pull schemes with transient analysis. The text SPICE input format netlist may be easily edited, allowing for design space exploration. The SPICE simulator generates a text output file, and the generated transient analysis data is analyzed by a C computer language utility program to extract statistical information from the raw SPICE transient analysis output. All the C computer language executables are supplied as three sets for both the popular Linux (RedHat Fedora version 31 – 64 bit and Ubuntu LTS 16.04 – 32 bit) and Windows (Windows 10) operating systems.

With the evolution of Internet, systems are moving towards a digital era. But there occurs a problem of security and safety, where the adversaries can attack our systems with viruses and malwares to extract the data from our system. To identify and to prevent the hacking, in particular, Trojan insertion we can design hardware based detection system. As the hardware based solutions are faster than software based solutions, the design of trust based obfuscation systems will give lesser time for an attacker to attack a victim’s system. Thus the overall damage in a victim’s system can be reduced. We propose in this paper a method by which we can identify the vulnerable nodes in a circuit using Transition Probability concepts to enhance the security of an IC. The authorization of the designed system will happen only when the correct input patterns are given. This probabilistic approach ensures that an attacker cannot extract net list and decode the circuit.

Field-Programmable Gate Arrays (FPGAs) are used almost everywhere, from smart-phones to datacenters. FPGA functionality is determined by the intellectual property (IP) encoded within a vendor-proprietary binary configuration file, or bitstream, that is deployed on these devices. The potential value offered by IP creates many incentives for an adversary to attempt to steal it. The opaque nature of vendor bitstream formats has thus far limited the ability to detect stolen IP in deployed FPGAs. In this work we demonstrate the ability to detect instances of IP piracy given ONLY the FPGA configuration bitstream and a golden user netlist. While prior works have shown it is possible to reverse-engineer FPGA bitstreams into an underlying structural netlist, in isolation this netlist is of limited utility. We take this a step further by introducing ReCon, a tool to automatically assist in detecting pirated IP within a bitstream. ReCon first extracts a netlist from an unknown bitstream, then applies subgraph isomorphism algorithms to detect IP within the extracted netlist that are pirated from an original, or user, IP. Our experiments demonstrate ReCon as an effective method for piracy detection because it allows for a composite comparison between two bitstreams without needing to manually reverse engineer circuits and identify submodules.

We propose a high efficiency Early-Complete Brute Force Elimination method that speeds up the analysis flow of the Camouflage Integrated Circuit (IC). The proposed method is targeted for security qualification of the Camouflaged IC netlists in Intellectual Property (IP) protection. There are two main features in the proposed method. First, the proposed method features immediate elimination of the incorrect Camouflage gates combination for the rest of computation, concentrating the resources into other potential correct Camouflage gates combination. Second, the proposed method features early complete, i.e. revealing the correct Camouflage gates once all incorrect gates combination are eliminated, increasing the computation speed for the overall security analysis. Based on the Python programming platform, we implement the algorithm of the proposed method and test it for three circuits including ISCAS’89 benchmarks. From the simulation results, our proposed method, on average, features 71% lesser number of trials and 79% shorter run time as compared to the conventional method in revealing the correct Camouflage gates from the Camouflaged IC netlist.

With many fabless companies outsourcing integrated circuit (IC) fabrication, the extent of design information recoverable by any third-party foundry remains clouded. While traditional reverse engineering schemes from the layout employ expensive high-resolution imaging techniques to recover design information, the extent of design information that can be recovered by the foundry remains ambiguous. To address this ambiguity, we propose ReGDS, a layout reverse engineering (RE) framework, posing as an inside-foundry attack to acquire original design intent. Our framework uses the layout, in GDSII format, and the technology library to extract the transistor-level connectivity information, and exploits unique relationship-based matching to identify logic gates and thereby, recover the original gate-level netlist. Employing circuits ranging from few hundreds to millions of transistors, we validate the scalability of our framework and demonstrate 100% recovery of the original design from the layout. To further validate the effectiveness of the framework in the presence of obfuscation schemes, we apply ReGDS to layouts of conventional XOR/MUX locked circuits and successfully recover the obfuscated netlist. By applying the Boolean SATisfiability (SAT) attack on the recovered obfuscated netlist, one can recover the entire key and, thereby, retrieve the original design intent. Thus ReGDS results in accelerated acquisition of the gate-level netlist by the attacker, in comparison to imaging-based RE schemes. Our experiments unearth the potential threat of possible intellectual property (IP) piracy at any third-party foundry.

Logic locking has been proposed as an obfuscation technique to protect outsourced IC designs from IP piracy by untrusted entities in the design and fabrication process. In this case, the netlist is locked by adding extra key-gates, and will be unlocked only if a correct key is applied to the key-gates. The key is assumed to be written into a non-volatile memory after the fabrication by the IP owner. In the past several years, the focus of the research community has been mostly on Oracle-guided attacks, such as SAT attacks, on logic locking and proposing proper countermeasures against such attacks. However, none of the reported research in the literature has ever challenged a more fundamental assumption of logic locking, which is the security of the key itself. In other words, if an adversary can read out the correct key after insertion, the security of the entire scheme is broken. In this work, we first review possible adversaries for the locked circuits and their capabilities. Afterward, we demonstrate that even with the assumption of having a tamper- and read-proof memory for the key storage, which is not vulnerable to any physical attacks, the key transfer between the memory and the key-gates through registers and buffers make the key extraction by an adversary possible. To support our claim, we implemented a proof-of-concept locked circuit as well as one of the standard logic locking benchmarks on an FPGA manufactured with a 28 nm technology and extract obfuscation keys using optical probing. Finally, we discuss the feasibility of the proposed attack in different scenarios and propose potential countermeasures.

Shift register to Circular buffer (Sr2Cb) conversion contributes imperative power savings in ASIC design optimization. This conversion includes time and resources exhausting complex calculations of Circular buffer (CB). Minimizing these calculations, it is important to estimate the efficiency and power of circular buffer using a machine learning approach. In this paper, we introduce a novel approach for predicting the power and efficiency of ASIC circuits using machine learning (ML) techniques on real-time designs. This model is trained on parameters obtained from numerous different configurations of Shift Register (SR). Using these parameters, the model is trained with minimal error. The proposed model uses the SR parameters and configuration to estimate the CB efficiency and power reduction with the conventional tool process of generating the CB Netlist and its complex calculations. We evaluated the performance on various established machine learning models and compared them with Mentor PowerPro tool. The trained model can be used to predict the efficiency and power for CB thus reducing its effort in the Sr2Cb conversion in tool.