Search

Training accurate deep learning (DL) models require large amounts of training data, significant work in labeling the data, considerable computing resources, and substantial domain expertise. In short, they are expensive to develop. Hence, protecting these models, which are valuable storehouses of intellectual properties (IP), against model stealing/cloning attacks is of paramount importance. Today’s mobile processors feature Neural Processing Units (NPUs) to accelerate the execution of DL models. DL models executing on NPUs are vulnerable to hyperparameter extraction via side-channel attacks and model parameter theft via bus monitoring attacks. This paper presents a novel solution to defend against DL IP theft in NPUs during model distribution and deployment/execution via lightweight, keyed model obfuscation scheme. Unauthorized use of such models results in inaccurate classification. In addition, we present an ideal end-to-end deep learning trusted system composed of: 1) model distribution via hardware root-of-trust and public-key cryptography infrastructure (PKI) and 2) model execution via low-latency memory encryption. We demonstrate that our proposed obfuscation solution achieves IP protection objectives without requiring specialized training or sacrificing the model’s accuracy. In addition, the proposed obfuscation mechanism preserves the output class distribution while degrading the model’s accuracy for unauthorized parties, covering any evidence of a hacked model.

Editor’s note : If you are designing or integrating hardware IP blocks into your designs, and you are using common global supply chains, then reading this overview article on how to protect your IP against reverse engineering, piracy, and malicious alteration attacks is a must. The authors give a comprehensive overview of current countermeasures that can be used at RTL, gate-, and layout-level to protect your design with a focus on combinational and sequential logic locking and a discussion on merits, overheads, and shortcomings of such techniques. —Jurgen Teich, FAU Erlangen

Hardware obfuscation is a technique that modifies the circuit to hide the functionality. Obfuscations through algorithmic modifications add protection in addition to circuit-level techniques, and their effects on the data paths can be analyzed and controlled at the architectural level. Many error-correcting coding and cryptography algorithms are based on finite field arithmetic. For the first time, this paper proposes a hardware obfuscation scheme achieved through varying finite field constructions and primitive element representations. Also the variations are effectively transformed to bit permuters controlled by obfuscation keys to achieve high level of security with very small complexity overheads. To illustrate the effectiveness, the proposed scheme is applied to obfuscate Reed-Solomon decoders, which are broadly used in communication and storage systems. For a (255, 239) RS decoder over finite field $GF(256)$GF(256), the proposed scheme achieves 1239 bits of independent obfuscation key with 4.4 percent area overhead, while yielding no penalty on the throughput and only one extra clock cycle of latency.

At different stages of the Integrated Circuit (IC) lifecycle there are attacks which threaten to compromise the integrity of the design through piracy, reverse engineering, hardware Trojan insertion, side channel analysis, and other physical attacks. Some of the most notable challenges in this field deal specifically with Intellectual Property (IP) theft and reverse engineering attacks. One method by which some of these concerns can be addressed is by introducing hardware obfuscation to the design in various forms. In this work we evaluate the effectiveness of a few different forms of netlist-level hardware obfuscation of a 16-bit substitution box component of a customizable cipher MK-3. These obfuscation methods were attacked using a satisfiability (SAT) attack, which is able to iteratively rule out classes of keys at once. This has been shown to be very effective against many forms of hardware obfuscation. A method to successfully defend against this attack is described in this paper. This method introduces a modified SIMON block cipher as a One-way Random Function (ORF) that is used to generate an obfuscation key. The S-box obfuscated using this 32-bit key and a round-reduced implementation of the SIMON cipher is shown to be secure against a SAT attack for at least 5 days.

A clear majority of electronic devices applications used in our daily life require a reliable, secure architecture, e.g., healthcare, social security cards, electronic meters, and smart homes. As a result, many studies are trying to develop appropriate solutions to tackle hardware security threats such as IC piracy, IC overbuilding, reverse engineering, counterfeiting, and tampering. Hardware obfuscation has been introduced as one of the leading robust, low-cost security solutions against different security threats, especially when combined with physical unclonable functions. Considering the inherent irreproducibility of PUFs, this method can provide a high-level security system. However, finding an applicable existent PUF or implementing a new PUF design that meets each hardware obfuscation requirements is not a trivial task. This study reviews and discusses hardware security systems based on PUFs inherited variations and the corresponding hardware obfuscation approaches.

The horizontal business model adopted by the semiconductor industry has resulted in a manufacturing process that has integrated various foreign entities focusing on individual production steps. However, serious trust issues have emerged with the internationalization of the semiconductor supply chain, and the trust concerns grow further with the proliferation of theft, reverse engineering (RE), and piracy of hardware intellectual property (IP). Unlike the software industry, the semiconductor supply chain cannot benefit from traditional cryptographic solutions due to the requirement of white-box accessibility to the hardware IP. Therefore, hardware obfuscation has originated as a potential countermeasure against dreaded supply chain attacks. The obfuscation process aims to hide the design intent and lock functionality by introducing structural and functional transformations to the IP, which increases the resistance against unauthorized use and potential exploitation of the design by an adversary. In this chapter, we investigate hardware obfuscation techniques that have been developed in the past decade and the limitations and challenges of these techniques. In particular, we explore the evolution of different techniques that are applicable at various supply chain stages of the semiconductor life cycle, the development of obfuscation benchmarks, and the research trends in the area of obfuscation. We also expand on the innovative attacks that have been developed to compromise the obfuscation techniques, as well as the countermeasures that are introduced to combat them. This chapter also sheds light on the lessons learned from the decade-long research on obfuscation by discussing the attack trends and unsolved challenges. Finally, we conclude by presenting a road map that aims to improve the existing solutions and provides improved security metrics for systematic evaluation.

Obfuscation is a promising solution for securing hardware intellectual property (IP) against various attacks, such as reverse engineering, piracy, and tampering. Due to the lack of standard benchmarks, proposed techniques by researchers and practitioners in the community are evaluated by existing benchmark suites such as ISCAS-85, ISCAS-89, and ITC-99. These open source benchmarks, though widely utilized, are not necessarily suitable for the purpose of evaluating hardware obfuscation techniques. In this context, we believe that it is important to establish a set of well-defined benchmarks, on which the effectiveness of new and existing obfuscation techniques and attacks on them can be compared. In this paper, we describe a set of such benchmarks obfuscated with some popular methods that we created to facilitate this need. These benchmarks have been made publicly available on Trust-Hub web portal. Moreover, we provide the first evaluation of several obfuscation approaches based on the metrics and existing attacks using this new suite. Finally, we discuss our observations and guidance for future work in hardware obfuscation and benchmarking.

It is important to protect the intellectual properties of logic circuits from reverse engineering. One of the countermeasures is logic obfuscation, which complicates the internal structures of logic circuits to prevent reverse engineering. A few researches have been conducted to simplify logic obfuscation using software obfuscation tools and high-level synthesis. However, it is not quantitatively evident whether the generated circuits are more complex than plain circuits. This paper discusses the three metrics of obfuscated netlists to evaluate the obfuscation methods proposed in previous studies. We confirmed that the obfuscated circuits are actually more complex than the original circuits using the proposed metrics.

There is a great variety of hardware Trojan detection and prevention approaches. However, state of art approaches cannot provide a full guarantee that an integrated circuit or complex electronic system is free of hardware Trojan. We introduced a reference monitor obfuscation approach on the base of formal transformations of structural system models. The approach ensures development of secure systems, operating in the presence of hardware Trojans. The reference monitor obfuscation ensures the main key reference monitor properties: must be non-bypassable and tamper-proof. This concept can be used as a prevention countermeasure against hardware Trojans at the following steps of development cycle of integrated circuit on the FPGA platform: prevention at design, prevention at fabrication, and prevention at post-fabrication. The paper demonstrates an implementation of reference monitor obfuscation approach by physical modeling on FPGA-based systems.

As a result of the increased use of contract foundries, internet protocol (IP) theft, excess production and reverse engineering are major concerns for the electronics and defense industries. Hardware obfuscation and IP locking can be used to make a design secure by replacing a part of the circuit with a key-locked module. In order to ensure each chip has unique keys, previous work has proposed using physical unclonable functions (PUF) to lock the circuit. However, these designs are area intensive. In this work, we propose a strong PUF-based hardware obfuscation scheme to uniquely lock each chip.

Intellectual property (IP) piracy and electronic counterfeiting have emerged as critical threats to the semiconductor industry in the current horizontal business model where the supply chain usually involves a large number of vendors. Hence, techniques that can protect integrated circuit (IC) against reverse engineering are demanded, especially for security-critical tasks. Hardware obfuscation is a broad category of techniques that could create ambiguity to the adversary by hiding the actual information from illegitimate users. This paper presents a novel hardware obfuscation design through reconfigurable finite field arithmetic units, which can be employed in various error correction and cryptographic algorithms. The effectiveness and efficiency of the proposed methods are verified by an obfuscated reformulated inversion-less Berlekamp-Massey (RiBM) Reed-Solomon decoder. Our experimental results show the hardware implementation of RiBM based Reed-Solomon decoder built using reconfigurable field multiplier designs. The proposed design provides only very low overhead.

To protect intellectual property, hardware obfuscation is necessary to conceal the implemented function. Besides logic-level approaches, hardware obfuscation can be done through algorithmic modifications. Prior algorithmic obfuscations address signal processing systems and those with variable data flow. This paper focuses on the obfuscation of systems based on finite field arithmetic, which are broadly adopted in digital communications. Netlists of hardware units with different field constructions are first analyzed to evaluate possible attacks. Taking into account the specifics of the computations in the Advanced Encryption Standard (AES) algorithm, optimized schemes are proposed to efficiently introduce obfuscation keys utilizing the variation of finite field construction. For an example pipelined fully-unrolled AES encryptor, the proposed scheme leads to 480 bits of obfuscation key with 3% area overhead without sacrificing the throughput. The proposed obfuscation method can be also extended to other algorithms involving finite field arithmetic.

The globalization of supply chain makes semiconductor chips susceptible to various security threats. Design obfuscation techniques have been widely investigated to thwart intellectual property (IP) piracy attacks. Key distribution among IP providers, system integration team, and end users remains as a challenging problem. This work proposes an orthogonal obfuscation method, which utilizes an orthogonal matrix to authenticate obfuscation keys, rather than directly examining each activation key. The proposed method hides the keys by using an orthogonal obfuscation algorithm to increasing the key retrieval time, such that the primary keys for IP cores will not be leaked. The simulation results show that the proposed method reduces the key retrieval time by 36.3% over the baseline. The proposed obfuscation methods have been successfully applied to ISCAS'89 benchmark circuits. Experimental results indicate that the orthogonal obfuscation only increases the area by 3.4% and consumes 4.7% more power than the baseline.1

Nowadays, integrated circuits (ICs) security grown as a primary responsibility at every stage of IC supply chain due to the globalized design, fabrication, test, deployment and monitoring of an IC. In this regard, Advanced Encryption Standard (AES) is widely accepted and supported in both the domain, software as well as hardware. To diminish the effect and cause of different threats, researchers identified that the hardware obfuscation based AES is a promising technique and a solution towards piracy and reverse engineering. This paper discusses about the design and simulation of 128-bit AES algorithm using active hardware obfuscation techniques. 128-bit AES is designed and simulated using Xilinx Vivado 2016.2. In this paper simulation results of 128-bit AES algorithm are analyzed with and without obfuscation techniques. Results shows that with obfuscation techniques 128 bit AES algorithm offer higher level of security and implementation flexibility with small area overhead and power overhead. The robustness of proposed algorithm is also analyzed in the form of throughput and efficiency. The authors also presented the power consumption and analyzed the area overhead of proposed algorithm with different xilinx 7 -series FPGAs.

IC piracy is a significant security threat, where malicious manufacturers can produce unauthorized extra chips and/or steal the information of a design through reverse engineering attempts. As a countermeasure, hardware obfuscation schemes usually withhold a part of the design (which thereafter constitutes the "key") by replacing it with configurable modules. Enforcing the configurable module to be filled in with the withheld key information enables a post-manufacturing activation of each authenticate chip, albeit with a a need to state the threat of a leaked common key. To ensure that each chip has a unique key, Physically Unclonable Functions (PUFs) have been proposed to be integrated with hardware obfuscation. Such a paradigm is constrained to use weak PUFs, because, to uniquely set the key (the content of the configurable module) for each chip, the designer needs to fully characterize the PUFs for all the chips. In this paper, we argue that a powerful attacker in the position of a manufacturer can fully characterize all the weak PUFs, and use any leaked key to break the obfuscation framework. This paper proposes a strong PUF-based hardware obfuscation scheme to effectively prevent IC piracy even in the case of a leaked key from some activated chip.

Hardware security is a matter of increasing importance in the modern world. With increasing threats of piracy and theft, it is needed to devise methodologies to mitigate these concerns. Obfuscating the design netlist is a popular method to achieve this to a significant extent. However, full security guarantee is not provided with the encryption approach. Under this scenario, a watermarking method complements the security guarantee by providing claims of IP authorship. In this paper, we present a unified methodology for circuit encryption and watermarking to enhance hardware security. Experiments on several ISCAS’85 benchmark circuits show that the proposed methodology has average 8.2% area overhead and 11.3% power overhead.

Obfuscation is a technique for protecting hardware intellectual property (IP) blocks against reverse engineering, piracy, and malicious modifications. Current obfuscation efforts mainly focus on functional locking of a design to prevent black-box usage. They do not directly address hiding design intent through structural transformations, which is an important objective of obfuscation. We note that current obfuscation techniques incorporate only: (1) local, and (2) predictable changes in circuit topology. In this paper, we present SAIL, a structural attack on obfuscation using machine learning (ML) models that exposes a critical vulnerability of these methods. Through this attack, we demonstrate that the gate-level structure of an obfuscated design can be retrieved in most parts through a systematic set of steps. The proposed attack is applicable to all forms of logic obfuscation, and significantly more powerful than existing attacks, e.g., SAT-based attacks, since it does not require the availability of golden functional responses (e.g. an unlocked IC). Evaluation on benchmark circuits show that we can recover an average of around 84% (up to 95%) transformations introduced by obfuscation. We also show that this attack is scalable, flexible, and versatile., 6 pages, 6 figures, 8 tables

3D Integrated Circuit (3D-IC) is an emerging technology that can address many challenging problems threatening the security of the chip by split manufacturing [1]. One of the disadvantages of split manufacturing is the uncertainty in the reliability of the last foundry that is responsible for the complete bonding of tiers. In this work, we present an innovative approach that safeguard the outsourcing of the entire 3D IC manufacturing including the last bonding stage. The proposed technique not only obfuscates the design functionality but immunes the IC against Trojan insertion.

The globalized semiconductor supply chain make integrated circuits (ICs) potentially suffer from diverse security threats. Among different hardware attacks, Trojan horse insertion has emerged as a major security concern. To mitigate the hardware Trojan insertion happened in the late stage of IC supply chain, researchers recognize that hardware obfuscation is a promising technique. This chapter first reviews the state-of-the-art hardware obfuscation methods at different levels, and then summarizes the metrics that can be used to assess the effectiveness of hardware obfuscation. At the end of this chapter, future research directions for hardware obfuscation against Trojan insertion are discussed.

While the globalization of the semiconductor production process has accelerated innovation, lowered costs, and reduced time-to-market, it has also created grave trust issues among the different entities involved in the production process. Theft, reverse engineering, and piracy of silicon intellectual property (IP) are the realities that manufacturers and vendors of integrated circuits must face today. In order to combat these threats, obfuscation has emerged as a viable candidate for semiconductor or hardware IP protection. Obfuscation techniques aim at concealing or locking the underlying intellectual property of a semiconductor product, such as IP cores, gate-level designs, or layout, in order to prevent an untrusted party or adversary from reverse engineering and/or exploiting the design. In this chapter, we will review emerging techniques for hardware obfuscation . We will describe the semiconductor supply chain in detail and outline the specific threats associated with each stage in the supply chain. We will also introduce the field of software obfuscation and related concepts that predate hardware obfuscation. Lastly, we will introduce relevant metrics for implementing and evaluating the various hardware obfuscation techniques.

This chapter discusses the fundamental concepts of design and testing and their role in hardware obfuscation. It outlines the traditional design flow of integrated circuits and assesses the vulnerabilities associated with the verification techniques and testing structures that can expose the design details and help reverse-engineer the functionality. A survey of security enhancement schemes has been presented. Furthermore, different classifications of hardware obfuscation have been discussed that cover the associated vulnerabilities of key management in nonvolatile memories (NVMs). The review of nonvolatile memories, emerging technologies and hardware-based cryptographic primitives, physical unclonable functions (PUFs) and true random number generators (TRNGs) and their use in hardware obfuscation techniques has been deliberated.

While hardware obfuscation has been used in industry for many years, very few scientific papers discuss layout-level obfuscation. The main aim of this paper is to start a discussion about hardware obfuscation in the academic community and point out open research problems. In particular, we introduce a very flexible layout-level obfuscation tool that we use as a case study for hardware obfuscation. In this obfuscation tool, a small custom-made obfuscell is used in conjunction with a standard cell to build a new obfuscated standard cell library called Obfusgates. This standard cell library can be used to synthesize any HDL code with standard synthesis tools, e.g. Synopsis Design Compiler. However, only obfuscating the functionality of individual gates is not enough. Not only the functionality of individual gates, but also their connectivity, leaks important important information about the design. In our tool we therefore designed the obfuscation gates to include a large number of "dummy wires". Due to these dummy wires, the connectivity of the gates in addition to their logic functionality is obfuscated. We argue that this aspect of obfuscation is of great importance in practice and that there are many interesting open research questions related to this.

As the internet-of-things (IoT) era begins, there is a significant need for low-cost access control schemes that allow humans to activate and maintain IoT systems.Traditional biometric access control systems remain, however, vulnerable to physical attacks resulting in template theft/privacy, illegal access, etc. This paper aimed to address this by expanding on a proposal called BLOcKeR, which combines biometrics with two recent advances in hardware security—physically unclonable functions (PUFs) and hardware obfuscation. Hardware obfuscation is a technique to protect electronic hardware against access control circumvention attacks through locking mechanisms. A PUF is incorporated to tie the biometrics of the owner to the system. Combining these advances with biometrics, BLOcKeR protects a biometric system from physical attacks by locking its functionality and aims at ensuring successful activation of the locked system unlike the authentication /matching in biometric systems. In addition, unlike various existing approaches, BLOcKeR does not store the raw biometric of users while providing irreversibility, unlinkability, and revocability to the templates. We present a security analysis and experiments with more than 45,000 attack variants to evaluate BLOcKeR’s security against unauthorized access.

The security of hardware intellectual properties (IPs) has become a significant concern, as the opportunity for piracy, reverse engineering, and malicious modification is increasing. Hardware obfuscation has been studied as a potent method to protect against all these attack vectors. However, most of the existing obfuscation techniques have been successfully compromised, where many inherent functional or structural vulnerabilities in these techniques are utilized to reveal the obfuscation key or retrieve the original design. In this paper, we introduce LeGO, a learning-guided obfuscation framework that overcomes known vulnerabilities in a scalable and systematic manner, leading to a robust and lightweight locking mechanism. The proposed framework is guided by our security evaluation process that performs a thorough assessment of an obfuscated IP against various attacks and identifies the vulnerabilities. It then judiciously selects and applies a set of design modification steps or rules that can eliminate these vulnerabilities. Such a rule-based obfuscation process has the distinctive capability to address all existing as well as emerging attacks through the learning of appropriate design transformation steps that prevent these attacks. We present an efficient strategy to apply these rules on a design, while resolving any conflict. Our evaluation of the LeGO framework on a set of ISCAS85 and open-source IP benchmarks has shown promising results in terms of robustness against diverse attacks with an average of area, power and delay overhead of 39%, 45%, and 15%, respectively.

Emerging nanoelectronic semiconductor devices have been quite promising in enhancing hardware-oriented security and trust. However, implementing hardware security primitives and methodologies requires large area overhead and power consumption. Furthermore, emerging new attack models and vulnerabilities are regularly evolving and cannot be adequately addressed by current CMOS technology. This paper for the first time presents a comprehensive review of numerous post-CMOS technologies based hardware security primitives and methodologies, particularly true random number generators, physically unclonable functions, sidechannel analysis countermeasures, and hardware obfuscation techniques. Various beyond-CMOS device technologies including tunneling FET (TFET), hybrid phase transition FET (HyperFET), carbon nanotube FET (CNTFET), silicon nanowire FET (SiNWFET), symmetrical tunneling FET (SymFET), phase-change memory (PCM), spin-transfer torque magnetic tunnel junction (STT-MTJ), resistive random access memory (RRAM) have been considered in this study. First, the basic principle of operation and unusual characteristics of nanoelectronic devices used for hardware security applications have been extensively discussed. Later, CMOS technology challenges and benefits of emerging nanotechnologies for the design of hardware security primitives and methodologies have been reported. Finally, different analyses have been presented to demonstrate the promising performance of post-CMOS devices over the current CMOS technology in different countermeasures. Additionally, challenges, future directions, and plans have been presented to achieve more research outcomes in this field.

Hardware reverse engineering is a powerful and universal tool for both security engineers and adversaries. From a defensive perspective, it allows for detection of intellectual property infringements and hardware Trojans, while it simultaneously can be used for product piracy and malicious circuit manipulations. From a designer's perspective, it is crucial to have an estimate of the costs associated with reverse engineering, yet little is known about this, especially when dealing with obfuscated hardware. The contribution at hand provides new insights into this problem, based on algorithms with sound mathematical underpinnings. Our contributions are threefold: First, we present the graph similarity problem for automating hardware reverse engineering. To this end, we improve several state-of-the-art graph similarity heuristics with optimizations tailored to the hardware context. Second, we propose a novel algorithm based on multiresolutional spectral analysis of adjacency matrices. Third, in three extensively evaluated case studies, namely (1) gate-level netlist reverse engineering, (2) hardware Trojan detection, and (3) assessment of hardware obfuscation, we demonstrate the practical nature of graph similarity algorithms.

International audience; This paper presents a high-level circuit obfuscation technique to prevent the theft of intellectual property (IP) of integrated circuits. In particular, our technique protects a class of circuits that relies on constant multiplications, such as filters and neural networks, where the constants themselves are the IP to be protected. By making use of decoy constants and a key-based scheme, a reverse engineer adversary at an untrusted foundry is rendered incapable of discerning true constants from decoy constants. The time-multiplexed constant multiplication (TMCM) block of such circuits, which realizes the multiplication of an input variable by a constant at a time, is considered as our case study for obfuscation. Furthermore, two TMCM design architectures are taken into account; an implementation using a multiplier and a multiplierless shift-adds implementation. Optimization methods are also applied to reduce the hardware complexity of these architectures. The well-known satisfiability (SAT) and automatic test pattern generation (ATPG) attacks are used to determine the vulnerability of the obfuscated designs. It is observed that the proposed technique incurs small overheads in area, power, and delay that are comparable to the hardware complexity of prominent logic locking methods. Yet, the advantage of our approach is in the insight that constants-instead of arbitrary circuit nodes-become key-protected. Index Terms-hardware obfuscation, reverse engineering, IP obfuscation, SAT attack, digital FIR filter design.

Hardware intellectual properties (IPs) used in diverse electronic systems face several critical security issues during their life cycle, including piracy, reverse engineering, and extraction of design secrets. To combat these issues, pre-silicon hardware obfuscation or logic locking has emerged as a promising solution and has been an active research topic over the past decade. However, in parallel, a number of functional and structural attacks on obfuscation have been discovered by the research community to break the protection provided by the existing obfuscation schemes. These attacks have played a major role in enhancing the security of hardware obfuscation schemes. In this paper, we introduce a novel combined attack modality, referred to as SOMA, which relies on judiciously combining the existing attacks to produce a significantly more powerful one. We demonstrate that such an attack can expose hidden exploits and measure the level of security offered by a given obfuscation technique. SOMA creates a sequence of attacks, where the outcome of each attack is used to guide the next and concludes with a key-refinement measure to restore the functionality of a locked IP. We demonstrate that SOMA can easily break major existing locking schemes that are believed to be secure with an attack accuracy average of 94.88%.

Logic locking has emerged as a promising solution to protect integrated circuits against piracy and tampering. However, the security provided by existing logic locking techniques is often thwarted by Boolean satisfiability (SAT)-based oracle-guided attacks. Criteria for successful SAT attacks on locked circuits include: (i) the circuit under attack is fully combinational, or (ii) the attacker has scan chain access. To address the threat posed by SAT-based attacks, we adopt the dynamically obfuscated scan chain (DOSC) architecture and illustrate its resiliency against the SAT attacks when inserted into the scan chain of an obfuscated design. We demonstrate, both mathematically and experimentally, that DOSC exponentially increases the resiliency against key extraction by SAT attack and its variants. Our results show that the mathematical estimation of attack complexity correlates to the experimental results with an accuracy of 95% or better. Along with the formal proof, we model DOSC architecture to its equivalent combinational circuit and perform SAT attack to evaluate its resiliency empirically. Our experiments demonstrate that SAT attack on DOSC-inserted benchmark circuits timeout at minimal test time overhead, and while DOSC requires less than 1% area and power overhead.

We propose three orthogonal techniques to secure Register-Transfer-Level (RTL) Intellectual Property (IP). In the first technique, the key-based RTL obfuscation scheme is proposed at an early design phase during High-Level Synthesis (HLS). Given a control-dataflow graph, we identify operations on non-critical paths and leverage synthesis information during and after HLS to insert obfuscation logic. In the second approach, we propose a robust design lockout mechanism for a key-obfuscated RTL IP when an incorrect key is applied more than the allowed number of attempts. We embed comparators on obfuscation logic output to check if the applied key is correct or not and a finite-state machine checker to enforce design lockout. Once locked out, only an authorized user (designer) can unlock the locked IP. In the third technique, we design four variants of the obfuscating module to camouflage the RTL design. We analyze the security properties of obfuscation, design lockout, and camouflaging. We demonstrate the feasibility on four datapath-intensive IPs and one crypto core for 32-, 64-, and 128-bit key lengths under three design corners (best, typical, and worst) with reasonable area, power, and delay overheads on both ASIC and FPGA platforms.

With the advancement of system miniaturization and automation, Lab-on-a-Chip (LoC) technology has revolutionized traditional experimental procedures. Microfluidic Biochip (MFB) is an emerging branch of LoC with wide medical applications such as DNA sequencing, drug delivery, and point of care diagnostics. Due to the critical usage of MFBs, their security is of great importance. In this article, we exploit the vulnerabilities of two types of MFBs: Flow-based Microfluidic Biochip (FMFB) and Digital Microfluidic Biochip (DMFB). We propose a systematic framework for applying Reverse Engineering (RE) attacks and Hardware Trojan (HT) attacks on MFBs as well as for practical countermeasures against the proposed attacks. We evaluate the attacks and defense on various benchmarks where experimental results prove the effectiveness of our methods. Security metrics are defined to quantify the vulnerability of MFBs. The overhead and performance of the proposed attacks as well as countermeasures are also discussed.

In recent years, IC reverse engineering and IC fabrication supply chain security have grown to become significant economic and security threats for designers, system integrators, and end customers. Many of the existing logic locking and obfuscation techniques have shown to be vulnerable to attack once the attacker has access to the design netlist either through reverse engineering or through an untrusted fabrication facility. We introduce soft embedded FPGA redaction, a hardware obfuscation approach that allows the designer substitute security-critical IP blocks within a design with a synthesizable eFPGA fabric. This method fully conceals the logic and the routing of the critical IP and is compatible with standard ASIC flows for easy integration and process portability. To demonstrate eFPGA redaction, we obfuscate a RISC-V control path and a GPS P-code generator. We also show that the modified netlists are resilient to SAT attacks with moderate VLSI overheads. The secure RISC-V design has 1.89x area and 2.36x delay overhead while the GPS design has 1.39x area and negligible delay overhead when implemented on an industrial 22nm FinFET CMOS process.

In recent years, IC reverse engineering and IC fabrication supply chain security have grown to become significant economic and security threats for designers, system integrators, and end customers. Many of the existing logic locking and obfuscation techniques have shown to be vulnerable to attack once the attacker has access to the design netlist either through reverse engineering or through an untrusted fabrication facility. We introduce soft embedded FPGA redaction, a hardware obfuscation approach that allows the designer substitute security-critical IP blocks within a design with a synthesizable eFPGA fabric. This method fully conceals the logic and the routing of the critical IP and is compatible with standard ASIC flows for easy integration and process portability. To demonstrate eFPGA redaction, we obfuscate a RISC-V control path and a GPS P-code generator. We also show that the modified netlists are resilient to SAT attacks with moderate VLSI overheads. The secure RISC-V design has 1.89x area and 2.36x delay overhead while the GPS design has 1.39x area and negligible delay overhead when implemented on an industrial 22nm FinFET CMOS process.

This paper proposes a novel technique for hardware obfuscation termed dynamic functional obfuscation . Hardware obfuscation refers to a set of countermeasures used against IC counterfeiting and illegal overproduction. Traditionally, obfuscation encrypts semiconductor circuits using key inputs which must be set to a correct value to operate the circuit correctly. By keeping the key values secret during the manufacturing process, any attempt by unauthorized parties to overproduce chips or pirate designs is thwarted. The proposed dynamic technique differs from existing fixed obfuscation schemes as the obfuscating signals change over time. This results in inconsistent circuit behavior upon input of incorrect key, where the chip operates correctly sometimes and fails sometimes. The advantage of dynamic obfuscation is that it results in stronger obfuscation by increasing the time complexity of deciphering the correct key using brute-force attack, even with shorter keys. Moreover, the dynamic nature of these circuits also makes them resistant to reverse engineering and SAT solver-based attacks. To achieve dynamic obfuscation, ideas from hardware Trojan literature and sequentially triggered counters are utilized. A demonstration of obfuscation on sequential circuits implementing fast Fourier transform (FFT) algorithm and Ethernet IP shows low overall area and power overheads of less than 1%. Security in terms of time to attack for the FFT circuit (for a key size of 30 bits and a system operating at 100 MHz) is increased to 1 021,055 years using dynamic obfuscation compared with only 5.36 s using fixed obfuscation schemes. For the Ethernet IP core, time to attack of dynamic obfuscation with a key size of 32 bits is 1 046,423, 135 years compared with 21.47s with fixed obfuscation. It is also shown that for a key size of $K$ bits, the lower bound for time to attack using brute-force is proportional to $K 2^{K}$ and $K 2^{2K}$ for the proposed design using one and two random number generators, respectively.

Hardware obfuscation is widely used in practice to counteract reverse engineering. In recent years, low-level obfuscation via camouflaged gates has been increasingly discussed in the scientific community and industry. In contrast to classical high-level obfuscation, such gates result in recovery of an erroneous netlist. This technology has so far been regarded as a purely defensive tool. We show that low-level obfuscation is in fact a double-edged sword that can also enable stealthy malicious functionalities.In this work, we present Doppelganger, the first generic design-level obfuscation technique that is based on low-level camouflaging. Doppelganger obstructs central control modules of digital designs, e.g., Finite State Machines (FSMs) or bus controllers, resulting in two different design functionalities: an apparent one that is recovered during reverse engineering and the actual one that is executed during operation. Notably, both functionalities are under the designer’s control.In two case studies, we apply Doppelganger to a universal cryptographic coprocessor. First, we show the defensive capabilities by presenting the reverse engineer with a different mode of operation than the one that is actually executed. Then, for the first time, we demonstrate the considerable threat potential of low-level obfuscation. We show how an invisible, remotely exploitable key-leakage Trojan can be injected into the same cryptographic coprocessor just through obfuscation. In both applications of Doppelganger, the resulting design size is indistinguishable from that of an unobfuscated design, depending on the choice of encodings.

The emerging security threats in the integrated circuit supply chain do not only challenge the chip integrity, but also raise serious concerns on hardware intellectual property (IP) piracy. Hardware design obfuscation is a promising countermeasure to resist reverse engineering attacks and IP piracy. The majority of existing hardware obfuscation methods modify the original finite state machine (FSM) by adding additional state transitions and utilizing a key sequence to lock the transition from the nonfunctional states to the functional reset state. Those methods are effective to prevent attackers from entering the normal functional mode but they lack resilience if the FSM is already in the normal mode. This paper proposes to protect all the states with a low-cost state-deflection-based obfuscation method, which dynamically deflects state transitions from the original transition path to a black hole cluster if a wrong key is applied. Unlike other works that use static transitions between legal states to black hole states at the design time, this method utilizes a state rotation function (Rotatefunc) and selective register flipping function (Mapfunc) to dynamically control the state deflection paths. Hence, the difficulty of reverse engineering and thwarting register overwrite attacks is increased. Simulations performed on ISCAS’89 benchmark circuits show that the proposed method significantly reduces the difference of the net toggle activities between the correct and wrong key scenarios, and achieves up to 56% higher code coverage than the most efficient obfuscation method. Thanks to the dynamic deflection feature, on average, this method generates about 100 more unique state register patterns than other methods with moderate power increase. Moreover, the proposed method achieves the Hamming distance of primary outputs and state registers close to 50%.

With the recent introduction of techniques to restrict scan chain access, a new class of deobfuscation problems emerge, in which the threat model, although similar to deobfuscation of a logic locked circuit, forms a novel class of attack. In this paper, the concept of a logic restricted circuit is generalized and defined. Next, a novel type of SAT-based attack is proposed for the new class of deobfuscation problems, described as a 2-stage SAT-attack. A SAT-attack resilience measure is developed to quantify the security strength of a logic restricted circuit against a SAT-based attack. Finally, the proposed SAT-resilience framework is applied to compare and evaluate effectiveness of example logic restriction schemes.

Protecting effectively integrated circuit (IC) intellectual property (IP) cores has become an urgent problem. Obfuscation is an effective measure to protect IP cores of IC design. After studying the full homomorphism algorithm and the hardware obfuscation theory, a obfuscation algorithm design scheme is proposed based on the full homomorphism. In this scheme, the feasibility of the full homomorphism method in the hardware circuit is analyzed. Then, obfuscated data selector and multiplier are implemented based on full homomorphic algorithm. Finally, the proposed hardware circuit of obfuscation algorithm are designed in the TSMC 65nm process. Experimental results show that the full homomorphism algorithm based on hardware obfuscation has the correct logic function and the encrypted output data has the better randomness.

The separation of manufacturing and design processes in the integrated circuit industry to tackle the ever increasing circuit complexity and time to market issues has brought with it some major security challenges. Chief among them is IP piracy by untrusted parties. Hardware obfuscation which locks the functionality and modifies the structure of an IP core to protect it from malicious modifications or piracy has been proposed as a solution. In this paper, we develop an efficient hardware obfuscation method, called Mystic (Mystifying IP Cores), to protect IP cores from reverse engineering, IP overproduction, and IP piracy. The key idea behind Mystic is to add additional state transitions to the original/functional FSM (Finite State Machine) that are taken only when incorrect keys are applied to the circuit. Using the proposed Mystic obfuscation approach, the underlying functionality of the IP core is locked and normal FSM transitions are only available to authorized chip users. The synthesis results of ITC99 circuit benchmarks for ASIC 45nm technology reveal that the Mystic protection method imposes on average 5.14% area overhead, 5.21% delay overhead, and 8.06% power consumption overheads while it exponentially lowers the probability that an unauthorized user will gain access to or derive the chip functionality.

Security in daily transactions, not only in the financial sector, but also in various upcoming Industrial smart application areas needs a generic solution, out of the cat and mouse race, where frequently vulnerabilities are pointed out and a quick patch is fabricated to resolve the issue temporarily. An impromptu solution to this protracted issue will not be enough to solve on the long run, thus dedicated researchers have been putting efforts to their best for finding the real problem by asking the right questions. Through this paper authors have attempted to trace the current issues in handling decentralised ledger system using blockchain technology and discussed state of the art management in auditing hardware obfuscation techniques.

The high cost of IC design has made chip protection one of the first priorities of the semiconductor industry. In addition, with the growing number of untrusted foundries, the possibility of inside foundry attack is escalating. However, by taking advantage of polymorphic gates, the layouts of the circuits with different functionalities look exactly identical, making it impossible even for an inside foundry attacker to distinguish the defined functionality of an IC by looking at its layout. Moreover, since memristor is compatible with CMOS structure, it is possible to efficiently design hybrid memristor-CMOS circuits. In this paper, we propose a hardware obfuscation method based on polymorphic hybrid memristor-CMOS technology. Overhead of the polymorphic designs and the time complexity of possible attacks are discussed.

Ahstract-Various attacks on hardware intellectual properties (IPs) have been successful in obtaining design information that can be used to reverse engineer a system, create counterfeits, or insert hardware Trojans. Key-based hardware obfuscation is an attractive solution that helps prevent such attacks. In this paper, for the first time, we propose a key error tolerant obfuscation approach that achieves graceful degradation in output Quality of Service (QoS) as the bit error rate (BER) in obfuscation key increases. The approach, which we refer to it as, “Quality Obfuscation”, is applicable to a large variety of IPs, including digital signal processing (DSP) and approximating computing IPs, which are resilient to output QoS degradation. We present a complete obfuscation framework that can be adapted to any error tolerance rate. To demonstrate its robustness, we obfuscate several common DSP IP blocks and observe the performance under various percentages of bit-flips in the key. We show that our approach provides controllability of system quality, as well as the strong protection at low overhead, e.g., average 15% area and 5.9% power overhead to tolerate 10% BER.

The protection of Intellectual Property (IP) has emerged as one of the most important issues in the hardware design industry. Most VLSI design companies are now fabless and need to protect their IP from being illegally distributed. One of the main approach to address this has been through logic locking. Logic locking prevents IPs from being reversed engineered as well as overbuilding the hardware circuit by untrusted foundries. One of the main problem with existing logic locking techniques is that the foundry has full access to the entire design including the logic locking mechanism. Because of the importance of this topic, continuous more robust locking mechanisms are proposed and equally fast new methods to break them appear. One alternative approach is to lock a circuit through omission. The main idea is to selectively map a portion of the IP onto an embedded FPGA (eFPGA). Because the foundry does not have access to the bitstream, the circuit cannot be used until programmed by the legitimate user. One of the main problems with this approach is the large overhead in terms of area and power, as well as timing degradation. Area is especially a concern for price sensitive applications. To address this, in this work we presents a method to map portions of a design onto a Coarse Grained Runtime Reconfigurable Architecture (CGRRA) such that multiple parts of a design can be hidden onto the CGRRA, substantially amortizing the area overhead introduced by the CGRRA.

Logic locking aims to protect the intellectual property (IP) of integrated circuit (IC) designs throughout the globalized supply chain. The SAIL attack, based on tailored machine learning (ML) models, circumvents combinational logic locking with high accuracy and is amongst the most potent attacks as it does not require a functional IC acting as an oracle. In this work, we propose UNSAIL, a logic locking technique that inserts key-gate structures with the specific aim to confuse ML models like those used in SAIL. More specifically, UNSAIL serves to prevent attacks seeking to resolve the structural transformations of synthesis-induced obfuscation, which is an essential step for logic locking. Our approach is generic; it can protect any local structure of key-gates against such ML-based attacks in an oracle-less setting. We develop a reference implementation for the SAIL attack and launch it on both traditionally locked and UNSAIL-locked designs. In SAIL, a change-prediction model is used to determine which key-gate structures to restore using a reconstruction model. Our study on benchmarks ranging from the ISCAS-85 and ITC-99 suites to the OpenRISC Reference Platform System-on-Chip (ORPSoC) confirms that UNSAIL degrades the accuracy of the change-prediction model and the reconstruction model by an average of 20.13 and 17 percentage points (pp) respectively. When the aforementioned models are combined, which is the most powerful scenario for SAIL, UNSAIL reduces the attack accuracy of SAIL by an average of 11pp. We further demonstrate that UNSAIL thwarts other oracle-less attacks, i.e., SWEEP and the redundancy attack, indicating the generic nature and strength of our approach. Detailed layout-level evaluations illustrate that UNSAIL incurs minimal area and power overheads of 0.26% and 0.61%, respectively, on the million-gate ORPSoC design., IEEE Transactions on Information Forensics and Security (TIFS)

Securing intellectual property (IP) blocks have become a huge concern for the designers due to increasing attacks at different stages of the design. This wide array of attacks from IP piracy, counterfeiting, reverse engineering to overproduction has prompted designers to look into protection mechanisms to limit unauthorized access to the actual design. Logic locking/obfuscation is such a technique that protects designs from unauthorized usages by embedding locking keys into the design that are unknown to adversaries. However, the majority of the proposed locking techniques work at the gate-level of the design, and it has been shown that the correct keys can be successfully retrieved through various adversarial attacks such as SAT attacks, removal attacks, and reverse engineering. In this chapter, we propose a locking technique at a higher level of abstraction and show that using high-level synthesis, this technique is far more resilient towards different attacks and provides better control in terms of performance parameters to the designer compared to other techniques. The key element of this technique is locking the design at higher levels of abstractions (i.e., C/C++) when the designers have a better understanding of the design’s critical functions/information. In the next step, a high-level synthesis (HLS) tool is used to automatically generate locked RTL modules from an untimed C/C++ description. The proposed framework is dependent on HLS. As a result, design security also depends on a secure HLS process. For this purpose, we also provide a detailed security assessment on the HLS process and show potential vulnerabilities during its translation. We also present some verification approaches to address these vulnerabilities to secure the design and provide a robust framework for IP protection.

To reduce the cost of ICs and to meet the market's demand, a considerable portion of manufacturing supply chain, including silicon fabrication, packaging and testing may be pushed offshore. Utilizing a global IC manufacturing supply chain, and inclusion of non-trusted parties in the supply chain has raised concerns over security and trust related challenges including those of overproduction, counterfeiting, IP piracy, and Hardware Trojans to name a few. To reduce the risk of IC manufacturing in an untrusted and globally distributed supply chain, the researchers have proposed various locking and obfuscation mechanisms for hiding the functionality of the ICs during the manufacturing, that requires the activation of the IP after fabrication using the key value(s) that is only known to the IP/IC owner. At the same time, many such proposed obfuscation and locking mechanisms are broken with attacks that exploit the inherent vulnerabilities in such solutions. The past decade of research in this area, has resulted in many such defense and attack solutions. In this paper, we review a decade of research on hardware obfuscation from an attacker perspective, elaborate on attack and defense lessons learned, and discuss future directions that could be exploited for building stronger defenses.

Effective resistance to intellectual property (IP) piracy, overproduction and reverse engineering are becoming more and more necessary in the integrated circuit (IC) supply chain. To protect the hardware, the obfuscation methodology hides the original function by adding a large number of redundant states. However, existing hardware obfuscation approaches have hardware overhead and efficiency of obfuscation limitations. This paper proposed a novel methodology for IP security using the minimum spanning tree finite state machine (MST-FSM) obfuscation. In the minimum spanning tree (MST) algorithm, the Hamming distance defines the cost of obfuscated states. The Kruskal algorithm optimizes the connection relationship of obfuscated states by computing the Hamming distance of the MST-FSM. The proposed MST-FSM is automatically generated and embedded in the hardware IP with the self-building program. Finally, the MST-FSM is applied on the itc99 benchmark circuits and encryption standard IP cores. Compared with other state-of-the-arts, the obfuscation potency is improved by 3.57%, and the average hardware cost is decreased by about 6.01%.