Redundancy Attack: Breaking Logic Locking Through Oracleless Rationality Analysis

Abstract

During the last decade, logic locking has been proposed to protect integrated circuits against piracy and reverse engineering threats. Functional pruning attacks, such as the Boolean satisfiability (SAT) attack, have greatly challenged the security of logic locking techniques, yet they require access to an oracle and suffer from muted efficacy on inherently SAT-hard circuits. In this article, we present a novel oracleless attack on both XOR and MUX-based logic locking by analyzing the redundancy level deviation under different keys. Our fundamental insight is that incorrect keys would produce circuits that violate universally followed design principles, prominent among which stands the minimization of logic redundancy. We leverage the redundancy-level deviation produced by individual and pairs of key bits to recover key bit values and establish pairwise equivalence, leading to an efficient nearly linear time attack algorithm. We experimentally verify that the proposed attack quickly unveils more than half of the key bits with high accuracy on 21 ISCAS’85 and MCNC circuits locked with a variety of locking techniques. To fortify logic locking in the face of this successful redundancy attack, we supplement this article with a key gate insertion methodology that smooths the deviation in redundancy level. We achieve this goal by selecting key gates that exhibit pairwise dissociation among a set of individually secure locations, which effectively breaks down correlations in arbitrary sets of key gates and, thus, imposes a consistent redundancy level throughout the key space. Experimental results confirm the strong redundancy attack resilience of the proposed defense strategy.