Functional Obfuscation Research Articles

A Module-Level Configuration Methodology for Programmable Camouflaged Logic

Logic camouflage is a widely adopted technique that mitigates the threat of intellectual property (IP) piracy and overproduction in the integrated circuit (IC) supply chain. Camouflaged logic achieves functional obfuscation through physical-level ambiguity and post-manufacturing programmability. However, discussions on programmability are confined to the level of logic cells/gates, limiting the broader-scale application of logic camouflage. In this work, we propose a novel module-level configuration methodology for programmable camouflaged logic that can be implemented without additional hardware ports and with negligible resources. We prove theoretically that the configuration of the programmable camouflaged logic cells can be achieved through the inputs and netlist of the original module. Further, we propose a novel lightweight ferroelectric FET (FeFET)-based reconfigurable logic gate (rGate) family and apply it to the proposed methodology. With the flexible replacement and the proposed configuration-aware conversion algorithm, this work is characterized by the input-only programming scheme as well as the combination of high output error rate and point-function-like defense. Evaluations show an average of >95% of the alternative rGate location for camouflage, which is sufficient for the security-aware design. We illustrate the exponential complexity in function state traversal and the enhanced defense capability of locked blackbox against Boolean Satisfiability (SAT) attacks compared with key-based methods. We also preserve an evident output Hamming distance and introduce negligible hardware overheads in both gate-level and module-level evaluations under typical benchmarks.

Hardware functional obfuscation with ferroelectric active interconnects

Existing circuit camouflaging techniques to prevent reverse engineering increase circuit-complexity with significant area, energy, and delay penalty. In this paper, we propose an efficient hardware encryption technique with minimal complexity and overheads based on ferroelectric field-effect transistor (FeFET) active interconnects. By utilizing the threshold voltage programmability of the FeFETs, run-time reconfigurable inverter-buffer logic, utilizing two FeFETs and an inverter, is enabled. Judicious placement of the proposed logic makes it act as a hardware encryption key and enable encoding and decoding of the functional output without affecting the critical path timing delay. Additionally, a peripheral programming scheme for reconfigurable logic by reusing the existing scan chain logic is proposed, obviating the need for specialized programming logic and circuitry for keybit distribution. Our analysis shows an average encryption probability of 97.43% with an increase of 2.24%/ 3.67% delay for the most critical path/ sum of 100 critical paths delay for ISCAS85 benchmarks.

Low‐cost robust anti‐removal logic for protecting functionally obfuscated DSP core against removal attack

Digital signal processing (DSP) cores (kernels) are key components of modern consumer electronics devices. However, protection of DSP kernels is very crucial considering its vulnerability to hardware threats such as reverse engineering (RE). Functional obfuscation is one of the security mechanisms which provide protection against RE. However, functional obfuscation logic is in itself vulnerable to removal attack. This Letter presents a novel anti-removal logic (ARL) unit which ensures protection against the removal attack on functional obfuscation logic. Further, the ARL unit is itself safeguarded against removal attack by incorporating design architecture customisation and camouflaging. Designer can customise and camouflage the internal gate structure network of the ARL blocks post-synthesis (post-mapping and fitting). The proposed ARL unit integrated with functionally obfuscated DSP design, yielded lightweight and highly secured solution against removal attack when compared to an existing approach. The proposed approach reported on an average 42.57% reduction in gate count and on an average 66.67% enhancement in security compared to a recent existing approach.

Low Cost Functional Obfuscation of Reusable IP Cores Used in CE Hardware Through Robust Locking

Intellectual property (IP) cores used in consumer electronics devices mandate protection against reverse engineering (RE) attacks. Functional obfuscation protects the design functionality by enhancing the complexity of RE attacks. This paper proposes a novel low cost (based on power-delay tradeoff) functional obfuscation methodology through employment of robust IP locking technique. In the proposed obfuscation methodology, several strong multipairwise secure IP locking block designs are presented that can only be actuated through application of valid serial key bits. As demonstration, this paper also shows a practical example of a functional obfuscated netlist structure of FIR filter. Proposed obfuscation on comparison with a recent approach for several DSP cores yielded a power reduction of ~10%, design cost reduction ~ 6.5% and security enhancement (strength of obfuscation) of $>\,\,4.29\,\,{e+9}$ times.

In brief

PAGE 372 A front-end adaptive folder with a filter is used to instantaneously push jammers to higher frequencies while preserving small signal integrity. Presented by a team of researchers from the USA, combinatorial intrinsic device characteristics are exploited to tune folding points and achieve maximum programmability. PAGE 396 A researcher from Japan has investigated the transmission characteristics of an optical signal which has been converted using detection, modulation and filtering from a high-speed terahertz-wave signal. The converted signal shaped with root Nyquist filters can be transmitted down a 9 km-long fiber without compensation. Received signals with jammer moved to gradually higher frequencies. PAGE 374 Digital signal processing cores are common in consumer electronics and require protection from the hardware threats posed by reverse engineering. A pair of researchers from India present a novel anti-removal logic unit which protects against attacks on functional obfuscation logic. The approach has significant security enhancements over current standards. Measured optical signal spectrum. PAGE 402 The energy storage battery in a microgrid can perform demand side management which requires a bidirectional power transmission control function with constant power. A group of Chinese researchers have designed a boost converter circuit topology followed by a timing trigger mechanism control system, with simulation demonstrating it achieves accurate power reference value tracking. Designer selected AND-OR network. PAGE 365 A pair of researchers from India propose a wideband circularly polarised antenna based on composite metamaterial structures applicable for small satellite applications. A new unit cell artificial magnetic conductor metasurface is used as a ground plane for the antenna which has increased bandwidth, gain and a wider axial ratio bandwidth despite its compact size. An operating mode of the proposed converter. Proposed metamaterial antenna front view.

Security of Functionally Obfuscated DSP Core Against Removal Attack Using SHA-512 Based Key Encryption Hardware

Digital signal processing (DSP) kernel-based intellectual property (IP) core forms an integral ingredient of consumer electronics devices. Thus, protection of these IP cores against reverse engineering attack is crucial. Functional obfuscation serves as a powerful mechanism to counter this hardware threat. However, functional obfuscation methodologies for DSP cores use security logics that are not lightweight and are prone to removal attack by an adversary. This paper presents a novel security mechanism for protecting functionally obfuscated DSP core against removal attack using low-cost, low-power key encryption hardware. The proposed methodology using lightweight secure hashing algorithm (SHA-512)-based key encryption custom hardware reconfigures the key-bits (resulting into structural reconfiguration) of the locking logic in a functionally obfuscated DSP design augmented with the complete logic synthesis of the design. This hinders the detection of the locking logic in the obfuscated design due to camouflaging. The proposed mechanism integrated with the functional obfuscation framework yielded lower power, lower gate count, and enhanced security compared with an existing approach. An average reduction of 25.86 % in gate count and power as well as the average enhancement of 43.75 % in security against removal attack was obtained in the proposed approach compared with a recent existing approach.

The Magic of ELFs

We introduce the notion of an Extremely Lossy Function (ELF). An ELF is a family of functions with an image size that is tunable anywhere from injective to having a polynomial-sized image. Moreover, for any efficient adversary, for a sufficiently large polynomial r (necessarily chosen to be larger than the running time of the adversary), the adversary cannot distinguish the injective case from the case of image size r. We develop a handful of techniques for using ELFs, and show that such extreme lossiness is useful for instantiating random oracles in several settings. In particular, we show how to use ELFs to build secure point function obfuscation with auxiliary input, as well as polynomially many hardcore bits for any one-way function. Such applications were previously known from strong knowledge assumptions—for example, polynomially many hardcore bits were only known from differing inputs obfuscation, a notion whose plausibility has been seriously challenged. We also use ELFs to build a simple hash function with output intractability, a new notion we define that may be useful for generating common reference strings. Next, we give a construction of ELFs relying on the exponential hardness of the decisional Diffie–Hellman problem, which is plausible in elliptic curve groups. Combining with the applications above, our work gives several practical constructions relying on qualitatively different—and arguably better—assumptions than prior works.

Key-Based Dynamic Functional Obfuscation of Integrated Circuits Using Sequentially Triggered Mode-Based Design

This paper proposes a novel technique for hardware obfuscation termed dynamic functional obfuscation . Hardware obfuscation refers to a set of countermeasures used against IC counterfeiting and illegal overproduction. Traditionally, obfuscation encrypts semiconductor circuits using key inputs which must be set to a correct value to operate the circuit correctly. By keeping the key values secret during the manufacturing process, any attempt by unauthorized parties to overproduce chips or pirate designs is thwarted. The proposed dynamic technique differs from existing fixed obfuscation schemes as the obfuscating signals change over time. This results in inconsistent circuit behavior upon input of incorrect key, where the chip operates correctly sometimes and fails sometimes. The advantage of dynamic obfuscation is that it results in stronger obfuscation by increasing the time complexity of deciphering the correct key using brute-force attack, even with shorter keys. Moreover, the dynamic nature of these circuits also makes them resistant to reverse engineering and SAT solver-based attacks. To achieve dynamic obfuscation, ideas from hardware Trojan literature and sequentially triggered counters are utilized. A demonstration of obfuscation on sequential circuits implementing fast Fourier transform (FFT) algorithm and Ethernet IP shows low overall area and power overheads of less than 1%. Security in terms of time to attack for the FFT circuit (for a key size of 30 bits and a system operating at 100 MHz) is increased to 1 021,055 years using dynamic obfuscation compared with only 5.36 s using fixed obfuscation schemes. For the Ethernet IP core, time to attack of dynamic obfuscation with a key size of 32 bits is 1 046,423, 135 years compared with 21.47s with fixed obfuscation. It is also shown that for a key size of $K$ bits, the lower bound for time to attack using brute-force is proportional to $K 2^{K}$ and $K 2^{2K}$ for the proposed design using one and two random number generators, respectively.

Obfuscating DSP Circuits via High-Level Transformations

This paper presents a novel approach to design obfuscated circuits for digital signal processing (DSP) applications using high-level transformations, a key-based obfuscating finite-state machine (FSM), and a reconfigurator. The goal is to design DSP circuits that are harder to reverse engineer. High-level transformations of iterative data-flow graphs have been exploited for area-speed-power tradeoffs. This is the first attempt to develop a design flow to apply high-level transformations that not only meet these tradeoffs but also simultaneously obfuscate the architectures both structurally and functionally. Several modes of operations are introduced for obfuscation where the outputs are meaningful from a signal processing point of view, but are functionally incorrect. Examples of such modes include a third-order digital filter that can also implement a sixth-order or ninth-order filter in a time-multiplexed manner. The latter two modes are meaningful but represent functionally incorrect modes. Multiple meaningful modes can be exploited to reconfigure the filter order for different applications. Other modes may correspond to nonmeaningful modes. A correct key input to an FSM activates a reconfigurator. The configure data controls various modes of the circuit operation. Functional obfuscation is accomplished by requiring use of the correct initialization key, and configure data. Wrong initialization key fails to enable the reconfigurator, and a wrong configure data activates either a meaningful but nonfunctional or nonmeaningful mode. Probability of activating the correct mode is significantly reduced leading to an obfuscated DSP circuit. Structural obfuscation is also achieved by the proposed methodology via high-level transformations. Experimental results show that the overhead of the proposed methodology is small, while a strong obfuscation is attained. For example, the area overhead for a (31)th-order IIR filter benchmark is only 17.7% with a 128-bit configuration key, where $1 \leq l \leq 8$ , i.e., the order of this filter should be a multiple of 3, and can vary from 3 to 24.