Hardware Obfuscation Research Articles

An Overview of FPGA-inspired Obfuscation Techniques

Building and maintaining a silicon foundry is a costly endeavor that requires substantial financial investment. From this scenario, the semiconductor business has largely shifted to a fabless model where the Integrated Circuit (IC) supply chain is globalized but potentially untrusted. In recent years, several hardware obfuscation techniques have emerged to thwart hardware security threats related to untrusted IC fabrication. Reconfigurable-based obfuscation schemes have shown great promise of security against state-of-the-art attacks – these are techniques that rely on the transformation of static logic configurable elements such as Look Up Tables (LUTs). This survey provides a comprehensive analysis of reconfigurable-based obfuscation techniques, evaluating their overheads and enumerating their effectiveness against all known attacks. The techniques are also classified based on different factors, including the technology used, element type, and IP type. Additionally, we present a discussion on the advantages of reconfigurable-based obfuscation techniques when compared to Logic Locking techniques and the challenges associated with evaluating these techniques on hardware, primarily due to the lack of tapeouts. The survey’s findings are essential for researchers interested in hardware obfuscation and future trends in this area.

Security Evaluation of State Space Obfuscation of Hardware IP through a Red Team-Blue Team Practice

Due to the inclination towards a fab-less model of integrated circuit (IC) manufacturing, several untrusted entities get white-box access to the proprietary intellectual property (IP) blocks from diverse vendors. To this end, the untrusted entities pose security-breach threats in the form of piracy, cloning, and reverse-engineering, sometimes threatening national security. Hardware obfuscation is a prominent countermeasure against such issues. Obfuscation allows for preventing the usage of the IP blocks without authorization from the IP owners. Due to finite state machine (FSM) transformation-based hardware obfuscation, the design’s FSM gets transformed to make it difficult for an attacker to reverse-engineer the design. A secret key needs to be applied to make the FSM functional, thus preventing the usage of the IP for unintended purposes. Although several hardware obfuscation techniques have been proposed, due to the inability to analyze the techniques from the attackers’ standpoint, numerous vulnerabilities inherent to the obfuscation methods go undetected unless a true adversary discovers them. In this article, we present a collaborative approach between two entities—one acting as an attacker or red team and another as a defender or blue team , the first systematic approach to replicate the real attacker-defender scenario in the hardware security domain, which in return strengthens the FSM transformation-based obfuscation technique. The blue team transforms the underlying FSM of a gate-level netlist using state space obfuscation. The red team plays the role of an adversary or evaluator and tries to unlock the design by extracting the unlocking key or recovering the obfuscation circuitries. As the key outcome of this red team–blue team effort, a robust state space obfuscation methodology is evolved showing security promises.

Hardware Obfuscation Based Watermarking Technique for IPR Ownership Identification

As the reuse of IP cores or the development of frequently used hardware modules is gaining more attention in the semiconductor industry, the misappropriation of the owner’s identity is a rising concern. Therefore, imprinting the owner’s identity in the form of a watermark or signature on the IP core is essential to avoid intellectual property right (IPR) infringement. In view of this, a watermarking technique is proposed in the present manuscript. A constraint-based dynamic watermarking method to generate the owner’s signature is proposed in conjunction with the logic encryption-based hardware obfuscation method. The method formulated in this manuscript consciously makes use of a basic switching component for embedding a watermark with IP core and hardware obfuscation, to achieve a lower overhead budget. Through the switching mechanism, the embedded watermark can be made detectable to legitimate end users off chip via test pin. The logic encryption-based method is set for accessing the watermark. Furthermore, an encrypted functionality is set as the signature generator module for generating owner’s signature. This provides hardware obfuscation and two-stage authentication mechanism for the generation of owner’s signature, and as a result of this, double-layer protection is achieved. Furthermore, a novel method to configure input key for signature generation module and to formulate owner’s signature is proposed. The viability of the present watermark technique for real-life application is checked on the ground of transparency, security, reliability, performance overhead, and robustness. Since the watermark in the proposed method is embedded outside the IP core, it does not cause any latency for the IP core functionality. Thus, even with significantly lower area overhead (∼<1.4%), the proposed method is able to provide higher robustness in terms of lower probability of coincidence (PC = 4.68 e − 97).

Hybrid Protection of Digital FIR Filters

A digital finite impulse response (FIR) filter is a ubiquitous block in digital signal processing applications and its behavior is determined by its coefficients. To protect filter coefficients from an adversary, efficient obfuscation techniques have been proposed, either by hiding them behind decoys or replacing them by key bits. In this article, we initially introduce a query attack that can discover the secret key of such obfuscated FIR filters, which could not be broken by the existing prominent attacks. Then, we propose a first of its kind hybrid technique, including both hardware obfuscation and logic locking using a point function for the protection of parallel direct and transposed forms of digital FIR filters. Experimental results show that the hybrid protection technique can lead to FIR filters with higher security while maintaining the hardware complexity competitive or superior to those locked by prominent logic locking methods. It is also shown that the protected multiplier blocks and FIR filters are resilient to existing attacks. The results on different forms and realizations of FIR filters show that the parallel direct form FIR filter has a promising potential for a secure design.

A New Optimal Method for the Secure Design of Combinational Circuits against Hardware Trojans Using Interference Logic Locking

Effective resistance to intellectual property theft, reverse engineering, and hardware Trojan insertion in integrated circuit supply chains is increasingly essential, for which many solutions have been proposed. Accordingly, strong attacks are also designed in this field. One way to achieve the above goal is obfuscation. The hardware obfuscation method hides the primary function of the circuit and the normal Netlist from the attacker by adding several key gates in the original Netlist. The functionality circuit is correct only if the correct key is applied; otherwise, the circuit is obfuscated. In recent years, various obfuscation methods have been proposed. One is logic locking, the most prominent hardware protection technique since it can protect against untrusted items. Logic locking induces functional and structural changes to a design even before the layout generation. We secured the circuit against hardware Trojan insertion with a secure logic locking method based on the insertion of key gates in interference mode. We call our proposed method Secure Interference Logic Locking, SILL. SILL is based on minimum controllability in paths with maximum fan-out. In this method, we have reduced the number of key gates required for circuit obfuscation and created the maximum Hamming distance between normal and obscure outputs. In addition, the key gates are added to the circuit’s complete interference, and the AES algorithm is used to generate the key. Our proposed method, SILL, was simulated in the Vivado simulation environment; the algorithms used in this method were prepared in VHDL language and designed to allow parallel execution, then applied on the original Netlist of the ISCAS85 benchmark circuits. By analyzing and comparing the results of this simulation to recent works, the amount of hardware consumption has decreased (about 5% space consumption and about a 0.15-nanosecond time delay). Then, the SAT attack algorithm was tested on ISCAS85 benchmark circuits that were obfuscated with SILL. The execution time of the attack in the second attempt was 0.24 nanoseconds longer compared to similar recent works, and it timed out in the fourth attempt. The resistance of our proposed method, having less hardware overhead and higher speed is more effective against SAT attacks than the existing conventional methods.

FPGA Design Deobfuscation by Iterative LUT Modification at Bitstream Level

Hardware obfuscation is a well-known countermeasure against reverse engineering. For FPGA designs, obfuscation can be implemented with a small overhead by using underutilised logic cells; however, its effectiveness depends on the stealthiness of the added redundancy. In this paper, we show that it is possible to deobfuscate an SRAM FPGA design by ensuring the full controllability of each instantiated look-up table input via iterative bitstream modification. The presented algorithm works directly on bitstream and does not require the possession of a flattened netlist. The feasibility of our approach is verified on the example of an obfuscated SNOW 3G design implemented on a Xilinx 7-series FPGA.

Titan: Security Analysis of Large-Scale Hardware Obfuscation Using Graph Neural Networks

Hardware obfuscation is a prominent design-for-trust solution that thwarts intellectual property (IP) piracy and reverse-engineering of integrated circuits (ICs). Researchers have proposed several large-scale obfuscation techniques that achieve high output corruption—thus offering resilience against seminal attacks along with acceptable power, performance, and area overheads. However, the research community has primarily evaluated hardware obfuscation on relatively small scales of obfuscation (i.e., a fixed number of obfuscated components). Moreover, prior art caters toward specific schemes based either on gate obfuscation or interconnect obfuscation, i.e., two prominent types of hardware obfuscation. The former shortcoming suggests focusing on large-scale obfuscation schemes, and the latter suggests the need for a holistic assessment framework. In this work, we propose Titan, a holistic framework considering large-scale gate and interconnect obfuscation schemes. More specifically, we propose a graph neural network (GNN)-based attack framework that is trained to exploit structural and functional properties of any secured circuit to recover its obfuscated components. We evaluate Titan on various obfuscation schemes, considering selected ITC-99 benchmarks with up to 50% obfuscation scale, i.e., up to 21,326 obfuscated components. We observe a substantial information leakage through structural and functional properties of secured designs even for large-scale obfuscation. We quantify the information leakage in two ways: first, an average reduction of Hamming distance (HD, a well-established metric for attack evaluation) by 23.27 and 16.19 percentage points over the baseline of random guessing for gate and interconnect obfuscation, respectively; second, an average recovery of 63.40% and 77.94% of obfuscated components for gate and interconnect obfuscation, respectively. Importantly, these results are superior to six state-of-the-art attacks. We will open-source our framework and associated artifacts to enable reproducibility and foster future work.

Hardware Obfuscation of AES IP Core Using PUFs and PRNG: A Secure Cryptographic Key Generation Solution for Internet-of-Things Applications

Hardware Obfuscation of AES IP Core Using PUFs and PRNG: A Secure Cryptographic Key Generation Solution for Internet-of-Things Applications

Hardware obfuscation of AES IP core using combinational hardware Trojan circuit for secure data transmission in IoT applications

SummaryIn semiconductor industry, reusability‐based System‐on‐Chip architecture using hardware intellectual property (IP) cores play a prominent role in Internet‐of‐Things (IoT) applications for secure data transmission. The advent of IoT makes it possible for physical things to transmit, process, compute, and receive data over internet. But, it also introduces in‐device communication security vulnerabilities. Advanced Encryption Standard (AES) IP has been used to address security vulnerabilities in IoT. It is an efficient and high‐performance crypto algorithm used in IoT devices for secure and fast data encryption. However, due to rise of many attacks, the security of AES IP is also under threat. Hardware obfuscation is one such prominent countermeasure that mitigates hardware attacks such as tampering, reverse engineering, and malicious alteration. This article presents secure AES IP mechanism using the potential technique of obfuscation inspired by the concept of combinational hardware Trojan. Experimental results show that the proposed technique is resilient against reverse‐engineering, malicious alteration, Boolean satisfiability attack, and key‐sensitizing attacks. The confusion and diffusion features of obfuscated AES IP are higher in terms of Hamming distance, avalanche effect, and balance rate. The proposed technique is implemented in Basys‐3 FPGAs within 5% of power and area overhead while maintaining high throughput.

Towards the enhancement of AES IP security using hardware obfuscation technique: A practical approach for secure data transmission in IoT

The global market of developing Internet of Things (IoT) devices increases rapidly with improved design goals like cost, energy efficiency, and performance. Unfortunately, the above design goals often come at the expense of security. Illegal access to the network, malicious device control, compromised sensitive information, and theft of personal data are main threats to these devices. As a result, the Advanced Encryption Standard (AES) is sometimes employed to ensure safe transmission and processing of data in IoT Systems. However, tampering, cloning, and reverse engineering are main concerns that impair the computational complexity of the 128-bit AES at the hardware level. Recently hardware obfuscation-based AES has emerged as a comprehensive hardware security approach for reducing threat impacts. The hardware obfuscation schemes efficiently introduce obfuscation keys for AES to conceal its functionality. The Xilinx Vivado 2016.2 software and BASYS-3 FPGA have been used to implement obfuscated AES approaches in this work. The proposed methods have low resource usage in terms of area and power overhead while providing a high level of security in terms of Hamming Distance of 50% and Avalanche Effect of 40% for each obfuscation method. We have also analyzed the probability of success for brute-force attacks for proposed methodologies.

Hardware Obfuscation for IP Protection of DSP Applications

Hardware Obfuscation for IP Protection of DSP Applications

A Novel Probability-Based Logic-Locking Technique: ProbLock

Integrated circuit (IC) piracy and overproduction are serious issues that threaten the security and integrity of a system. Logic locking is a type of hardware obfuscation technique where additional key gates are inserted into the circuit. Only the correct key can unlock the functionality of that circuit; otherwise, the system produces the wrong output. In an effort to hinder these threats on ICs, we have developed a probability-based logic-locking technique to protect the design of a circuit. Our proposed technique, called “ProbLock”, can be applied to both combinational and sequential circuits through a critical selection process. We used a filtering process to select the best location of key gates based on various constraints. Each step in the filtering process generates a subset of nodes for each constraint. We also analyzed the correlation between each constraint and adjusted the strength of the constraints before inserting key gates. We tested our algorithm on 40 benchmarks from the ISCAS ’85 and ISCAS ’89 suites. We evaluated ProbLock against a SAT attack and measured how long the attack took to successfully generate a key value. The SAT attack took longer for most benchmarks using ProbLock which proves viable security in hardware obfuscation.

LifeLine for FPGA Protection: Obfuscated Cryptography for Real-World Security

Over the last decade attacks have repetitively demonstrated that bitstream protection for SRAM-based FPGAs is a persistent problem without a satisfying solution in practice. Hence, real-world hardware designs are prone to intellectual property infringement and malicious manipulation as they are not adequately protected against reverse-engineering.In this work, we first review state-of-the-art solutions from industry and academia and demonstrate their ineffectiveness with respect to reverse-engineering and design manipulation. We then describe the design and implementation of novel hardware obfuscation primitives based on the intrinsic structure of FPGAs. Based on our primitives, we design and implement LifeLine, a hardware design protection mechanism for FPGAs using hardware/software co-obfuscated cryptography. We show that LifeLine offers effective protection for a real-world adversary model, requires minimal integration effort for hardware designers, and retrofits to already deployed (and so far vulnerable) systems.

LeGO: A Learning-Guided Obfuscation Framework for Hardware IP Protection

The security of hardware intellectual properties (IPs) has become a significant concern, as the opportunity for piracy, reverse engineering, and malicious modification is increasing. Hardware obfuscation has been studied as a potent method to protect against all these attack vectors. However, most of the existing obfuscation techniques have been successfully compromised, where many inherent functional or structural vulnerabilities in these techniques are utilized to reveal the obfuscation key or retrieve the original design. In this article, we introduce LeGO, a learning-guided obfuscation framework that overcomes known vulnerabilities in a scalable and systematic manner, leading to a robust and lightweight locking mechanism. The proposed framework is guided by our security evaluation process that performs a thorough assessment of an obfuscated IP against various attacks and identifies the vulnerabilities. It then judiciously selects and applies a set of design modification steps or rules that can eliminate these vulnerabilities. Such a rule-based obfuscation process has the distinctive capability to address all existing as well as emerging attacks through the learning of appropriate design transformation steps that prevent these attacks. We present an efficient strategy to apply these rules on a design, while resolving any conflict. Our evaluation of the LeGO framework on a set of ISCAS85 and open-source IP benchmarks has shown promising results in terms of robustness against diverse attacks with an average of area, power, and delay overhead of 39%, 45%, and 15%, respectively.

Satisfiability Attack-Resistant Camouflaged Two-Dimensional Heterostructure Devices.

Reverse engineering (RE) is one of the major security threats to the semiconductor industry due to the involvement of untrustworthy parties in an increasingly globalized chip manufacturing supply chain. RE efforts have already been successful in extracting device level functionalities from an integrated circuit (IC) with very limited resources. Camouflaging is an obfuscation method that can thwart such RE. Existing work on IC camouflaging primarily involves transformable interconnects and/or covert gates where variation in doping and dummy contacts hide the circuit structure or build cells that look alike but have different functionalities. Emerging solutions, such as polymorphic gates based on a giant spin Hall effect and Si nanowire field effect transistors (FETs), are also promising but add significant area overhead and are successfully decamouflaged by the satisfiability solver (SAT)-based RE techniques. Here, we harness the properties of two-dimensional (2D) transition-metal dichalcogenides (TMDs) including MoS2, MoSe2, MoTe2, WS2, and WSe2 and their optically transparent transition-metal oxides (TMOs) to demonstrate area efficient camouflaging solutions that are resilient to SAT attack and automatic test pattern generation attacks. We show that resistors with resistance values differing by 5 orders of magnitude, diodes with variable turn-on voltages and reverse saturation currents, and FETs with adjustable conduction type, threshold voltages, and switching characteristics can be optically camouflaged to look exactly similar by engineering TMO/TMD heterostructures, allowing hardware obfuscation of both digital and analog circuits. Since this 2D heterostructure devices family is intrinsically camouflaged, NAND/NOR/AND/OR gates in the circuit can be obfuscated with significantly less area overhead, allowing 100% logic obfuscation compared to only 5% for complementary metal oxide semiconductor (CMOS)-based camouflaging. Finally, we demonstrate that the largest benchmarking circuit from ISCAS'85, comprised of more than 4000 logic gates when obfuscated with the CMOS-based technique, is successfully decamouflaged by SAT attack in <40 min; whereas, it renders to be invulnerable even in more than 10 h when camouflaged with 2D heterostructure devices, thereby corroborating our hypothesis of high resilience against RE. Our approach of connecting material properties to innovative devices to secure circuits can be considered as a one of a kind demonstration, highlighting the benefits of cross-layer optimization.

Hardware Security Exploiting Post-CMOS Devices: Fundamental Device Characteristics, State-of-the-Art Countermeasures, Challenges and Roadmap

Emerging nanoelectronic semiconductor devices have been quite promising in enhancing hardware-oriented security and trust. However, implementing hardware security primitives and methodologies requires large area overhead and power consumption. Furthermore, emerging new attack models and vulnerabilities are regularly evolving and cannot be adequately addressed by current CMOS technology. This paper for the first time presents a comprehensive review of numerous post-CMOS technologies based hardware security primitives and methodologies, particularly true random number generators, physically unclonable functions, sidechannel analysis countermeasures, and hardware obfuscation techniques. Various beyond-CMOS device technologies including tunneling FET (TFET), hybrid phase transition FET (HyperFET), carbon nanotube FET (CNTFET), silicon nanowire FET (SiNWFET), symmetrical tunneling FET (SymFET), phase-change memory (PCM), spin-transfer torque magnetic tunnel junction (STT-MTJ), resistive random access memory (RRAM) have been considered in this study. First, the basic principle of operation and unusual characteristics of nanoelectronic devices used for hardware security applications have been extensively discussed. Later, CMOS technology challenges and benefits of emerging nanotechnologies for the design of hardware security primitives and methodologies have been reported. Finally, different analyses have been presented to demonstrate the promising performance of post-CMOS devices over the current CMOS technology in different countermeasures. Additionally, challenges, future directions, and plans have been presented to achieve more research outcomes in this field.

Doppelganger Obfuscation — Exploring theDefensive and Offensive Aspects of Hardware Camouflaging

Hardware obfuscation is widely used in practice to counteract reverse engineering. In recent years, low-level obfuscation via camouflaged gates has been increasingly discussed in the scientific community and industry. In contrast to classical high-level obfuscation, such gates result in recovery of an erroneous netlist. This technology has so far been regarded as a purely defensive tool. We show that low-level obfuscation is in fact a double-edged sword that can also enable stealthy malicious functionalities.In this work, we present Doppelganger, the first generic design-level obfuscation technique that is based on low-level camouflaging. Doppelganger obstructs central control modules of digital designs, e.g., Finite State Machines (FSMs) or bus controllers, resulting in two different design functionalities: an apparent one that is recovered during reverse engineering and the actual one that is executed during operation. Notably, both functionalities are under the designer’s control.In two case studies, we apply Doppelganger to a universal cryptographic coprocessor. First, we show the defensive capabilities by presenting the reverse engineer with a different mode of operation than the one that is actually executed. Then, for the first time, we demonstrate the considerable threat potential of low-level obfuscation. We show how an invisible, remotely exploitable key-leakage Trojan can be injected into the same cryptographic coprocessor just through obfuscation. In both applications of Doppelganger, the resulting design size is indistinguishable from that of an unobfuscated design, depending on the choice of encodings.

Graph Similarity and its Applications to Hardware Security

Hardware reverse engineering is a powerful and universal tool for both security engineers and adversaries. From a defensive perspective, it allows for detection of intellectual property infringements and hardware Trojans, while it simultaneously can be used for product piracy and malicious circuit manipulations. From a designer's perspective, it is crucial to have an estimate of the costs associated with reverse engineering, yet little is known about this, especially when dealing with obfuscated hardware. The contribution at hand provides new insights into this problem, based on algorithms with sound mathematical underpinnings. Our contributions are threefold: First, we present the graph similarity problem for automating hardware reverse engineering. To this end, we improve several state-of-the-art graph similarity heuristics with optimizations tailored to the hardware context. Second, we propose a novel algorithm based on multiresolutional spectral analysis of adjacency matrices. Third, in three extensively evaluated case studies, namely (1) gate-level netlist reverse engineering, (2) hardware Trojan detection, and (3) assessment of hardware obfuscation, we demonstrate the practical nature of graph similarity algorithms.

A Low Cost MST-FSM Obfuscation Method for Hardware IP Protection

Effective resistance to intellectual property (IP) piracy, overproduction and reverse engineering are becoming more and more necessary in the integrated circuit (IC) supply chain. To protect the hardware, the obfuscation methodology hides the original function by adding a large number of redundant states. However, existing hardware obfuscation approaches have hardware overhead and efficiency of obfuscation limitations. This paper proposed a novel methodology for IP security using the minimum spanning tree finite state machine (MST-FSM) obfuscation. In the minimum spanning tree (MST) algorithm, the Hamming distance defines the cost of obfuscated states. The Kruskal algorithm optimizes the connection relationship of obfuscated states by computing the Hamming distance of the MST-FSM. The proposed MST-FSM is automatically generated and embedded in the hardware IP with the self-building program. Finally, the MST-FSM is applied on the itc99 benchmark circuits and encryption standard IP cores. Compared with other state-of-the-arts, the obfuscation potency is improved by 3.57%, and the average hardware cost is decreased by about 6.01%.

Tunnel FET‐based ultralow‐power and hardware‐secure circuit design considering p‐i‐n forward leakage

SummaryTunnel field‐effect transistor (TFET) exhibits significant p‐i‐n forward leakage with the increase in drain‐to‐source voltage bias, and this adversely impacts the power consumption and reliability of TFET digital circuits. This work presents low‐power circuit techniques that result in novel compact gates and recommends tristate gates to mitigate the leakage effects. The proposed novel compact gates and tristate gates demonstrate two and six times lower power consumption compared with conventional TFET transmission gates with enhanced reliability. Further, this work introduces a new design methodology that leverages TFET p‐i‐n forward leakage for hardware obfuscation applications. Utilizing the proposed design methodology, the optimization of 40% and 80% in area and power consumption of hardware security primitives like true random number generators is also accomplished.