Logic Locking Research Articles

Characterization of In-Cone Logic Locking Resiliency Against the SAT Attack

The resiliency of in-cone logic locking techniques to the satisfiability (SAT) attack is characterized in this paper. An analysis of the parameters of the SAT solver that impact security and a characterization of the effect netlist topology has on the security of the circuit is presented. The analysis of SAT solver parameters and logic structure is used to develop three novel logic locking gate selection algorithms based on maximum fanout free cones (MFFCs) and gate controllability for circuits implementing XOR, look-up table (LUT), and $2\times 1$ MUX-based logic obfuscation. The XOR, LUT, and MUX MFFC-based algorithms resulted in an average increase of, respectively, 61.8%, 123.6%, and 38.5% in the minimum number of iterations required to complete the SAT attack across 1,000 different variable orderings of the netlist while applying the locking techniques to 5% of the gates within the netlist. In addition, the SAT attack resiliency and output corruption of the developed algorithms are compared with out-of-cone locking techniques.

Logic Locking: A Survey of Proposed Methods and Evaluation Metrics

The outsourcing business model is dominating the semiconductor industry. Due to this loss of control over the design flow, several threats have become a major source of concern, including overproduction and IP overuse. For over a decade, several solutions have been proposed in the literature to counteract such threats. These solutions consist in hiding the behavior of the IPs/ICs until the design house securely unlocks them. This way, only unlocked IPs/ICs can be used properly while locked ones produce erroneous data. In this paper, we survey logic locking approaches and discuss locking quality in hiding expected behavior and in resisting to attacks.

Logic Locking With Provable Security Against Power Analysis Attacks

Outsourcing of integrated circuit (IC) fabrication to external foundries has lead to many new security vulnerabilities, including IC piracy, overbuilding, and reverse engineering. In this regard, logic locking (LL) was introduced to protect intellectual property from such threats. In this paper, we evaluate the strength of various LL techniques, including earlier works, such as random LL (RLL) and fault analysis-based LL (FLL), against power-based side-channel attack. We have developed attacks where at least 60% of the key bits can be successfully recovered for 60% of the circuits for both RLL and FLL using a 32-bit key. However, the success rate reduces to 45% and 35% for RLL and FLL, respectively, when using a 64-bit key. We demonstrate the practicality of our proposed attack by mounting it against RLL and FLL implementations of ISCAS’85 and MCNC benchmark circuits on Spartan-6 FPGA platform. Further, we present differential power analysis (DPA) results on mutual information analysis on LL techniques that capture any dependence between the intermediate data and the captured power traces. We also formally establish that resilience to satisfiability-based (SAT) attack implies resilience to DPA attack as well for an LL technique. We validate this further via experiments on Spartan-6 FPGA on SAKURA-G development board for a recent LL technique that is known to thwart the SAT attack.

Anti-SAT: Mitigating SAT Attack on Logic Locking

Logic locking is a technique that is proposed to protect outsourced IC designs from piracy and counterfeiting by untrusted foundries. A locked IC preserves the correct functionality only when a correct key is provided. Recently, the security of logic locking is threatened by a new attack called SAT attack, which can decipher the correct key of most logic locking techniques within a few hours even for a reasonably large key-size. This attack iteratively solves SAT formulas which progressively eliminate the incorrect keys till the circuit is unlocked. In this paper, we present a circuit block (referred to as Anti-SAT block) to enhance the security of existing logic locking techniques against the SAT attack. We show using a mathematical proof that the number of SAT attack iterations to reveal the correct key in a circuit comprising an Anti-SAT block is an exponential function of the key-size thereby making the SAT attack computationally infeasible. Besides, we address the vulnerability of the Anti-SAT block to various removal attacks and investigate obfuscation techniques to prevent these removal attacks. More importantly, we provide a proof showing that these obfuscation techniques for making Anti-SAT un-removable would not weaken the Anti-SAT block’s resistance to SAT attack. Through our experiments, we illustrate the effectiveness of our approach to securing modern chips fabricated in untrusted foundries.

On the Approximation Resiliency of Logic Locking and IC Camouflaging Schemes

The SAT-based attacks are extremely successful in deobfuscating the traditional combinational logic locking and IC camouflaging schemes. While several SAT-resilient protection schemes that increase the minimum query count of the attack have been proposed recently, none of them satisfy the output corruptibility (error) criteria. Therefore, most of them were combined with high corruptibility schemes to achieve both corruptibility and high query count. These “compound” schemes are successful since existing SAT attacks are agnostic to the corruptibility of the protection scheme. In this paper, we propose an approximate SAT-based attack framework which focuses on the iterative convergence of an attack toward a better solution. This helps our attack reduce a compound scheme to a standalone SAT-resilient scheme. In addition, we relate the problem of minimum query count to a well-known graph problem, and we propose a novel technique to increase the corruptibility of SAT-resilient protection schemes in a controllable manner. This creates protection schemes that have both high query count and corruptibility. Furthermore, due to the approximation resiliency property of these schemes, approximate attacks provide no advantage over exact attacks when attacking them.

Logic Locking Using Hybrid CMOS and Emerging SiNW FETs

The outsourcing of integrated circuit (IC) fabrication services to overseas manufacturing foundry has raised security and privacy concerns with regard to intellectual property (IP) protection as well as the integrity maintenance of the fabricated chips. One way to protect ICs from malicious attacks is to encrypt and obfuscate the IP design by incorporating additional key gates, namely logic encryption or logic locking. The state-of-the-art logic encryption techniques certainly incur considerable performance overhead upon the genuine IP design. The focus of this paper is to leverage the unique property of emerging transistor technology on reducing the performance overhead as well as preserving the robustness of logic locking technique. We design the polymorphic logic gate using silicon nanowire field effect transistors (SiNW FETs) to replace the conventional Exclusive-OR (XOR)-based logic cone. We then evaluate the proposed technique based on security metric and performance overhead.

On Improving the Security of Logic Locking

Due to globalization of integrated circuit (IC) design flow, rogue elements in the supply chain can pirate ICs, overbuild ICs, and insert hardware Trojans. EPIC locks the design by randomly inserting additional gates; only a correct key makes the design to produce correct outputs. We demonstrate that an attacker can decipher the locked netlist, in a time linear to the number of keys, by sensitizing the key-bits to the output. We then develop techniques to fix this vulnerability and make an attacker’s effort truly exponential in the number of inserted keys. We introduce a new security metric and a method to deliver strong logic locking.

Erratum to: Speeding Up Logic Locking via Fault Emulation and Dynamic Multiple Fault Injection

Erratum to: Speeding Up Logic Locking via Fault Emulation and Dynamic Multiple Fault Injection

Speeding Up Logic Locking via Fault Emulation and Dynamic Multiple Fault Injection

Today's Integrated Circuit (IC) industry is suffering from piracy, overbuild ICs, and hardware Trojans. One way to protect ICs is logic locking. Logic locking is done by inserting extra logic to the original design's netlist such that correct outputs are produced only when the correct key is applied. However, the determination of locations to insert logic is a computationally expensive process. In this paper, we propose a fault emulation technique to speed up the process of determination of fault locations. Our fault emulation technique enables dynamic multiple fault injection as well as real-time fault impact computation in a single FPGA configuration. The effectiveness of the proposed emulation technique is evaluated with ISCAS'89 sequential benchmark circuits and results are presented.