The security of hardware intellectual properties (IPs) has become a significant concern, as the opportunity for piracy, reverse engineering, and malicious modification is increasing. Hardware obfuscation has been studied as a potent method to protect against all these attack vectors. However, most of the existing obfuscation techniques have been successfully compromised, where many inherent functional or structural vulnerabilities in these techniques are utilized to reveal the obfuscation key or retrieve the original design. In this article, we introduce LeGO, a learning-guided obfuscation framework that overcomes known vulnerabilities in a scalable and systematic manner, leading to a robust and lightweight locking mechanism. The proposed framework is guided by our security evaluation process that performs a thorough assessment of an obfuscated IP against various attacks and identifies the vulnerabilities. It then judiciously selects and applies a set of design modification steps or rules that can eliminate these vulnerabilities. Such a rule-based obfuscation process has the distinctive capability to address all existing as well as emerging attacks through the learning of appropriate design transformation steps that prevent these attacks. We present an efficient strategy to apply these rules on a design, while resolving any conflict. Our evaluation of the LeGO framework on a set of ISCAS85 and open-source IP benchmarks has shown promising results in terms of robustness against diverse attacks with an average of area, power, and delay overhead of 39%, 45%, and 15%, respectively.

Intellectual property (IP) protection against piracy and reverse engineering (RE) has emerged as a critical area of research in the field of hardware security. Logic locking has been studied as a promising technique to provide robust protection against these attacks. However, a vast body of recent works has presented successful attacks to break existing locking methods in terms of retrieving the secret key and restoring the original functionality. In this paper, we propose SARO, a scalable attack-resistant logic locking that provides a robust functional and structural design transformation process. SARO treats the target circuit as a hypergraph (G), and performs partitioning of G to produce a set of sub-graphs, then applies an efficient Truth Table Transformation (T3) process to each partition. Further, to mitigate specific attacks (such as SAT-based analysis), SARO implements distributed attack resistance, which integrates random SAT-hard functions (obtained from an automatic function generator, RanSAT) into select partitions. RanSAT produces non-biased and non-deterministic design transformations, where added locking mechanisms are not distinguishable from the original circuit. Finally, it implements a concept of a derived key generation that simultaneously helps to minimize the required key size through judicious reuse of key bits, as well as enhancing the structural alterations. Unlike state-of-the-art logic locking solutions, which focus on primarily enhancing robustness against functional query-based attacks, the proposed transformation steps provide the following unique benefits: (1) high scalability to large designs obtained through partitioning; (2) high structural obfuscation leading to resistance to structural attacks; and (3) low key size, while maintaining strong resistance against functional attacks. To quantitatively represent the level of structural and functional transformation, we also propose the T3metric. We evaluate SARO on ISCAS85 and EPFL benchmarks, and provide comprehensive security and performance analysis of our proposed framework.

Obfuscation or Logic locking (LL) is a technique for protecting hardware intellectual property (IP) blocks against diverse threats, including IP theft, reverse engineering, and malicious modifications. State-of-the-art locking techniques primarily focus on securing a design from unauthorized usage by disabling correct functionality – they often do not directly address hiding design intent through structural transformations. They rely on the synthesis tool to introduce structural changes. We observe that this process is insufficient as the resulting changes in circuit topology are: (1) local and (2) predictable. In this paper, we analyze the structural transformations introduced by LL and introduce a potential attack, called SAIL, that can exploit structural artifacts introduced by LL. SAIL uses machine learning (ML) guided structural recovery that exposes a critical vulnerability in these techniques. Through this attack, we demonstrate that the gate-level structure of a locked design can be retrieved in most parts through a systematic set of steps. The proposed attack is applicable to most forms of logic locking, and significantly more powerful than existing attacks, e.g., SAT-based attacks, since it does not require the availability of golden functional responses (e.g., an unlocked IC). Evaluation on benchmark circuits shows that we can recover an average of about 92%, up to 97%, transformations (Top-10 R-Metric) introduced by logic locking. We show that this attack is scalable, flexible, and versatile. Additionally, to evaluate the SAIL attack resilience of a locked design, we present the SIVA-Metric that is fast in terms of computation speed and does not require any training. We also propose possible mitigation steps for incorporating SAIL resilience into a locked design.

Hardware intellectual property (IP) piracy and misuse have introduced new challenges in the semiconductor industry as untrusted parties in the IP's life cycle may clone, reverse-engineer, or extract important design secrets from an IP. A promising solution to protect a hardware IP against such attacks is to perform logic locking, where additional logic controlled by a secret key is inserted in strategic locations of an IP to lock the functionality when the correct key is not available. As a multitude of logic locking techniques has emerged in the past decade, the research community has also developed strong attacks against them to expose various vulnerabilities that can be exploited by an adversary to break the protection. While state-of-the-art logic locking solutions have demonstrated provable robustness against known attacks, there is a critical need to explore new attack vectors and mitigate them to achieve a higher level of protection. In this article, we present SCOPE, a novel synthesis-based constant propagation attack for security evaluation of logic locking techniques. SCOPE is oracle-less and requires no knowledge about the locking algorithm or the locked design by an attacker. The introduced attack performs a synthesis-based analysis on each individual key-input port and looks for meaningful design features that may help derive the correct key value. SCOPE offers two attack modes with varying complexity and effectiveness, a linear regression test, and an unsupervised machine-learning analysis. We perform SCOPE to a number of existing locking techniques and demonstrate that the average attack accuracy is 84.13% with high scalability in terms of design size. Based on the vulnerabilities identified by SCOPE, we provide a low-overhead countermeasure that can help mitigate such constant propagation attacks.

Ahstract-Various attacks on hardware intellectual properties (IPs) have been successful in obtaining design information that can be used to reverse engineer a system, create counterfeits, or insert hardware Trojans. Key-based hardware obfuscation is an attractive solution that helps prevent such attacks. In this paper, for the first time, we propose a key error tolerant obfuscation approach that achieves graceful degradation in output Quality of Service (QoS) as the bit error rate (BER) in obfuscation key increases. The approach, which we refer to it as, “Quality Obfuscation”, is applicable to a large variety of IPs, including digital signal processing (DSP) and approximating computing IPs, which are resilient to output QoS degradation. We present a complete obfuscation framework that can be adapted to any error tolerance rate. To demonstrate its robustness, we obfuscate several common DSP IP blocks and observe the performance under various percentages of bit-flips in the key. We show that our approach provides controllability of system quality, as well as the strong protection at low overhead, e.g., average 15% area and 5.9% power overhead to tolerate 10% BER.