The modern supply chain ecosystem exposes hardware intellectual property (IP) blocks to diverse confidentiality attacks aimed at reverse engineering (RE), piracy, or the extraction of design secrets. An emerging and potent design solution for IP protection against these attacks, particularly against RE, is the fine-grained redaction of security-critical logic and replacing the redacted logic with lookup tables (LUTs). The LUTs are then programmed in-field, similar to FPGAs, using protected bitstreams, thereby preventing untrusted foundries or test/assembly facilities from mounting RE attacks. The LUT-based redaction paradigm incurs a substantial hardware cost, with area overhead ranging from 70x to 100x and delay overhead from 2x to 5x, while also often necessitating significant alterations to the commercial tool flow for design, verification, and testing. In this work, we propose PROM, a robust fine-grain redaction technique inspired by structured ASIC, that aims to address the limitations of LUT-based redaction with novel overhead optimizations. The redacted security-critical logic is implemented using a library of custom-design PROM cells that are optimized to minimize overheads compared to state-of-the-art redaction techniques while providing strong protection against various RE attacks. We evaluated the proposed redaction technique across a range of open-source benchmarks, achieving robust security with average overheads of 1.42x in area and 1.09x in delay, demonstrating its efficiency and practicality.

Hardware fuzzing is critical for uncovering vulnerabilities in modern integrated circuits by systematically exploring input spaces. A major challenge lies in generating high-quality seeds that maximize coverage and verification efficiency. While Coverage-Guided Fuzzing (CGF) enhances overall exploration, it lacks precision when targeting specific submodules. DirectFuzz addresses this with directed test generation but suffers from key limitations, including limited HDL support, abstraction mismatches, and poor scalability for large target regions. In this work, to overcome these challenges, we propose PROFUZZ, a Directed Graybox Fuzzing (DGF) framework that integrates Automatic Test Pattern Generation (ATPG) for precise and scalable seed generation. By leveraging ATPG’s structural analysis capabilities, PROFUZZ improves coverage effectiveness and supports large-scale hardware designs. Experimental results show that PROFUZZ outperforms DirectFuzz with 30× greater scalability in terms of handling target sites, 11.66% higher coverage, and 2.76× faster execution, demonstrating its potential to advance the state-of-the-art in directed hardware fuzzing.

The growing complexity of modern system-on-chip (SoC) designs, coupled with the integration of untrusted thirdparty Intellectual Property (IP) blocks, presents significant challenges for security verification to ensure the trust and integrity of the fabricated silicon. Traditional verification methods, such as functional simulation and Formal Property Verification (FPV), suffer from limited scalability, substantial manual effort, and often incomplete coverage. To address these issues, we propose an automated formal verification framework FV-PAL that can vastly enhance security verification at both module and submodule levels. Our approach introduces judicious design partitioning to identify submodules using structural analysis and enables targeted verification of gate-level netlists, reducing computational overhead. Leveraging Large Language Models (LLMs) and retrieval-augmented generation (RAG), the framework automatically generates non-vacuous security properties translated into SystemVerilog Assertions (SVAs) using design specifications and related documentation. FV-PAL can be integrated with the commercial EDA toolflow to perform FPV and generate coverage metrics with iterative refinement via a feedback loop if coverage falls below specified threshold. FV-PAL demonstrates significant improvements in verification efficiency and coverage based on our evaluation on open-source benchmarks, offering a scalable and efficient formal verification approach for hardware designs.

Scan-Based Design-For-Testability (DFT) measures are prevalent in modern digital integrated circuits to achieve high test quality at low hardware cost. With the advent of 3D heterogeneous integration and chiplet-based systems, the role of scan is becoming ever more important due to its ability to make internal design nodes controllable and observable in a systematic and scalable manner. However, the effectiveness of scan-based DFT suffers from poor testability of internal nodes for complex circuits at deep logic levels. Existing solutions to address this problem primarily rely on Test Point Insertion (TPI) in the nodes with poor controllability or observability. However, TPI-based solutions, while an integral part of commercial practice, come at a high design and hardware cost. To address this issue, in this paper, we present LITE, a novel ATPG-aware scan instrumentation approach that utilizes the functional flip-flops in a scan chain to make multiple internal nodes observable and controllable in a low-cost, scalable manner. We provide both circuit-level design as well as an algorithmic approach for automating the insertion of LITEfor design modifications. We show that LITEsignificantly improves the testability in terms of the number of patterns and test coverage for ATPG and random pattern testability, respectively, while incurring considerably lower overhead than TPI-based solutions.

Logic Equivalence Checking (LEC) is a widely used formal verification method that ensures design accuracy by comparing implemented schematics with the respective Register Transfer Level (RTL) specifications to confirm functional equivalence. Traditional LEC approaches based on SAT-based verification often do not account for complexities introduced by resynthesis, technology transition, and port name changes, leading to verification failures or poor results. Additionally, IP protection techniques, including state space transformation and fine-grained redaction, further complicate traditional LEC analysis by altering the design and obscuring functional relationships, often leading to verification failures. This paper presents a novel framework, CLIP, Cut Point Matching-based Logic Equivalence Checking, that addresses these limitations of conventional LEC techniques and offers scalable and robust verification with higher accuracy and reliability leveraging on structural analysis. Experimental results show that CLIP can effectively handle both combinational and sequential designs, including support for transformed designs for which traditional LEC analysis fails, and significantly improves both verification efforts and accuracy for diverse open-source designs.

Modern computing systems rely on System-on-Chips (SoCs) to integrate multiple Intellectual Property (IP) cores developed in-house or acquired from third-party vendors with varying trust levels. Commercial Off-The-Shelf (COTS) components, such as microcontrollers and FPGAs, offer ready-made solutions but introduce security risks, especially in an untrusted supply chain. Effective verification of both IP cores and COTS components is essential for ensuring functionality, security, and reliability. Traditional IP verification techniques are often complex and error-prone due to over-reliance on manual efforts, while COTS verification poses significant challenges due to their inherent black-box nature and diverse integrity issues. The emergence of Large Language Models (LLMs) significantly enhances hardware verification by automating tasks such as code generation and bug fixing. In this paper, we present a review of LLM-based IP verification methods and discuss challenges in current verification practices. Next, we propose an LLM-driven workflow that generates test programs for COTS verification and demonstrate its effectiveness through experimental analysis on open-source COTS processors.

Due to the globalization of the semiconductor supply chain and the adoption of the zero trust model, hardware Trojan attacks pose significant security threats introduced by untrusted entities. Hardware Trojans relate to malicious modification of a design before fabrication, resulting in unintended functional or side-channel behavior, such as causing a Denial of Service (DoS) attack or leaking sensitive information. Detecting hardware Trojans in fabricated silicon chips is extremely challenging primarily due to the vast possible attack space. Directed test generation towards activation (i.e., trigger) and/or manifestation (e.g., observation of payload) of the viable Trojans with conventional post-manufacturing Automatic Test Pattern Generation (ATPG) process is known to be practically infeasible. Hence, researchers have explored statistical test techniques for detecting arbitrary instances of Trojan attacks through post-silicon functional testing. However, existing statistical test solutions lack in effective trigger and payload coverage and suffer from scalability issues. In this paper, we propose LATENT, a scalable payload-aware statistical test pattern generation technique for high-coverage Trojan detection leveraging the power of existing functional ATPG solutions. Our experimental study on large population of randomly inserted Trojans in a suite of open-source designs shows promising results in both trigger and Trojan coverage.

Securing intellectual property (IP) in hardware has become increasingly crucial amid increasing threats from adversaries due to untrusted entities in the integrated circuit (IC) supply chain. Hardware obfuscation techniques like logic locking and state-space transformation have emerged as potent countermeasures against such threats, but doubts about their efficacy persist due to compromises in recent years. Furthermore, existing countermeasures also tend to address specific adversarial threat models. This paper introduces LISA, a multi-layered framework that uses iterative unit transformations to address security concerns in hardware obfuscation at minimal overhead costs. The proposed framework employs a security-metric-guided analysis of obfuscated IPs, subjecting them to various attacks to uncover vulnerabilities. Once identified, LISA implements unit transformations that harden the obfuscation against these vulnerabilities. Compared to prior work, the layered iterative framework employed can thwart current and emerging threats by acquiring novel adaptive design transformations to minimize overhead incurred at each iteration. The proposed methodology is implemented using commercial EDA tools and evaluated on open-source ISCAS85 and MIT-CEP benchmarks, demonstrating promising attack resilience with low overheads.

The increasing prominence of Large Language Models (LLMs) is being acknowledged for their exceptional abilities in comprehending natural language, conducting advanced reasoning, and generating contextual responses. LLMs expedite code generation, verification, and bug-fixing tasks across software and hardware domains. Development of hardware designs typically involves translating natural language specifications into Hardware Description Languages (HDLs) like Verilog or SystemVerilog, followed by circuit synthesis, physical layout, and fabrication, with the potential for human errors in the process. In the current industry practice, HDL verification tasks typically rely on manual expertise from security professionals to detect and address vulnerabilities. Modern System-on-Chip (SoC) designs integrate several Intellectual Property (IP) blocks implemented using HDL and communicate through a common bus to perform intended functions. Ensuring security throughout the SoC design process requires innovative solutions due to the complex nature of SoC designs and the distribution of assets across multiple IP blocks. Popular conversation LLMs such as Open AI’s ChatGPT and Google’s GEMINI (formerly BARD) offer the potential to automate HDL code generation and verification tasks by interpreting user prompts represented in natural language descriptions, thereby minimizing manual effort and enhancing hardware design quality. This paper explores recent research works on HDL generation, verification, and bug fix leveraging LLMs while addressing prevailing challenges and presenting potential opportunities for improvement.

Counterfeiting, overproduction, and cloning of integrated circuits (ICs) and associated hardware have emerged as major security concerns in the modern globalized microelectronics supply chain. One way to combat these issues effectively is to deploy hardware authentication techniques that utilize physical unclonable functions (PUFs). PUFs utilize intrinsic variations in hardware that occur during the manufacturing and fabrication process to generate device-specific fingerprints or immutable signatures that cannot be replicated by counterfeits and clones. However, unavoidable factors like environmental noise and harmonics can significantly deteriorate the quality of the PUF signature. Besides, conventional PUF solutions are generally not amenable to in-field authentication of hardware, which has emerged as a critical need for Internet of Things (IoT) edge devices to detect physical attacks on them. In this article, we introduce frequency-domain PUF or FDPUF, a novel PUF that analyzes time-domain current waveforms in the frequency domain to create high-quality authentication signatures that are suitable for in-field authentication. FDPUF decomposes electrical signals into their spectral coefficients, filters out unnecessary low-energy components, reconstructs the waveforms, and generates high-quality digital fingerprints for device authentication purposes. Compared to the existing authentication mechanisms, the higher quality of the signatures through the frequency-domain analysis makes the proposed FDPUF more suitable for protecting the integrity of the edge computing hardware. We perform experimental measurements on FPGA and analyze FDPUF properties using the National Institute of Standards and Technology test suite to demonstrate that the FDPUF provides better uniqueness and robustness than its time-domain counterpart while being attractive for in-field authentication.

Automated test-pattern generation (ATPG) is an important step of testing flows that is responsible for generating test values that expose faults in post-fabrication hardware. Previous work has introduced numerous ATPG methods that analyze application functionality to minimize the number of required tests. However, this existing work is misaligned with the emerging trend to use reconfigurable hardware, such as eFPGAs, to redact security-critical IP. When using reconfigurable hardware, application functionality is only known after serially loading a bitstream into a set of configuration flip-flops, which requires ATPG to do more general tests of the reconfigurable hardware as opposed to the targeted application. This more general testing results in prohibitively slow testing times that are on average 14.6× longer than the original design. In this paper, we explore novel ATPG and test methods for reconfigurable hardware to maximize stuck-at fault coverage, while minimizing testing time. We show significantly improved testing times that are on average 1.9× slower than the unredacted designs, without requiring any knowledge of the original application.