In the context of hardware trust and assurance, reverse engineering has been often considered as an illegal action. Generally speaking, reverse engineering aims to retrieve information from a product, i.e., integrated circuits (ICs) and printed circuit boards (PCBs) in hardware security-related scenarios, in the hope of understanding the functionality of the device and determining its constituent components. Hence, it can raise serious issues concerning Intellectual Property (IP) infringement, the (in)effectiveness of security-related measures, and even new opportunities for injecting hardware Trojans. Ironically, reverse engineering can enable IP owners to verify and validate the design. Nevertheless, this cannot be achieved without overcoming numerous obstacles that limit successful outcomes of the reverse engineering process. This article surveys these challenges from two complementary perspectives: image processing and machine learning. These two fields of study form a firm basis for the enhancement of efficiency and accuracy of reverse engineering processes for both PCBs and ICs. In summary, therefore, this article presents a roadmap indicating clearly the actions to be taken to fulfill hardware trust and assurance objectives.

Optical probing, though developed as silicon debugging tools from the chip backside, has shown its capability of extracting secret data, such as cryptographic keys and user identifications, from modern system-on-chip devices. Existing optical probing countermeasures are based on detecting any device modification attempt or abrupt change in operating conditions during asset extraction. These countermeasures usually require additional fabrication steps and cause area and power overheads. In this article, we propose a novel low-overhead design methodology to prevent optical probing. It leverages additional operational logic gates, termed as “CONCEALING-Gates,” inserted as neighbor gates of the logic gates connected to the nets carrying asset signals. The switching activity of the asset carrying logic is camouflaged with the switching activity of the concealing-gate. The input signal and placement in the layout of the concealing-gates must be selected in such a way that they remain equally effective in preventing different variants of optical probing, i.e., electro-optical frequency mapping and Electro-optical probing. The methodology is suitable for the existing ASIC/FPGA design flow and fabrication process, since designing new standard logic cells is not required. We have performed a comprehensive security evaluation of the concealing-gates using a security metric developed based on the parameters that are crucial for optical probing. The attack resiliency of the logic cells, protected by concealing-gates, is evaluated using an empirical study-based simulation methodology and experimental validation. Our analysis has shown that in the presence of concealing-gates, logic cells achieve high resiliency against optical contactless probing techniques.

The backside of modern Integrated Circuits (ICs) is becoming an open backdoor for malicious hardware attackers to take advantage of. Aided by new Failure Analysis (FA) optical techniques, e.g., Photon Emission Analysis (PEA), optical probing, and Laser Fault Injection (LFI), hackers pose a serious threat to the confidentiality, integrity and availability of sensitive information on a chip. In addition, optical backside attacks can risk semiconductor intellectual property (IP) protection mechanisms, such as logic locking. In this work, we review some of these failure analysis techniques through the lens of Optical Attack. We also review combinational and sequential Logic Locking, and then focus on corresponding state space obfuscation methodology. Attack procedures are then described on how to break into these obfuscation systems, and finally, existing countermeasures and their limitations are discussed.

The outsourcing of the design and manufacturing of integrated circuits (IC) involves various untrusted entities, which can pose many security threats such as overproduction of ICs, sale of out-of-specification/rejected ICs, and piracy of Intellectual Properties (IPs). As a result, various design-for-trust techniques have been developed. Logic locking has recently gained significant interest from the research community due to its capability to provide defense against the threats from untrusted manufacturing. In logic locking, the original circuit is locked using a secret key to make it into a key-dependent circuit. However, various attacks on the extraction of secret keys associated with locking have undermined the security of logic locking techniques. Even after a decade of research, the security of logic locking is still under risk as none of the countermeasures can simultaneously provide resiliency against different attacks, such as tampering, probing, and oracle or oracle-less attacks. This paper presents an overview of novel attacks on logic locking apart from SAT-based analysis. We will present three different techniques to break a secure lock, and they are hardware Trojan based attacks, optical probing based attacks, and the ATPG oriented attacks.

Over the past two decades, globalized outsourcing in the semiconductor supply chain has lowered manufacturing costs and shortened the time-to-market for original equipment manufacturers (OEMs). However, such outsourcing has rendered the printed circuit boards (PCBs) vulnerable to malicious activities and alterations on a global scale. In this article, we take an in-depth look into one such attack, called the “Big Hack,” that was recently reported by Bloomberg Buisnessweek. The article provides background on the Big Hack from three perspectives: an attacker, a security investigator, and the societal impacts. This study provides details on vulnerabilities in the modern PCB supply chain, the possible attacks, and the existing and emerging countermeasures. The necessity for novel visual inspection techniques for PCB assurance is emphasized throughout the article. Further, a review of various imaging modalities, image analysis algorithms, and open research challenges are provided for automated visual inspection.

Modern integrated circuits (ICs) possess several countermeasures to safeguard sensitive data and information stored in the device. In recent years, semi-invasive physical attacks based on optical debugging techniques have proven to be capable of easily bypassing these security measures implemented in the chip. Optical attacks can reveal the data stored in memory, cache and register through various methods such as photon emission analysis, laser fault injection, laser voltage probing, and thermal laser stimulation. The above-mentioned methods, which employ laser scanning microscopy and photon emission microscopy, are effective because the silicon substrate is transparent to near-infrared (NIR) photons. Therefore, the most vulnerable part of an IC to optical attacks is the backside, where the chip's transistors can be accessed and probed with a NIR laser beam. Although different optical attack detection and avoidance mechanisms have been proposed, many can be circumvented and none are universal solutions for all types of optical attacks. In this study, we present a taxonomy of the different types of optical attacks and the security threats posed by each type. Then we discuss the existing prevention-detection based solutions to optical probing attacks which will set the future research direction.