Logic locking protects integrated circuits (ICs) from design piracy. The idea is to insert key-controlled components, a.k.a. key-gates, to lock the IC’s functionality, where the correct key is the designer’s secret. The robustness of logic locking can be enhanced by carefully identifying best locations to insert key-gates, e.g., by analyzing the IC’s topology and lock parts with high impact on functional behaviour. Traditionally, the challenge of identifying critical locations relies on computationally-intensive graph traversal and design methods like fault analysis. The rise of large language models (LLMs), which have recently demonstrated proficiency also on complex graph data, presents an interesting opportunity to revisit this challenge. Here, we present GLLaMoR, a first-of-its-kind framework using LLMs on graph-based IC representations to identify critical locking locations. Through LLM performance evaluation and end-to-end case studies, we demonstrate that GLLaMoR paves the way for more effective and scalable logic locking.

The globalization of the integrated circuit (IC) manufacturing industry has lured the adversary to come up with numerous malicious activities in the IC supply chain. Logic locking has risen to prominence as a proactive defense strategy against such threats. CAS-Lock (proposed in CHES'20), is an advanced logic locking technique that harnesses the concept of single-point function in providing SAT-attack resiliency. It is claimed to be powerful and efficient enough in mitigating existing state-of-the-art attacks against logic locking techniques. Despite the security robustness of CAS-Lock as claimed by the authors, we expose a serious vulnerability and by exploiting the same we devise a novel attack algorithm against CAS-Lock. The proposed attack can not only reveal the correct key but also the exact AND/OR structure of the implemented CAS-Lock design along with all the key gates utilized in both the blocks of CAS-Lock. It simply relies on the externally observable Distinguishing Input Patterns (DIPs) pertaining to a carefully chosen key simulation of the locked design without the requirement of structural analysis of any kind of the locked netlist. Our attack is successful against various AND/OR cascaded-chain configurations of CAS-Lock and reports 100% success rate in recovering the correct key. It has an attack complexity of$\mathcal{O}(m)$, where$m$denotes the number of DIPs obtained for an incorrect key simulation.

The skyrocketing cost of integrated circuit (IC) manufacturing has forced the majority of enterprises to shift to fabless operation. IC design is often outsourced to foreign fabrication laboratories to reduce time and cost However, as a flip-side, it has introduced various hardware security concerns at different stages in the supply chain, namely, IP piracy, illegal overproduction, design counterfeiting, etc. Logic locking has risen to prominence as a proactive defense strategy against such threats. The basic idea of logic locking is to obscure the actual design to an adversary by integrating additional key-based logic into the original design. The authors in [1] have proposed an obfuscation scheme using a class of non-group additive cellular automata (CA) called $D1 * CA$ and $D1 * CA_{dual}$ to obfuscate each state-transition of an FSM. We propose a novel attack (named ORACALL) to extract the secret key used to obfuscate each FSM state-transition. We further propose a novel logic locking technique [2] which harnesses the security of block ciphers. It is found to be secure against known existing attacks.

In logic locking, the finite-state machine (FSM) embedded in a sequential circuit is often chosen to be obfuscated. Such an obfuscation scheme using a class of nongroup additive cellular automata (CA) called$D1 * CA$and$D1 * CA_{\mathrm{ dual}}$to obfuscate each state transition of an FSM has been proposed previously. Since$D1 * CA$and$D1 * CA_{\mathrm{ dual}}$provide high testability even in the absence of scan-based design-for-testability techniques, they conceal the sequential elements, thus thwarting several existing scan-chain attacks. In this article, we introduce a novel attack to extract the secret key used to obfuscate each state transition of the FSM, by utilizing the information leaked by the leftmost CA cell, which is obtained via an oracle query to the obfuscated circuit. The proposed attack has two variants: 1) when the combinational circuit of theInterrupt Logicis not logic encrypted and 2) when theInterrupt Logicis logic encrypted with a$k$-bit key. The first attack variant has a complexity of$\mathcal {O}(n \cdot m)$, where$n$denotes the number of transitions in the FSM, and$m$denotes the maximum transition cycle length of the underlying$D1 * CA$. The second attack variant has a complexity of$\mathcal {O}(n\cdot q_{\mathrm{ max}})$, where$q_{\mathrm{ max}}$denotes the maximum number of oracle queries (equal to the number of primary inputs involved in that state transition), followed by a SAT-attack to extract the$k$-bit key of the correspondingInterrupt Logic. The experimental evaluation of the attack on CA-based obfuscated benchmark circuits establishes the effectiveness of our proposed attack.

Block ciphers are widely regarded as concrete realizations of pseudorandom permutations with established security features. However, their applicability outside the domain of encryption has not been explored so far. In this paper, we open up, for the first time, an entirely novel application of them to logic hiding. We show that a combinational circuit can always be embedded within a block cipher having a bit-permutation based diffusion layer, preserving the cipher structure and security properties. The functionality of the embedded circuit becomes transparent only on the application of a secret key, whereas a wrong key will cause behaviour that is uncorrelated to that of the circuit. As an immediate application, we propose a combinational logic-locking scheme. The proposed locking scheme is also found to be robust against the state-of-the-art (SAT-assisted and other) attacks on logic locks.