Due to the inclination towards a fab-less model of integrated circuit (IC) manufacturing, several untrusted entities get white-box access to the proprietary intellectual property (IP) blocks from diverse vendors. To this end, the untrusted entities pose security-breach threats in the form of piracy, cloning, and reverse-engineering, sometimes threatening national security. Hardware obfuscation is a prominent countermeasure against such issues. Obfuscation allows for preventing the usage of the IP blocks without authorization from the IP owners. Due to finite state machine (FSM) transformation-based hardware obfuscation, the design’s FSM gets transformed to make it difficult for an attacker to reverse-engineer the design. A secret key needs to be applied to make the FSM functional, thus preventing the usage of the IP for unintended purposes. Although several hardware obfuscation techniques have been proposed, due to the inability to analyze the techniques from the attackers’ standpoint, numerous vulnerabilities inherent to the obfuscation methods go undetected unless a true adversary discovers them. In this article, we present a collaborative approach between two entities—one acting as an attacker or red team and another as a defender or blue team , the first systematic approach to replicate the real attacker-defender scenario in the hardware security domain, which in return strengthens the FSM transformation-based obfuscation technique. The blue team transforms the underlying FSM of a gate-level netlist using state space obfuscation. The red team plays the role of an adversary or evaluator and tries to unlock the design by extracting the unlocking key or recovering the obfuscation circuitries. As the key outcome of this red team–blue team effort, a robust state space obfuscation methodology is evolved showing security promises.

Hardware obfuscation is a design transformation technique that transforms a design to protect its confidentiality against untrusted parties. In particular, it aims at protecting proprietary hardware intellectual property (IP) blocks against reverse engineering (RE), piracy, and extraction of design secrets. A wide array of existing works on hardware obfuscation have demonstrated its security promises and theoretical robustness against diverse attacks. However, these techniques lack in: 1) scalability to large commercial-scale designs; 2) ease of integration with existing electronic design automation (EDA) tool flow; 3) ability to protect against emergent attack modes, such as structural analysis-based attacks; and 4) ability to efficiently trade off security with design overhead. The latter requires an effective metric to quantify robustness against RE attacks. In this article, we introduce a practical state-space obfuscation algorithm and associated automation tool,ProtectIP, that address the above shortcomings. The algorithmic steps have polynomial complexity and are scalable for large designs. We have developed a complete EDA tool flow that integratesProtectIP. We show that exponential resistance can be achieved against all known RE attacks while incurring modest area overhead (24% on average) with negligible impact (maximum 5% overhead) on critical-path delay. We quantify the level of achieved security using metrics and show that an intelligent attacker with partial knowledge of the obfuscation process has a minimal success rate (a probability of 0.33) in RE attacks.

Hardware intellectual property (IP) piracy and misuse have introduced new challenges in the semiconductor industry as untrusted parties in the IP's life cycle may clone, reverse-engineer, or extract important design secrets from an IP. A promising solution to protect a hardware IP against such attacks is to perform logic locking, where additional logic controlled by a secret key is inserted in strategic locations of an IP to lock the functionality when the correct key is not available. As a multitude of logic locking techniques has emerged in the past decade, the research community has also developed strong attacks against them to expose various vulnerabilities that can be exploited by an adversary to break the protection. While state-of-the-art logic locking solutions have demonstrated provable robustness against known attacks, there is a critical need to explore new attack vectors and mitigate them to achieve a higher level of protection. In this article, we present SCOPE, a novel synthesis-based constant propagation attack for security evaluation of logic locking techniques. SCOPE is oracle-less and requires no knowledge about the locking algorithm or the locked design by an attacker. The introduced attack performs a synthesis-based analysis on each individual key-input port and looks for meaningful design features that may help derive the correct key value. SCOPE offers two attack modes with varying complexity and effectiveness, a linear regression test, and an unsupervised machine-learning analysis. We perform SCOPE to a number of existing locking techniques and demonstrate that the average attack accuracy is 84.13% with high scalability in terms of design size. Based on the vulnerabilities identified by SCOPE, we provide a low-overhead countermeasure that can help mitigate such constant propagation attacks.