This paper introduces KRATT, a removal and structural analysis attack against state-of-the-art logic locking techniques, such as single and double flip locking techniques (SFLTs and DFLTs). KRATT utilizes powerful quantified Boolean formulas (QBFs), which have not found widespread use in hardware security, to find the secret key of SFLTs for the first time. It can handle locked circuits under both oracle-less (OL) and oracle-guided (OG) threat models. It modifies the locked circuit and uses a prominent OL attack to make a strong guess under the OL threat model. It uses a structural analysis technique to identify promising protected input patterns and explores them using the oracle under the OG model. Experimental results on ISCAS'85, ITC'99, and HeLLO: CTF'22 benchmarks show that KRATT can break SFLTs using a QBF formulation in less than a minute, can decipher a large number of key inputs of SFLTs and DFLTs with high accuracy under the OL threat model, and can easily find the secret key of DFLTs under the OG threat model. It is shown that KRATT outperforms publicly available OL and OG attacks in terms of solution quality and run-time.

Logic locking acts as powerful countermeasure against piracy and reverse engineering attacks on the Integrated circuit (IC) supply chain. Stripped functionality logic locking (SFLL) represents the state-of-the-art in logic locking. SFLL delivers high resilience against certain attacks; however, it can protect only a small fraction of the design. Moreover, it fails to achieve a high corruption rate at the circuit outputs. In this paper, we explore strategies for deploying SFLL in a way that optimizes both corruption rate and resilience while protecting a large fraction of the design. The proposed joint optimization framework leverages the principles of VLSI testing to meet desired objectives cost-effectively.

The fabless business model has given rise to many security threats, including piracy of intellectual property (IP), overproduction, counterfeiting, reverse engineering (RE), and hardware Trojans (HT). Such threats severely undermine the benefits of the fabless model. Among the countermeasures developed to thwart piracy and RE attacks, logic locking has emerged as a promising and versatile solution that is being adopted by both academia and industry. The idea behind logic locking is to lock the design using a “keying” mechanism; only the rightful owner has control over the locked design. Therefore, the design remains nonfunctional without the knowledge of the key. In this article, we survey the evolution of logic locking over the last decade. We introduce various “cat-and-mouse” games involved in logic locking along with its novel applications-including, processor pipelines, graphics processing units (GPUs), and analog circuits. We aim this article to be a primer for researchers interested in developing new logic-locking techniques and employing logic locking in different application domains.

Outsourcing of integrated circuit (IC) fabrication to external foundries has lead to many new security vulnerabilities, including IC piracy, overbuilding, and reverse engineering. In this regard, logic locking (LL) was introduced to protect intellectual property from such threats. In this paper, we evaluate the strength of various LL techniques, including earlier works, such as random LL (RLL) and fault analysis-based LL (FLL), against power-based side-channel attack. We have developed attacks where at least 60% of the key bits can be successfully recovered for 60% of the circuits for both RLL and FLL using a 32-bit key. However, the success rate reduces to 45% and 35% for RLL and FLL, respectively, when using a 64-bit key. We demonstrate the practicality of our proposed attack by mounting it against RLL and FLL implementations of ISCAS'85 and MCNC benchmark circuits on Spartan-6 FPGA platform. Further, we present differential power analysis (DPA) results on mutual information analysis on LL techniques that capture any dependence between the intermediate data and the captured power traces. We also formally establish that resilience to satisfiability-based (SAT) attack implies resilience to DPA attack as well for an LL technique. We validate this further via experiments on Spartan-6 FPGA on SAKURA-G development board for a recent LL technique that is known to thwart the SAT attack.

While financially advantageous, outsourcing key steps such as testing to potentially untrusted Outsourced Semiconductor Assembly and Test (OSAT) companies may pose a risk of compromising on-chip assets. Obfuscation of scan chains is a technique that hides the actual scan data from the untrusted testers; logic inserted between the scan cells, driven by a secret key, hide the transformation functions between the scan-in stimulus (scan-out response) and the delivered scan pattern (captured response). In this paper, we propose ScanSAT: an attack that transforms a scan obfuscated circuit to its logic-locked version and applies a variant of the Boolean satisfiability (SAT) based attack, thereby extracting the secret key. Our empirical results demonstrate that ScanSAT can easily break naive scan obfuscation techniques using only three or fewer attack iterations even for large key sizes and in the presence of scan compression.

In this paper, we propose a hardware security methodology for mixed-signal Integrated Circuits (ICs). The proposed methodology can be used as a countermeasure for IC piracy, including counterfeiting and reverse engineering. It relies on logic locking of the digital section of the mixed-signal IC, such that unless the correct key is provided, the mixed-signal performance will be pushed outside of the acceptable specification range. We employ a state-of-the-art logic locking technique, called Stripped Functionality Logic Locking (SFLL). We show that strong security levels are achieved in both mixed-signal and digital domains. In addition, the proposed methodology presents several appealing properties. It is non-intrusive for the analog section, it incurs reasonable area and power overhead, it can be fully automated, and it is virtually applicable to a wide range of mixed-signal ICs. We demonstrate it on a ΣΔ Analog-to-Digital Converter (ADC).

Analogous to CMOS circuits, we can expect attacks such as integrated circuit (IC) counterfeiting, piracy through reverse engineering (RE) or over-production, and insertion of hardware Trojans to be launched on emerging class of reversible circuits, which is a promising alternative to standard CMOS technology. In this paper, we explore the possibility of securing reversible circuits against IP piracy and RE attacks using state-of-the-art logic locking techniques. Our security analysis reveals that applying existing techniques as is on reversible circuits creates new vulnerabilities due to inherent reversible properties. We propose low overhead (around 0.013x for gate count, 0.0004x for T-count and 0.02x for quantum cost on average) defense strategies that overcome these vulnerabilities and protect the circuits from all known attacks.

Logic locking has emerged as a promising countermeasure against piracy and reverse engineering attacks on integrated circuits. The state-of-the-art logic locking techniques, more specifically stripped-functionality logic locking (SFLL), offer provable security guarantees against many attacks. However, these techniques focus on protecting individual modules or even parts of a module, failing to deliver system-wide security. This paper sheds light on integrating logic locking with high-level synthesis (HLS) in an attempt to deliver system-wide security. We demonstrate the integration of SFLL with LegUp HLS tool for an image processing application.

Logic locking is a solution that mitigates hardware security threats, such as Trojan insertion, piracy and counterfeiting. Research in this area has led to, in an iterative fashion, a series of logic locking defenses as well as attacks that circumvent these defenses by extracting the logic locking key. The most powerful attacks rely on a full access to a working chip/oracle that can be used to produce the input-output pairs utilized in recovering the secret key. A recently proposed technique Stripped Functionality Logic Locking (SFLL) provides resilience to all known attacks on combinational logic locking. In this paper, we propose a functional reverse engineering attack on SFLL: an attack that can detect the protection logic of SFLL which results in obtaining the original unlocked design with a high success rate. The restore and perturb blocks utilized by SFLL were detected with average coverage percentages of 93.95% and 85.42% respectively, proving that our attack is capable of breaking the state of the art logic locking technique.

The continuing decrease in feature size of integrated circuits, and the increase of the complexity and cost of design and fabrication has led to outsourcing the design and fabrication of integrated circuits to third parties across the globe, and in turn has introduced several security vulnerabilities. The adversaries in the supply chain can pirate integrated circuits, overproduce these circuits, perform reverse engineering, and/or insert hardware Trojans in these circuits. Developing countermeasures against such security threats is highly crucial. Accordingly, this paper first develops a learning-based trust verification framework to detect hardware Trojans. To tackle Trojan insertion, IP piracy and overproduction, logic locking schemes and in particular stripped functionality logic locking is discussed and its resiliency against the state-of-the-art attacks is investigated.

Logic locking is a promising countermeasure against intellectual property (IP) piracy, counterfeiting, hardware Trojans, reverse engineering, and overbuilding attacks. Yet, various attacks that use a working chip as an oracle have been launched on logic locking, undermining the defense of all existing locking techniques. This paper advances the state-of-the-art in logic locking by developing new countermeasures as well as attacks. We present two logic locking techniques, SARLock and SFLL, that provide quantitative security guarantees against the SAT, removal, and approximate attacks. We validate the effectiveness of proposed techniques by taping-out two silicon chips. We also study the interplay between logic locking and VLSI test, highlighting the security vulnerabilities associated with the test of locked chips. We develop three removal attacks to evaluate the security of existing logic locking techniques.

The globalization of IC supply chain lead to the emergence of hardware security threats such as IP piracy, reverse engineering, overbuilding, and hardware Trojans. Among the techniques developed to mitigate these threats, logic locking offers the most versatile protection and is being actively researched. The most recent locking technique SFLL thwarts with provable and quantifiable security all the state-of-the-art attacks including SAT, AppSAT, and the removal attack. However, the implementation cost of SFLL can sometimes be prohibitive, as it lacks an automated framework that explores cost-effective implementation options. In this paper, we show how VLSI testing principles and tools can be adopted to automate critical steps in SFLL and minimize its cost. We propose “SFLL-fault” that utilizes fault injection driven synthesis to efficiently explore design options and ATPG to assess security levels. Our experimental results confirm the efficacy of our strategy; SFLL-fault can reduce the implementation cost by 35% compared to SFLL without compromising security.

Logic encryption protects integrated circuits (ICs) against intellectual property (IP) piracy and overbuilding attacks by encrypting the IC with a key. A Boolean satisfiability (SAT) based attack breaks all existing logic encryption technique within few hours. Recently, a defense mechanism known as Anti-SAT was presented that protects against SAT attack, by rendering the SAT-attack effort exponential in terms of the number of key gates. In this paper, we highlight the vulnerabilities of Anti-SAT and propose signal probability skew (SPS) attack against Anti-SAT block. SPS attack leverages the structural traces in Anti-SAT block to identify and isolate Anti-SAT block. The attack is 100% successful on all variants of Anti-SAT block. SPS attack is scalable to large circuits, as it breaks circuits with up to 22K gates within two minutes.

Logic locking has been conceived as a promising proactive defense strategy against intellectual property (IP) piracy, counterfeiting, hardware Trojans, reverse engineering, and overbuilding attacks. Yet, various attacks that use a working chip as an oracle have been launched on logic locking to successfully retrieve its secret key, undermining the defense of all existing locking techniques. In this paper, we propose stripped-functionality logic locking (SFLL), which strips some of the functionality of the design and hides it in the form of a secret key(s), thereby rendering on-chip implementation functionally different from the original one. When loaded onto an on-chip memory, the secret keys restore the original functionality of the design. Through security-aware synthesis that creates a controllable mismatch between the reverse-engineered netlist and original design, SFLL provides a quantifiable and provable resilience trade-off between all known and anticipated attacks. We demonstrate the application of SFLL to large designs (>100K gates) using a computer-aided design (CAD) framework that ensures attaining the desired security level at minimal implementation cost, 8%, 5%, and 0.5% for area, power, and delay, respectively. In addition to theoretical proofs and simulation confirmation of SFLL's security, we also report results from the silicon implementation of SFLL on an ARM Cortex-M0 microprocessor in 65nm technology.

Logic locking is an intellectual property (IP) protection technique that prevents IP piracy, reverse engineering and overbuilding attacks by the untrusted foundry or end-users. Existing logic locking techniques are all based on locking the functionality; the design/chip is nonfunctional unless the secret key has been loaded. Existing techniques are vulnerable to various attacks, such as sensitization, key-pruning, and signal skew analysis enabled removal attacks. In this paper, we propose a tenacious and traceless logic locking technique, TTlock, that locks functionality and provably withstands all known attacks, such as SAT-based, sensitization, removal, etc. TTLock protects a secret input pattern; the output of a logic cone is flipped for that pattern, where this flip is restored only when the correct key is applied. Experimental results confirm our theoretical expectations that the computational complexity of attacks launched on TTLock grows exponentially with increasing key-size, while the area, power, and delay overhead increases only linearly. In this paper, we also coin ``parametric locking," where the design/chip behaves as per its specifications (performance, power, reliability, etc.) only with the secret key in place, and an incorrect key downgrades its parametric characteristics. We discuss objectives and challenges in parametric locking.

The globalization of integrated circuit (IC) supply chain and the emergence of threats, such as intellectual property (IP) piracy, reverse engineering, and hardware Trojans, have forced semiconductor companies to revisit the trust in the supply chain. Logic locking is emerging as a popular and effective countermeasure against these threats. Over the years, multiple logic techniques have been developed. Moreover, a number of attacks have been proposed that expose the security vulnerabilities of these techniques. This paper highlights the key developments in the logic locking research and presents a comprehensive literature review of logic locking.

Test of integrated circuits (ICs) is essential to ensure their quality; the test is meant to prevent defective and out-of-spec ICs from entering into the supply chain. The test is conducted by comparing the observed IC output with the expected test responses for a set of test patterns; the test patterns are generated using automatic test pattern generation algorithms. Existing test-pattern generation algorithms aim to achieve higher fault coverage at lower test costs. In an attempt to reduce the size of test data, these algorithms reveal the maximum information about the internal circuit structure. This is realized through sensitizing the internal nets to the outputs as much as possible, unintentionally leaking the secrets embedded in the circuit as well. In this paper, we present HackTest, an attack that extracts secret information generated in the test data, even if the test data do not explicitly contain the secret. HackTest can break the existing intellectual property protection techniques, such as camouflaging, within 2 min for our benchmarks using only the camouflaged layout and the test data. HackTest applies to all existing camouflaged gate-selection techniques and is successful even in the presence of the state-of-the-art test infrastructure, i.e., test data compression circuits. Our attack necessitates that the IC test data generation algorithms can be reinforced with security.

Integrated circuit (IC) camouflaging is a layout-level technique that thwarts reverse engineering attacks on ICs by introducing camouflaged cells that look alike, but can implement one of many possible Boolean functions. Existing camouflaging techniques have been broken by a recent decamouflaging attack, which uses Boolean satisfiability (SAT) techniques to compute specialized discriminating input patterns that prune the functionality search space quickly. This paper presents CamoPerturb, a countermeasure to thwart the decamouflaging attack by integrating logic perturbation with IC camouflaging. CamoPerturb, contrary to all the existing camouflaging schemes, perturbs the functionality of the given design minimally, i.e., adds/removes one minterm, rather than camouflaging the design. A separate camouflaged block CamoFix restores the perturbed minterm, recovering the functionality of the design. The perturbed minterm is the designer's secret and is incorporated into CamoFix using camouflaged cells. CamoPerturb renders the decamouflaging attack effort exponentially harder in the number of camouflaged gates while its overhead grows linearly. The paper presents formal proofs for the security of CamoPerturb along with experimental results.

Due to globalization of integrated circuit (IC) design flow, rogue elements in the supply chain can pirate ICs, overbuild ICs, and insert hardware Trojans. EPIC locks the design by randomly inserting additional gates; only a correct key makes the design to produce correct outputs. We demonstrate that an attacker can decipher the locked netlist, in a time linear to the number of keys, by sensitizing the key-bits to the output. We then develop techniques to fix this vulnerability and make an attacker's effort truly exponential in the number of inserted keys. We introduce a new security metric and a method to deliver strong logic locking.

Per-core power proxies for multi-core processors are known to use several dozens of hardware activity monitors to achieve a 2% accuracy on core power estimation. These activity monitors are typically not accessible to the user, and even if they were accessible, there would be a significant overhead in using them at the kernel or OS level for power monitoring or control. Furthermore, when scaled up to hundreds of cores per chip, such power proxies become a computational bottleneck for power management operations such as chip power capping. In this paper, we show that a 4% accuracy or better for per-core power estimation can be achieved using an ultra compact power proxy based on a hybrid set of only four user-accessible parameters, namely core frequency, core temperature, instruction-per-cycle and active-state residency. Our proxy is nonlinear, valid across all P and C states, and is based on a randomized power data collection strategy that aims at exercising all the P and C levels of each core. We illustrate the accuracy of the model using the full suite of the SPEC CPU 2006 benchmarks on a 12-core processor.

Java Digital Signal Processing (J-DSP) is a Java-based object-oriented programming environment that was developed at Arizona State University (ASU) for use in undergraduate- and graduate-level engineering classes. J-DSP is written as a platform-independent Java applet that resides on the Web and is thereby accessible by all students using a Web browser. We describe an innovative software extension to J-DSP, called 2D J-DSP, to accommodate on-line laboratories for two-dimensional digital signal processing. Two-dimensional DSP capabilities in J-DSP include: 2D signal generation; 2D FIR filter design and implementation; 2D transforms. Image processing capabilities include image restoration and enhancement. In order to illustrate 2D concepts graphically, contour (2D) and perspective (3D) plots have been incorporated in 2D J-DSP. Online laboratory exercises have been developed in the aforementioned areas for use in the graduate-level multidimensional signal processing and image processing courses at ASU, and are posted on the Website (http://jdsp.asu.edu). Statistical and qualitative evaluations that assess the learning experiences of the students that use 2D J-DSP are also presented.