Modern system-on-chip (SoC) designs are becoming prone to numerous security threats due to their critical applications and ever-growing complexity and size. Therefore, the early stage of the design flow requires comprehensive security verification. The control flow of an SoC, generally implemented using finite state machines (FSMs), is not an exception to this requirement. Any deviations from the desired flow of FSMs can cause serious security issues. On the other hand, the control FSMs may be prone to fault-injection and denial-of-service (DoS) attacks or have inherent information leakage and access control issues at the gate-level netlist abstraction. Therefore, defining a set of security rules (guidelines) for obtaining FSM implementations free from particular security vulnerabilities after performing logic synthesis is crucial. Unfortunately, as of today, no solution exists in the state-of-the-art domain to verify the security of control FSMs. In this paper, we propose a set of such security rules for control FSM design and a verification framework called ARC-FSM-G to check for those security rule violations at pre-silicon to prevent any security vulnerabilities of FSM against fault-injection, access control, and information leakage threats. Experimental results on several benchmarks varying in size and complexity illustrate that ARC-FSM-G can effectively check for violations of all the proposed rules within a few seconds.

The ever-increasing propensity for intellectual property (IP) reuse has reduced the design productivity gap in the supply chain. As a consequence, protecting IPs has become more difficult since IP vendors now make their IPs more flexible so that they can be reused in other designs for greater profits. This has made IP piracy and infringement easier than ever. IP watermarking can detect IP piracy and infringement and it has been an active research topic for the past decade. Various watermarking techniques have been discussed in the literature that embed circuitry into IP to provide proof of ownership. But, in most RT-level watermarking methods, the watermarking circuit is separate from IP functionality and can be easily identified and tampered with. In this paper, we propose CAPEC, a Cellular Automata (CA) guided watermarking technique that embeds watermarking circuits into the don’t care states of the FSM. The watermarking function is a set of configurable CA rules tightly coupled with the functional states of the FSM. CAPEC generates a signature in a challenge-response-based protocol, is resistant to identification, tampering, and removal attacks, and has minimal overhead. We also analyze and evaluate the efficiency of the technique and its resilience to different attacks for varying challenge size and CA rules. After watermarking different benchmarks, the watermark overhead was found to be negligible and formal verification proved no changes to the functional circuit.

Numerous security vulnerability assessment techniques urge precise and fast finite state machines (FSMs) extraction from the design under evaluation. Sequential logic locking, watermark insertion, fault-injection assessment of a system-on-a-chip (SoC) control flow, information leakage assessment, and reverse engineering at gate-level abstraction, to name a few, require precise FSM extraction from the synthesized netlist of the design. Unfortunately, no reliable solutions are currently available for fast and accurate extraction of FSMs from the highly unstructured gate-level netlist for effective security evaluation. The major challenge in developing such a solution is the precise recognition of FSM state flip-flops (FFs) in a netlist having a massive collection of FFs. In this article, we propose finite state machine extractor ultra (FSMx-Ultra), a framework for extracting FSMs from extremely unstructured gate-level netlists. FSMx-Ultra utilizes state-of-the-art graph theory concepts and algorithms to distinguish FSM state registers from other registers and then constructs gate-level state transition graphs (STGs) for each identified FSM state register using automatic test pattern generation (ATPG) techniques. The results of our experiments on 14 open-source benchmark designs illustrate that FSMx-Ultra can recover all FSMs quickly and precisely from synthesized gate-level netlists of diverse complexity and size utilizing various state encoding schemes.

At the early stage of the design process, many security vulnerability assessment solutions require fast and precise extraction of the finite state machines (FSMs) present in the register-transfer level (RTL) description of the design. FSMs should be accurately extracted for watermark insertion, fault injection assessment of control paths in a system-on-chip (SoC), information leakage assessment, control-flow reverse engineering in RTL abstraction, logic obfuscation, etc. However, it is quite unfortunate that, as of today, existing state-of-the-art synthesis tools cannot provide accurate and reliable extraction of all FSMs from the provided high-level RTL code. Precise identification of all FSM state registers and the pure combinational state transition logic described in the RTL code with numerous registers and other combinational logic makes it quite challenging to develop such a solution. In this paper, we propose a framework named RTL-FSMx to extract FSMs from high-level RTL codes written in Verilog HDL. RTL-FSMx utilizes node-based analysis on the abstract syntax tree (AST) representation of the RTL code to isolate FSM state registers from other registers. RTL-FSMx automatically extracts state transition graphs (STGs) for each of the detected FSM state registers and additional information of the extracted FSMs. Experimental results on a large number of benchmark circuits demonstrate that RTL-FSMx accurately recovers all control FSMs from RTL codes with various complexity and size within just a few seconds.

A number of security vulnerability assessments require accurate and fast extraction of the finite state machines (FSMs) in the circuit. FSM should be accurately extracted for watermark insertion, FSM-based logic locking, fault injection assessment of control paths in a system-on-chip (SoC), information leakage assessment, and reverse engineering at gate-level. Unfortunately, as of today, there are no good solutions available that can provide very fast and accurate extraction of FSMs from the flattened netlist to perform effective security assessment. The difficulty of developing such a solution lies in precisely identifying FSM state flip-flops present in a netlist that contains numerous circuit flip-flops. In this paper, we propose to develop a framework called FSMx to extract FSMs from highly unstructured synthesized designs. FSMx utilizes graph theory to identify FSM state registers from other registers. FSMx automatically extracts gate-level state transition graphs (STGs) for each of the detected FSM state registers. Experimental results demonstrate that FSMx efficiently recovers FSMs from synthesized netlists with various complexity and size in less than 7 minutes in the worst case of NIST AES 128-bit design with 12,976 gates on a personal desktop.