The multinational, distributed, and multistep nature of integrated circuit (IC) production supply chain has introduced hardware-based vulnerabilities. Existing literature in hardware security assumes ad hoc threat models, defenses, and metrics for evaluation, making it difficult to analyze and compare alternate solutions. This paper systematizes the current knowledge in this emerging field, including a classification of threat models, state-of-the-art defenses, and evaluation metrics for important hardware-based attacks.

A Primer on Hardware Security: Models, Methods, and Metrics

Camouflaging is a layout-level technique that hampers an attacker from reverse engineering by introducing, in one embodiment, dummy contacts into the layout. By using a mix of real and dummy contacts, one can camouflage a standard cell whose functionality can be one of many. If an attacker cannot resolve the functionality of a camouflaged gate, he/she will extract an incorrect netlist. In this paper, we analyze the feasibility of identifying the functionality of camouflaged gates. We also propose techniques to make the dummy contact-based IC camouflaging technique resilient to reverse engineering. Furthermore, we judiciously select gates to camouflage by using techniques which ensure that the outputs of the extracted netlist are controllably corrupted. The techniques leverage IC testing principles such as justification and sensitization. The proposed techniques are evaluated using ISCAS benchmark circuits and OpenSparc T1 microprocessor controllers.

Security analysis of integrated circuit camouflaging

Logic locking has been conceived as a promising proactive defense strategy against intellectual property (IP) piracy, counterfeiting, hardware Trojans, reverse engineering, and overbuilding attacks. Yet, various attacks that use a working chip as an oracle have been launched on logic locking to successfully retrieve its secret key, undermining the defense of all existing locking techniques. In this paper, we propose stripped-functionality logic locking (SFLL), which strips some of the functionality of the design and hides it in the form of a secret key(s), thereby rendering on-chip implementation functionally different from the original one. When loaded onto an on-chip memory, the secret keys restore the original functionality of the design. Through security-aware synthesis that creates a controllable mismatch between the reverse-engineered netlist and original design, SFLL provides a quantifiable and provable resilience trade-off between all known and anticipated attacks. We demonstrate the application of SFLL to large designs (>100K gates) using a computer-aided design (CAD) framework that ensures attaining the desired security level at minimal implementation cost, 8%, 5%, and 0.5% for area, power, and delay, respectively. In addition to theoretical proofs and simulation confirmation of SFLL's security, we also report results from the silicon implementation of SFLL on an ARM Cortex-M0 microprocessor in 65nm technology.

https://dl.acm.org/doi/pdf/10.1145/3133956.3133985

Provably-Secure Logic Locking: From Theory To Practice

With the adoption of a globalized and distributed IC design flow, IP piracy, reverse engineering, and counterfeiting threats are becoming more prevalent. Logic obfuscation techniques including logic locking and IC camouflaging have been developed to address these emergent challenges. A major challenge for logic locking and camouflaging techniques is to resist Boolean satisfiability (SAT) based attacks that can circumvent state-of-the-art solutions within minutes. Over the past year, multiple SAT attack resilient solutions such as Anti-SAT and AND-tree insertion (ATI) have been presented. In this paper, we perform a security analysis of these countermeasures and show that they leave structural traces behind in their attempts to thwart the SAT attack. We present three attacks, namely “signal probability skew” (SPS) attack, “AppSAT guided removal (AGR) attack, and “sensitization guided SAT” (SGS) attack”, that can break Anti-SAT and ATI, within minutes.

Removal Attacks on Logic Locking and Camouflaging Techniques

A number of studies of hardware security aim to thwart piracy, overbuilding, and reverse engineering (RE) by obfuscating and/or camouflaging. However, these techniques incur high overheads, and integrated circuit (IC) camouflaging cannot provide any protection for the gate-level netlist of the third party intellectual property (IP) core or the single large monolithic IC. In order to circumvent these weaknesses, this brief elaborately analyzes these hardware security techniques and proposes a practical logic obfuscation method with low overheads to prevent an adversary from RE both the gate-level netlist and the layout-level geometry of IP/IC and protect IP/IC from piracy and overbuilding. Experimental evaluations demonstrate the low area, power, and zero performance overhead of the proposed obfuscation technique.

A Practical Logic Obfuscation Technique for Hardware Security

A logical building block and method of using the building block to design a logic cell library for CMOS (Complementary Metal Oxide Silicon) ASICs (Application Specific Integrated Circuits) is disclosed. Different logic gates, built with the same building block as described in this invention, will have the same schematics of transistor connection and also the same physical layout so that they appear to be physically identical under optical or electron microscopy. An ASIC designed from a library of such logic cells is strongly resistant to a reverse engineering attempt.

Building block for a secure CMOS logic cell library

A method and apparatus for camouflaging an application specific integrated circuit (ASIC), wherein the ASIC comprises a plurality of interconnected functional logic is disclosed. The method adds functionally inert elements to the logical description or provides alternative definitions of standard logical cells to make it difficult for reverse engineering programs to be used to discover the circuit's function. Additionally, post processing may be performed on GDS layers to provide a realistic fill of the empty space so as to resemble structural elements found in a functional circuit.

Method and apparatus for camouflaging a standard cell based integrated circuit with micro circuits and post processing

An application specific integrated circuit (ASIC) and a method for its design and fabrication is disclosed. In one embodiment, the camouflaged application specific integrated circuit (ASIC), comprises a plurality of interconnected functional logic cells that together perform one or more ASIC logical functions, wherein the functional logic cells comprise a camouflage cell including: a source region of a first conductivity type, a drain region of the first conductivity type, and a camouflage region of a second conductivity type disposed between the source region and the drain region. The camouflage region renders the camouflage cell always off in a first camouflage cell configuration and always on in a second camouflage cell configuration having a planar layout substantially indistinguishable from the first configuration.

Physically unclonable camouflage structure and methods for fabricating same

A technique for and structures for camouflaging an integrated circuit structure and strengthen its resistance to reverse engineering. A plurality of transistors are formed in a semiconductor substrate, at least some of the transistors being of the type having sidewall spacers with LDD regions formed under the sidewall spacers. Transistors are programmably interconnected with ambiguous interconnection features, the ambiguous interconnection features each comprising a channel formed in the semiconductor substrate with preferably the same dopant density as the LDD regions, with selected ones of the channels being formed of a conductivity type supporting electrical communication between interconnected active regions and with other selected ones of the channels being formed of a conductivity type inhibiting electrical communication but ambiguously appearing to a reverse engineer as supporting electrical communication.

Programmable connection and isolation of active regions in an integrated circuit using ambiguous features to confuse a reverse engineer

The camouflage technique described herein introduces programmed configuration inputs to Micro Netlists, creating Programmable Micro Netlists (PMNLs). PMNLs are a group of camouflaged and non-camouflaged cells that may be configured to perform one of several possible logic functions. They retain all the protective properties of non-programmable MNLs, but also allow for secure post-manufacture configuration of their aggregate logic function.

Lap Wai Chow

Papers

Building block for a secure CMOS logic cell library

Method and apparatus for camouflaging a standard cell based integrated circuit with micro circuits and post processing

Physically unclonable camouflage structure and methods for fabricating same

Programmable connection and isolation of active regions in an integrated circuit using ambiguous features to confuse a reverse engineer

Secure logic locking and configuration with camouflaged programmable micro netlists