Integrated Circuit (IC) Decamouflaging: Reverse Engineering Camouflaged ICs within Minutes

Abstract

Circuit camouflaging is a recently proposed defense mechanism to protect digital integrated circuits (ICs) from reverse engineering attacks by using camouflaged gates, i.e., logic gates whose functionality cannot be precisely determined by the attacker. Recent work appears to establish that an attacker requires time that is exponential in the number of camouflaged gates to reverse engineer a circuit, if the gates that are camouflaged are chosen using a procedure proposed in that work. Consequently, it appears to be the case that even by camouflaging a relatively small number of gates in the circuit, the attacker is forced to undertake several thousands of years of work. In this paper, we refute such claims. With an underlying complexity-theoretic mindset, we show that the same benchmark circuits with the camouflaged gates chosen the same way as prior work, we can decamouflage the circuit in minutes, and not years. As part of constructing our attack, we provide a precise characterization of two problems that the attacker seeks to solve to carry out his attack, and their computational complexity. A composition of solvers for the two problems is our attack procedure. We show that the two problems are co-NP-complete and NP-complete respectively, and our reduction to boolean satisfiability (SAT) and the use of off-the-shelf SAT solvers results in a highly effective attack. We also propose a new notion that we call a discriminating set of input patterns, that soundly captures the attacker's difficulty. Our extensive empirical studies reveal that the discriminating sets of inputs for realistic circuits are surprising small, thereby providing an explanation for the effectiveness of our attack. We provide additional insights by comparing the procedure of choosing gates to be camouflaged proposed in prior work to simply choosing them randomly. After presenting the results from our attack, we provide insights into the fundamental effectiveness of IC camouflaging. Our work serves as a strong caution to designers of ICs that seek security through IC camouflaging. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Physical Design Obfuscation of Hardware: A Comprehensive Investigation of Device and Logic-Level Techniques

“…SAT solving is used both for synthesizing new inputs that should be applied to the oracle, and is also used for deobfuscating the design once a sufficient set of input-output examples is obtained. For more details on this approach, we point interested readers to the work El Massad et al [62]; their work shows that the logic function of a circuit with 200 obfuscated gates, each capable of implementing NAND/NOR/XOR (3 200 possible logic functions), can be identified in less than an hour after observing just tens of input/output vectors [62]. Later work extends El Massad's attack using incremental SAT solvers for more efficient implementation [63].…”

Fundamental Challenges Toward Making the IoT a Reachable Reality

“…Obfuscation and camouflaging are two effective techniques to thwart reverse-engineering security threats. More specifically, obfuscation inserts additional gates, states, or transitions into the hardware to hide the original functionality and implementation of the design Frey and Yu 2015;Zhang 2015], whereas camouflaging is a layout information hiding technique that prevents the extraction of netlists from the layout by inserting additional cells in empty spaces or making layouts of different gates look identical [Cocchi et al 2014;El Massad et al 2015;Karri et al 2015]. The overhead associated with obfuscation and camouflaging needs to be carefully analyzed so that the most cost effective technique can be selected to increase the hardware security.…”

Logic Locking Using Hybrid CMOS and Emerging SiNW FETs

“…It is worth noting that the two reversed engineering attacks (propagated/isolated secret key [5] and SAT [23] attacks) assume that an attacker can get a functional IC from the market and obtain the encrypted chip by either IC design or reverse engineering in an untrusted foundry [5,23,36]. Therefore, an adversary can have access to the primary input-output pairs and can also reveal the structure of the circuit.…”