Protecting integrated circuits from piracy with test-aware logic locking

Abstract

The increasing IC manufacturing cost encourages a business model where design houses outsource IC fabrication to remote foundries. Despite cost savings, this model exposes design houses to IC piracy as remote foundries can manufacture in excess to sell on the black market. Recent efforts in digital hardware security aim to thwart piracy by using XOR-based chip locking, cryptography, and active metering. To counter direct attacks and lower the exposure of unlocked circuits to the foundry, we introduce a multiplexor-based locking strategy that preserves test response allowing IC testing by an untrusted party before activation. We demonstrate a simple yet effective attack against a locked circuit that does not preserve test response, and validate the effectiveness of our locking strategy on IWLS 2005 benchmarks.

In-situ Trojan authentication for invalidating hardware-Trojan functions

“…They are classified into anti-reverse engineering [10], [15], vulnerability analysis [13], HT detection [2], [4]- [6], [8], [11], [14], [16], [19], [21]. test point insertion [18], logic obfuscation [9], [12], HT prevention [20], and HT removing [7]. Anti-reverse engineering implements special gates on original designs against reverse engineering.…”

Logic Modification-Based IP Protection Methods: An Overview and a Proposal

“…Considering the threat model described above, a major concern expressed in [20] is the ease of a hill-climbing attack. It was described as an attack against the logic masking technique presented in [3].…”

“…This is due to the tight link between the masking/locking inputs and the outputs. The attack procedure for logic masking described in [20] is as follows. First, pick a random key and apply it on the unlocking inputs.…”

“…Since in this case, security is not based on a cryptographic primitive, it is easily broken and [20] showed how it was possible to recover the key using a basic hill-climbing attack.…”

Centrality Indicators for Efficient and Scalable Logic Masking

“…Intellectual property protection means were proposed to thwart this threat [2] and some are based on RTL modifications [3]. We add our voice to authors of [4] to explicitly define the terms used for gate level modifications of netlists to achieve intellectual property protection. We use the terminology recently defined in [3], and focus on logic masking.…”