Skip to main content
Fachgebiete
Automobil + Motoren Bauwesen + Immobilien Business IT + Informatik Elektrotechnik + Elektronik Energie + Nachhaltigkeit Finance + Banking Management + Führung Marketing + Vertrieb Maschinenbau + Werkstoffe Versicherung + Risiko
DE
EN
Bücher
Zeitschriften
Themenseiten
Organisationspsychologie Projektmanagement Marketing Smart Manufacturing
Weitere Formate
Podcasts Webinare Technik Webinare Wirtschaft Kongresse Veranstaltungskalender Awards
Jetzt Einzelzugang starten
Zugang für Unternehmen
Referenzkunden
SLX-Digitalkonferenz: Zukunftswerkstatt 2024

Mehr Umsatz mit Top-Kontakten

Am 7. Mai erfahren Sie, wie Vertriebsteams Leadgenerierung, Leadnurturing und Leadstrategien effizient steuern können.
Erweiterte Suche
Anmelden
nach oben

2020 | Buch

The Need for Logic Locking Kapitel lesen Erstes Kapitel lesen

Trustworthy Hardware Design: Combinational Logic Locking Techniques

verfasst von: Muhammad Yasin, Prof. Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu

Verlag: Springer International Publishing

Buchreihe : Analog Circuits and Signal Processing

Enthalten in: Springer Professional "Wirtschaft+Technik" , Springer Professional "Technik" , Springer Professional "Wirtschaft"

Einloggen, um Zugang zu erhalten
insite
SUCHEN

Über dieses Buch

With the popularity of hardware security research, several edited monograms have been published, which aim at summarizing the research in a particular field. Typically, each book chapter is a recompilation of one or more research papers, and the focus is on summarizing the state-of-the-art research.

Different from the edited monograms, the chapters in this book are not re-compilations of research papers. The book follows a pedagogical approach. Each chapter has been planned to emphasize the fundamental principles behind the logic locking algorithms and relate concepts to each other using a systematization of knowledge approach. Furthermore, the authors of this book are in a good position to be able to deliver such a book, as they contributed to this field significantly through numerous fundamental papers.

Inhaltsverzeichnis

Frontmatter
Chapter 1. The Need for Logic Locking
Abstract
The first chapter of the book describes the need for logic locking and how it addresses the hardware security challenges faced by the IC design community. The chapter begins with a description of the globalized IC design flow and the associated security threats. This introduction is followed by a brief description of various design-for-trust countermeasures and their comparison with logic locking in terms of security properties. The chapter ends with a detailed description of logic locking and the associated terminology that will be used throughout this book.
Integrated circuits (ICs) are ubiquitous and an essential component in our lives today. ICs at the heart of electronic systems ranging from home appliances and smartphones to satellites and military equipment. ICs serve as the root-of-trust for these systems. The software computations can only be trustworthy if the underlying hardware is reliable and trustworthy [42]. The security of the hardware is, gradually, becoming as important as that of the software, in part due to the emergence of hardware attacks, such as the latest Spectre and Meltdown attacks on Intel processors [23, 29]. The primary reason for many hardware-based attacks, such as reverse engineering or IP piracy, is the profit-driven globalization of the IC design flow. This chapter focuses on logic locking, which is a well-known countermeasure against multiple hardware-based attacks. If we have to summarize logic locking in one sentence, it would be something along the following lines: Logic locking “locks” the functionality of a design until it is unlocked with a secret key. You might be wondering how a design is locked? The high-level answers to this and many other questions that you might have will be provided before the end of this chapter. The specific details of various logic locking algorithms can be found in the subsequent chapters of this book.
This chapter is organized as follows. Section 1.1 describes the globalized IC design flow followed by a description of the associated security threats in Sect. 1.2. Section 1.3 presents a summary of the existing design-for-trust (DfTr) countermeasures. Section 1.4 elaborates on the fundamental concepts of logic locking and illustrates how it addresses various hardware security vulnerabilities. The same section also introduces various terms and definitions that are associated with logic locking and will be used throughout this book.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Chapter 2. A Brief History of Logic Locking
Abstract
This chapter presents a comprehensive history of logic locking defenses and attacks. A classification of logic locking techniques as well as attacks is provided. The logic locking defenses are divided into classes: pre-SAT and post-SAT techniques. Four classes of attacks: algorithmic, approximate, structural, and side-channel, are introduced. The chapter emphasizes the relationship between different logic locking techniques. A timeline of the prominent logic locking attacks and defenses is also presented.
Since the inception of logic locking in 2008 [16], it has received significant interest from the research community. Over the last decade, a number of logic locking techniques as well as attacks have emerged. This chapter presents a high-level introduction to the major developments in logic locking. In addition to offering an overview of different logic locking attacks and defenses, the chapter also highlights the relationships between different attack and defense algorithms. Section 2.1 provides a summary of the milestones in logic locking research. Section 2.2 introduces a classification of logic locking defenses and attacks. Section 2.3 presents a brief overview of the existing logic locking defenses. Section 2.4 summarizes the existing attacks on logic locking. Section 2.5 elaborates on the resilience of each defense against different attack algorithms using an attack-defense matrix. Section 2.6 presents a summary of different metrics that can be used to evaluate the effectiveness of a logic locking technique.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Chapter 3. Pre-SAT Logic Locking
Abstract
This chapter focuses on the Pre-SAT logic locking, presenting three techniques, RLL, FLL, and SLL, in addition to describing the sensitization attack. RLL is the earliest known logic locking technique that was introduced to thwart IC piracy. FLL improves upon RLL and prevents the black-box usage of an IC. However, both RLL and FLL remain susceptible to the sensitization attack, which retrieves the key bits from a functional IC in a divide-and-conquer fashion. SLL thwarts the sensitization attack by inserting key gates that exhibit strong interference among themselves and make it hard to retrieve key bits on an individual basis.
This chapter is about the Pre-SAT logic locking techniques. Section 3.1 introduces RLL, the first-ever logic locking technique. Section 3.2 describes FLL, which improves upon RLL to prevent the black-box usage of an IC. Section 3.3 focuses on the sensitization attack, the first algorithmic attack on logic locking. Section 3.3 presents SLL as a countermeasure to the sensitization attack.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Chapter 4. The SAT Attack
Abstract
This chapter elaborates on the SAT attack, which breaks all pre-SAT logic locking techniques. The SAT attack is an oracle-guided attack that utilizes a SAT solver to compute attack patterns that refine the key search space iteratively. The SAT attack has changed the direction of logic locking research; developing efficient countermeasures against the attack is still an active area of research.
This chapter presents the SAT attack, which breaks all pre-SAT logic locking techniques. The SAT attack forms the most potent variant of key recovery attacks mounted to break basic combinational logic locking techniques [10]. The attack and its variants apply to both logic locking [10] and camouflaging [4, 5]. The attack uses the notion of Boolean satisfiability. Section 4.1 reviews the fundamental concepts of Boolean satisfiability. Section 4.2 presents the SAT attack algorithm. Section 4.3 elaborates on the effectiveness of the SAT attack against the pre-SAT logic locking techniques. Section 4.4 discusses the potential approaches to thwart the SAT attack. Section 4.5 presents a formal security analysis framework to quantify security of logic locking techniques against different classes of attacks including the SAT attack.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Chapter 5. Post-SAT 1: Point Function-Based Logic Locking
Abstract
This chapter presents point function-based logic locking techniques, namely SARLock, Anti-SAT, and AND-tree detection that thwart the SAT attack by controlling the distinguishing ability of the DIPs. All these techniques integrate with the original netlist a point function that sets a limit on the number of incorrect key values that a DIP can eliminate. While these techniques cost-effectively thwart the SAT attack, their main limitation is the susceptibility to removal attacks. Moreover, these techniques fail to achieve a high output error rate.
This chapter is about point function-based logic locking techniques that remain the earliest countermeasures against the SAT attack. The chapter presents three techniques, SARLock [5], Anti-SAT [4], and AND-tree detection [1]. All three techniques harness point functions to control the distinguishing ability of individual DIPs and ultimately render the required number of required DIPs exponential in the key size. Section 5.1 describes the common principle underlying these techniques. Section 5.2 describes the architecture and operation of SARLock. Section 5.3 explains how Anti-SAT makes use of point functions to circumvent the SAT attack. Section 5.4 elaborates on the effectiveness of AND-tree detection. Section 5.5 compares the three approaches in terms of the attack resilience and the implementation cost. Section 5.6 highlights the limitations of the point function-based logic locking.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Chapter 6. Approximate Attacks
Abstract
This chapter presents approximate attacks on logic locking, namely AppSAT and Double-DIP. Approximate attacks target compound logic techniques and reduce a compound technique (comprising a low corruptibility technique and a high corruptibility technique) to the low corruptibility technique. AppSAT augments the basic SAT attack with random queries at regular intervals; it terminates when the computed OER is below a certain threshold. Double-DIP makes use 2-DIPs that eliminate at least two incorrect key values per 2-DIP; the attack terminates when 2-DIPs can no longer be found. The effectiveness of the approximate attacks cautions against naive integration of logic locking techniques.
This chapter is about approximate attacks on logic locking. Approximate attacks target compound logic locking techniques, reducing the compound technique to its constituent low-corruptibility technique. Section 6.1 introduces compound logic locking techniques that paved the way for the emergence of approximate attacks. Section 6.2 elaborates on the operation of the AppSAT attack [3]. Section 6.3 describes how Double-DIP attack [4] works and how the attack methodology differs from that of the AppSAT attack.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Chapter 7. Structural Attacks
Abstract
This chapter is about structural attacks on point function-based logic locking. These attacks rely on the structural properties of a locked netlist to identify the correct functionality of the original version. The chapter presents four attacks: the signal probability skew (SPS) attack, the AppSAT-guided removal (AGR) attack, sensitization-guided SAT (SGS) attack, and the Bypass attack. The SPS attack targets the basic Anti-SAT block; the AGR attack circumvents the functional and structural obfuscation added on top of basic Anti-SAT; the SGS attack exposes the security vulnerabilities associated with AND-tree detection (ATD); the Bypass attack integrates the Double-DIP attack with simple post-processing steps to recover an exact netlist.
Structural/removal attacks on point function-based logic locking exploit the structural traces embedded in a netlist to identify and/or bypass the protection offered by the point-function and recover the correct functionality of the target netlist. This chapter describes the operation of four structural attacks on logic locking. Section 7.1 presents the SPS attack that can identify and remove the basic (unobfuscated) Anti-SAT block to retrieve the original circuit. Section 7.2 elaborates on the operation of the AGR attack that integrates AppSAT with simple netlist analysis to break obfuscated Anti-SAT (OA). Section 7.3 presents the SGS attack that exploits the security vulnerabilities of ATD to weaken the security it promises. Section 7.4 discusses how the Bypass attack recovers an exact netlist by adding a bypass circuit to an approximate netlist.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Chapter 8. Post-SAT 2: Insertion of SAT-Unresolvable Structures
Abstract
This chapter presents cyclic logic locking and one-way function-based logic locking. The underlying idea of both schemes is to embed structures in a netlist that are hard to resolve for a SAT solver. Cyclic logic locking introduces cycles into a netlist with the expectation that it will render the SAT attack effort exponential in the number of cycles introduced. However, cyclic logic locking is vulnerable to the CycSAT attack, which can encode the presence of cycles in the CNF representation. One-way function-based logic locking integrates one-way functions into the locked netlist to render the SAT attack computationally infeasible.
The SAT attack resilient techniques discussed so far achieve high SAT attack resilience by compromising on the output corruptibility. This chapter introduces two logic locking techniques that need not make such compromise. Section 8.1 introduces cyclic logic locking that inserts cycles/loops in a netlist to thwart the SAT attack. Section 8.2 highlights the security vulnerabilities of cyclic logic locking and presents CycSAT, an attack that can break cyclic logic locking. Section 8.3 presents one-way function-based logic locking that integrates one-way functions into the locked netlist.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Chapter 9. Post-SAT 3: Stripped-Functionality Logic Locking
Abstract
This chapter presents stripped-functionality logic locking (SFLL), a technique that provides provable security against SAT, removal, and approximate attacks. SFLL hides part of the design functionality in the form of compactly represented input patterns, rendering the on-chip circuit different from the original circuit. Only upon applying the correct key(s) to the restore circuit, the original functionality of the circuit is restored.
This chapter presents SFLL, a logic locking technique that offers provable security guarantees against various classes of logic locking attacks. The underlying principle of logic locking is to implement a modified circuit on-chip; the difference in functionality is quantified in terms of the number of protected input patterns, which also dictates the protection achieved against various attacks. Only upon application of the correct key to a separately added restore circuit, the original functionality is restored. Section 9.1 explains the motivation behind SFLL and the basic concepts associated with SFLL. Section 9.2 introduces a special case of SFLL, referred to as SFLL-HD0, which protects only one pattern. Section 9.3 elaborates on the operation of the more general SFLL-HD scheme. Section 9.4 presents SFLL-flex that allows a designer to specify the functionality-to-be-protected.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Chapter 10. Side-Channel Attacks
Abstract
Apart from the previously mentioned attacks that exploit the algorithmic weaknesses of logic locking techniques, logic locking is also vulnerable to the emerging class of side-channel attacks, which are the focus of this chapter. The chapter introduces four attacks on logic locking that exploit various side-channels to extract secret key. The differential power analysis attack utilizes the power consumption of a chip to determine the secret logic locking key. The test-data mining attack and the hill climbing attack determine the secret key from the test data. The de-synthesis attack extracts the key by leveraging the traces left in a netlist during logic synthesis.
The attacks discussed so far in this book aim at exploiting the algorithmic weaknesses of logic locking techniques. However, secret information may also be leaked through side-channels such as power, electromagnetic radiation, and time [3, 4]. This chapter presents four representative side-channel attacks on logic locking. Section 10.1 presents the differential power analysis (DPA) attack on logic locking. Apart from the traditional side-channels such as timing and power, logic locking has also been shown to be vulnerable to newer classes of side-channel attacks that leverage the vulnerabilities associated with different stages of the IC design flow. Sections 10.2 and 10.3 present the test-data mining (TDM) attack and the hill climbing attack, respectively; both attacks exploit test data to extract sensitive information. Section 10.4 introduces the de-synthesis attack that derives the secret key from the information embedded in a netlist during logic synthesis.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Chapter 11. Discussion
Abstract
The last chapter of this book presents a summary of the logic locking defenses and attacks discussed throughout the book. The chapter also highlights the challenges faced by existing logic locking approaches and hints at the future research directions.
This chapter concludes the book by summarizing the techniques discussed throughout the book and offering directions for future research. Section 11.1 revisits the attack/defense matrix introduced in Chap. 2, summarizing the relation among various classes of attacks and defenses. Section 11.2 offers insights into the challenges faced by logic locking techniques. Section 11.3 highlights the future research directions.
Muhammad Yasin, Jeyavijayan (JV) Rajendran, Ozgur Sinanoglu
Backmatter
Metadaten
Titel
Trustworthy Hardware Design: Combinational Logic Locking Techniques
verfasst von
Muhammad Yasin
Prof. Jeyavijayan (JV) Rajendran
Ozgur Sinanoglu
Copyright-Jahr
2020
Electronic ISBN
978-3-030-15334-2
Print ISBN
978-3-030-15333-5
DOI
https://doi.org/10.1007/978-3-030-15334-2

Neuer Inhalt

    Bildnachweise