Abstract:With the globalization and distribution of the semiconductor supply chain, intellectual property (IP) protection has become a necessity. Recent years have witnessed a surge of interest in logic locking as a proactive IP protection solution. However, in recent years, we also have seen an increase in logic/circuit de-obfuscation attacks that put the strength of logic locking at risk. One of these attacks on locked circuits is the bounded-model-checker (BMC)-based attack, where the adversary has limited access to the design-for-testability (DFT) (known as scan chain). While the BMC-based attack is widely known as an algorithmic attack, numerous studies show that the attack lacks scalability since it has two unrolling factors: sequential unrolling and miter duplication. Inspired by straightforward heuristics widely used for satisfiability problems in the computer science SAT community, in this paper, we will explore a set of methodologies that can have a significant impact on mitigating the BMC attack's scalability issue. For this purpose, through the BMC attack process, we explore the efficacy of "restart" and "initialization" on the attack performance, in which we apply some modification on the locked design before ("initialization") or within ("restart") the BMC execution. By applying "restart" and "initialization" in numerous different configurations, our experimental results show >85% consistent improvement in the BMC attack that can lead to a stronger algorithmic attack scenario on logic locking.

Bounded Model Checking for RTL Circuits Based on Algorithm Abstraction Refinement

Bounded Model Checking Combining Symbolic Trajectory Evaluation Abstraction With Hybrid Three-Valued Sat Solving

Combinational Equivalence Checking Based on Circuit Topology Analysis

Abstraction-based model checking programs

More anti-chain based refinement checking

Bounded Model Checking of CTL

Automatic abstraction for C program

Bounded Model Checking for Branching-Time Temporal Logic

Formal Verification for C Program

EHSAT Modeling from Algorithm Description for RTL Model Checking

Optimizing the SAT Decision Ordering of Bounded Model Checking by Structural Information

Modified Clause Form for Bounded Model Checking

Cooperative Bounded Model Checking Using STE and Hybrid Three-Valued SAT Solving

CBMC: The C Bounded Model Checker

Model Checking on Clock Domain Crossing Design of System-on-Chip

Competent Predicate Abstraction in Model Checking.

An Improved Hybrid SAT Solver for Bounded Model Checking in Circuit Design

Improving Bounded Model Checkers Scalability for Circuit De-Obfuscation: An Exploration

Abstraction Refinement Algorithms for Timed Automata

Direct model checking based on dynamic Kripke structure and its application

Detecting spurious counterexamples efficiently in abstract model checking