Abstract:The transistors used to construct Integrated Circuits (ICs) continue to shrink. While this shrinkage improves performance and density, it also reduces trust: the price to build leading-edge fabrication facilities has skyrocketed, forcing even nation states to outsource the fabrication of high-performance ICs. Outsourcing fabrication presents a security threat because the black-box nature of a fabricated IC makes comprehensive inspection infeasible. Since prior work shows the feasibility of fabrication-time attackers' evasion of existing post-fabrication defenses, IC designers must be able to protect their physical designs before handing them off to an untrusted foundry. To this end, recent work suggests methods to harden IC layouts against attack. Unfortunately, no tool exists to assess the effectiveness of the proposed defenses---meaning gaps may exist. This paper presents an extensible IC layout security analysis tool called IC Attack Surface (ICAS) that quantifies defensive coverage. For researchers, ICAS identifies gaps for future defenses to target, and enables the quantitative comparison of existing and future defenses. For practitioners, ICAS enables the exploration of the impact of design decisions on an IC's resilience to fabrication-time attack. ICAS takes a set of metrics that encode the challenge of inserting a hardware Trojan into an IC layout, a set of attacks that the defender cares about, and a completed IC layout and reports the number of ways an attacker can add each attack to the design. While the ideal score is zero, practically, our experience is that lower scores correlate with increased attacker effort.

Circuit Obfuscation and Oracle-Guided Attacks: Who Can Prevail?

Cyclic Obfuscation for Creating SAT-Unresolvable Circuits.

Appsat: Approximately Deobfuscating Integrated Circuits

Toward a Formal and Quantitative Evaluation Framework for Circuit Obfuscation Methods

Efficacy of Satisfiability Based Attacks in the Presence of Circuit Reverse Engineering Errors

KC2: Key-Condition Crunching for Fast Sequential Circuit Deobfuscation

Hiding circuit topology from unbounded reverse engineers

Removal of SAT-Hard Instances in Logic Obfuscation Through Inference of Functionality

IP Protection and Supply Chain Security Through Logic Obfuscation: A Systematic Overview

IP Protection and Supply Chain Security through Logic Obfuscation

SMT Attack: Next Generation Attack on Obfuscated Circuits with Capabilities and Performance Beyond the SAT Attacks

Exploiting Spin-Orbit Torque Devices As Reconfigurable Logic for Circuit Obfuscation

Scalable Attack-Resistant Obfuscation of Logic Circuits

TimingSAT: Decamouflaging Timing-based Logic Obfuscation

An Overview of FPGA-inspired Obfuscation Techniques

Secure and Low-Overhead Circuit Obfuscation Technique with Multiplexers

Is The Secure Ic Camouflaging Really Secure?

Security Closure of IC Layouts Against Hardware Trojans

On the Approximation Resiliency of Logic Locking and IC Camouflaging Schemes.

Provably Secure Camouflaging Strategy for IC Protection

An Extensible Framework for Quantifying the Coverage of Defenses Against Untrusted Foundries