A survey of algorithmic methods in IC reverse engineering

Abstract

The discipline of reverse engineering integrated circuits (ICs) is as old as the technology itself. It grew out of the need to analyze competitor's products and detect possible IP infringements. In recent years, the growing hardware Trojan threat motivated a fresh research interest in the topic. The process of IC reverse engineering comprises two steps: netlist extraction and specification discovery. While the process of netlist extraction is rather well understood and established techniques exist throughout the industry, specification discovery still presents researchers with a plurality of open questions. It therefore remains of particular interest to the scientific community. In this paper, we present a survey of the state of the art in IC reverse engineering while focusing on the specification discovery phase. Furthermore, we list noteworthy existing works on methods and algorithms in the area and discuss open challenges as well as unanswered questions. Therefore, we observe that the state of research on algorithmic methods for specification discovery suffers from the lack of a uniform evaluation approach. We point out the urgent need to develop common research infrastructure, benchmarks, and evaluation metrics. KeywordsHardware reverse engineering • Survey • Boolean function learning • Logical equivalence checking IntroductionReverse engineering of integrated circuits serves a multitude of purposes [32]. For example, understanding the details of a competitor's IC helps to conduct a competitive analysis. Furthermore, patent infringements can be detected by locating the stolen IP in a competitor's IC. In addition, a particularly growing topic in recent years is the detection of hardware B Leonid Azriel

An Overview of Medical Electronic Hardware Security and Emerging Solutions

“…Similar to the attacks, the defense solutions can be designed for networking communications, device software, and/or device hardware. With respect to hardware-based defensive solutions, reverse engineering is one of the effective methods for hardware trust and assurance [118][119][120]. Although originally used for negative purposes (e.g., dis- [114].…”

“…Similar to the attacks, the defense solutions can be designed for networking communications, device software, and/or device hardware. With respect to hardware-based defensive solutions, reverse engineering is one of the effective methods for hardware trust and assurance [118][119][120]. Although originally used for negative purposes (e.g., disclosing sensitive information to a competitor/adversary), it can detect malicious alteration and/or tampering (applied by semiconductor foundries) with high accuracy.…”

An Exploratory Study of Hardware Reverse Engineering Technical and Cognitive Processes

“…Although our work was faced with methodological challenges that we discuss in the limitations section, we render the following main contributions advancing the current scientific knowledge of technical and cognitive processes in HRE. 1) We propose and examine an HRE phase model based on an exploratory behavioral study of human reverse engineers, who solved a realistic HRE task.…”

“…HRE is a multilayered process, where high-level information is extracted from a low-level circuit, consisting of two major stages [1]: In the first stage, a gate-level netlist is obtained from an IC either directly from the device or possibly through (online) interception of design information. A gatelevel netlist is a logical circuit description and is usually composed of Boolean gates and their respective interconnections.…”

“…The technical steps required for netlist extraction, including decapsulation and imaging, are relatively well-covered in the literature [27,35]. The objective of the second stage is to make sense of the recovered netlist, that is, to understand the netlist [1]. This second stage has only been rudimentarily addressed in the literature and is the topic of our investigation.…”