A Survey on Split Manufacturing: Attacks, Defenses, and Challenges

Abstract

In today's integrated circuit (IC) ecosystem, owning a foundry is not economically viable, and therefore most IC design houses are now working under a fabless business model. In order to overcome security concerns associated with the outsorcing of IC fabrication, the Split Manufacturing technique was proposed. In Split Manufacturing, the Front End of Line (FEOL) layers (transistors and lower metal layers) are fabricated at an untrusted high-end foundry, while the Back End of Line (BEOL) layers (higher metal layers) are manufactured at a trusted low-end foundry. This approach hides the BEOL connections from the untrusted foundry, thus preventing overproduction and piracy threats. However, many works demonstrate that BEOL connections can be derived by exploiting layout characteristics that are introduced by heuristics employed in typical floorplanning, placement, and routing algorithms. Since straightforward Split Manufacturing may not afford a desirable security level, many authors propose defense techniques to be used along with Split Manufacturing. In our survey, we present a detailed overview of the technique, the many types of attacks towards Split Manufacturing, as well as possible defense techniques described in the literature. For the attacks, we present a concise discussion on the different threat models and assumptions, while for the defenses we classify the studies into three categories: proximity perturbation, wire lifting, and layout obfuscation. The main outcome of our survey is to highlight the discrepancy between many studiessome claim netlists can be reconstructed with near perfect precision, while others claim marginal success in retrieving BEOL connections. Finally, we also discuss future trends and challenges inherent to Split Manufacturing, including the fundamental difficulty of evaluating the efficiency of the technique.

Digital-to-Analog Hardware Trojan Attacks

“…The orange curves in Figs. [16][17][18][19] show the HT-infected performances in this scenario. As it can be seen, all performances are degraded.…”

“…The red curves in Figs. [16][17][18][19] show the HT-infected performances in this scenario. As it can be seen, there is no noise shaping and the signal now is buried under the noise floor.…”

“…Pre-silicon prevention methods include: (a) functional verification of 3PIP cores [7]; (b) structural analysis of Hardware Description Language (HDL) codes [7]; (c) targeted automatic test pattern generation algorithms [8] or simulating the circuit using specific test benches, i.e., performing aging simulations along with over-clocking [9] or short-term aging [10] to magnify the effect of the HT without triggering it; (d) searching for unused components during design-time verification and removing them as potentially suspicious [11]; (e) filling in all unused spaces on the layout, which are most likely insertion areas for HTs, with functional filler cells and checking if those have changed [12]; and (f) design obfuscation, for example using locking [13], [14], camouflaging [15], [16], or split manufacturing [17], aiming at obscuring the IC functionality so as to make it difficult for the attacker to insert the HT.…”

Side-Channel Trojan Insertion - a Practical Foundry-Side Attack via ECO

“…Furthermore, we argue that our proposed methodology is not only capable of inserting an SCT in a high density layout, but also of keeping the target's performance regardless of its (challenging) frequency. Finally, there are very few techniques that would assuredly counter the ECO-enabled trojan insertion [3], [25].…”

Locking by Untuning: A Lock-Less Approach for Analog and Mixed-Signal IC Security

“…Countermeasures against IP/IC piracy have been extensively studied for digital ICs for over a decade now. Main countermeasures include split manufacturing [5], [6], physical design obfuscation [7], [8], and logic locking [9], [10].…”