Anti-SAT: Mitigating SAT Attack on Logic Locking

Xie, Yang; Srivastava, Ankur

doi:10.1109/tcad.2018.2801220

Cited by 159 publications

(112 citation statements)

References 27 publications

Supporting

Mentioning

107

Contrasting

Order By: Relevance

“…Moreover, SAT formulation is an NP-Complete problem and the heuristic-based solutions are not guaranteed to give a solution within reasonable time. Different protections [9], [10], [8] against SAT attack [2] have been proposed that generally involve adding extra logic to increase either the number of iterations of the attack or the time to complete each iteration. In [1], an approximate key is retrieved that shows output corruptibility for very few inputs and can bypass the protections offered by [9].…”

Section: Background and Related Workmentioning

confidence: 99%

SAIL: Machine Learning Guided Structural Analysis Attack on Hardware Obfuscation

Chakraborty

Cruz

Bhunia

2018

2018 Asian Hardware Oriented Security and Trust Symposium (AsianHOST)

114

View full text Add to dashboard Cite

Obfuscation is a technique for protecting hardware intellectual property (IP) blocks against reverse engineering, piracy, and malicious modifications. Current obfuscation efforts mainly focus on functional locking of a design to prevent black-box usage. They do not directly address hiding design intent through structural transformations, which is an important objective of obfuscation. We note that current obfuscation techniques incorporate only: (1) local, and (2) predictable changes in circuit topology. In this paper, we present SAIL, a structural attack on obfuscation using machine learning (ML) models that exposes a critical vulnerability of these methods. Through this attack, we demonstrate that the gate-level structure of an obfuscated design can be retrieved in most parts through a systematic set of steps. The proposed attack is applicable to all forms of logic obfuscation, and significantly more powerful than existing attacks, e.g., SAT-based attacks, since it does not require the availability of golden functional responses (e.g. an unlocked IC). Evaluation on benchmark circuits show that we can recover an average of around 84% (up to 95%) transformations introduced by obfuscation. We also show that this attack is scalable, flexible, and versatile.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

SAIL: Machine Learning Guided Structural Analysis Attack on Hardware Obfuscation

Chakraborty

Cruz

Bhunia

2018

2018 Asian Hardware Oriented Security and Trust Symposium (AsianHOST)

114

View full text Add to dashboard Cite

show abstract

“…This essentially leaves the attacker to decipher <48 key bits, which can be simply achieved by applying a brute-force attack. 8 Therefore, barring b17 (for sixteen scan chains configuration), Fig. 8: Boundary scan cell design.…”

Section: A Attack Resultsmentioning

confidence: 99%

Is Robust Design-for-Security Robust Enough? Attack on Locked Circuits with Restricted Scan Chain Access

Limaye

Sengupta

Nabeel

et al. 2019

2019 IEEE/ACM International Conference on Computer-Aided Design (ICCAD)

View full text Add to dashboard Cite

The security of logic locking has been called into question by various attacks, especially a Boolean satisfiability (SAT) based attack, that exploits scan access in a working chip. Among other techniques, a robust design-for-security (DFS) architecture was presented to restrict any unauthorized scan access, thereby, thwarting the SAT attack (or any other attack that relies on scan access). Nevertheless, in this work, we successfully break this technique by recovering the secret key despite the lack of scan access. Our security analysis on a few benchmark circuits protected by the robust DFS architecture demonstrates the effectiveness of our attack; on average ∼95% of the key bits are correctly recovered, and almost 100% in most cases. To overcome this and other prevailing attacks, we propose a defense by making fundamental changes to the robust DFS technique; the new defense can withstand all logic locking attacks. We observe, on average, lower area overhead (∼1.65%) than the robust DFS design (∼5.15%), and similar test coverage (∼99.88%).

show abstract

“…These benchmark circuits remain reflective of contemporary combinational circuits and have been used extensively in prior work on logic locking, e.g. [18,22,27]. We implemented the TTLock and SFLL locking algorithms for varying values of the Hamming distance parameter h and maximum key size of 128 bits.…”

Section: A Methodologymentioning

confidence: 99%

Functional Analysis Attacks on Logic Locking

Sirone

Subramanyan

2020

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

This paper proposes Functional Analysis attacks on Logic Locking algorithms (abbreviated as FALL attacks). FALL attacks have two stages. Their first stage is dependent on the locking algorithm and involves analyzing structural and functional properties of locked circuits to identify a list of potential locking keys. The second stage is algorithm agnostic and introduces a powerful addition to SAT-based attacks called key confirmation. Key confirmation can identify the correct key from a list of alternatives and works even on circuits that are resilient to the SAT attack.In comparison to past work, the FALL attack is more practical as it can often succeed (90% of successful attempts in our experiments) by only analyzing the locked netlist, without requiring oracle access to an unlocked circuit. Further, FALL attacks successfully defeat Secure Function Logic Locking (SFLL), the only locking algorithm resilient to all prior attacks on logic locking. Our experimental evaluation shows that FALL attacks are able to defeat 65 out of 80 (81%) circuits locked using SFLL.

show abstract

Anti-SAT: Mitigating SAT Attack on Logic Locking

Cited by 159 publications

References 27 publications

SAIL: Machine Learning Guided Structural Analysis Attack on Hardware Obfuscation

SAIL: Machine Learning Guided Structural Analysis Attack on Hardware Obfuscation

Is Robust Design-for-Security Robust Enough? Attack on Locked Circuits with Restricted Scan Chain Access

Functional Analysis Attacks on Logic Locking

Contact Info

Product

Resources

About