DECOY: DEflection-Driven HLS-Based Computation Partitioning for Obfuscating Intellectual PropertY

Chen, Jianqi; Zaman, Monir; Makris, Yiorgos; Blanton, R. D.; Mitra, Subhasish; Schäfer, Benjamin Carrión

doi:10.1109/dac18072.2020.9218519

Cited by 25 publications

(18 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These two design choices are relatively simple to implement in physical synthesis but carry overheads that we deemed not advantageous, even if they make perfect sense for an FPGA device. A recent trend in obfuscation research is the use of embedded FPGA (eFPGA) [21], [22]. A very similar approach is also found in [23], where authors perform obfuscation with transistor-level granularity.…”

Section: Comparison and Discussionmentioning

confidence: 90%

From FPGAs to Obfuscated eASICs: Design and Security Trade-offs

Abideen¹,

Perez²,

Pagliarini³

2021

Preprint

View full text Add to dashboard Cite

Threats associated with the untrusted fabrication of integrated circuits (ICs) are numerous: piracy, overproduction, reverse engineering, hardware trojans, etc. The use of reconfigurable elements (i.e., look-up tables as in FPGAs) is a known obfuscation technique. In the extreme case, when the circuit is entirely implemented as an FPGA, no information is revealed to the adversary but at a high cost in area, power, and performance. In the opposite extreme, when the same circuit is implemented as an ASIC, best-in-class performance is obtained but security is compromised. This paper investigates an intermediate solution between these two. Our results are supported by a custom CAD tool that explores this FPGA-ASIC design space and enables a standardcell based physical synthesis flow that is flexible and compatible with current design practices. Layouts are presented for obfuscated circuits in a 65nm commercial technology, demonstrating the attained obfuscation both graphically and quantitatively. Furthermore, our security analysis revealed that for truly hiding the circuit's intent (not only portions of its structure), the obfuscated design also has to chiefly resemble an FPGA: only some small amount of logic can be made static for an adversary to remain unaware of what the circuit does.

show abstract

Section: Comparison and Discussionmentioning

confidence: 90%

From FPGAs to Obfuscated eASICs: Design and Security Trade-offs

Abideen¹,

Perez²,

Pagliarini³

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…This ensures that a designer should have an idea of how much resources in terms of logic and I/Os are available in a fabric. This will lead to a better resource utilization in the fabric when one redacts a module, especially if one adopts a High Level Synthesis (HLS)-based "top-down" approach [6], [7]. There can be two cases which limits the choice of a fabric: (1) Logic: This constitute the number of CLBs required to map a design; (2) I/Os: The number of inputs and outputs of a modules.…”

Section: Discussionmentioning

confidence: 99%

“…When deciding which module(s) to redact, the designer could know the "sensitive" parts of the design, manually driving the selection [5], or use methods based on highlevel synthesis (HLS) to identify the logic that differentiates variants of the same design [6]. In all cases, the designer assumes a standard or even off-the-shelf implementation of the eFPGA, incurring in significant overheads.…”

Section: B Efpga-based Redactionmentioning

confidence: 99%

Not All Fabrics Are Created Equal: Exploring eFPGA Parameters For IP Redaction

Bhandari¹,

Moosa²,

Tan³

et al. 2021

Preprint

View full text Add to dashboard Cite

Semiconductor design houses rely on third-party foundries to manufacture their integrated circuits (IC). While this trend allows them to tackle fabrication costs, it introduces security concerns as external (and potentially malicious) parties can access critical parts of the designs and steal or modify the Intellectual Property (IP). Embedded FPGA (eFPGA) redaction is a promising technique to protect critical IPs of an ASIC by redacting (i.e., removing) critical parts and mapping them onto a custom reconfigurable fabric. Only trusted parties will receive the correct bitstream to restore the redacted functionality. While previous studies imply that using an eFPGA is a sufficient condition to provide security against IP threats like reverseengineering, whether this truly holds for all eFPGA architectures is unclear, thus motivating the study in this paper. We examine the security of eFPGA fabrics generated by varying different FPGA design parameters. We characterize the power, performance, and area (PPA) characteristics and evaluate each fabric's resistance to SAT-based bitstream recovery. Our results encourage designers to work with custom eFPGA fabrics rather than off-the-shelf commercial FPGAs and reveals that only considering a redaction fabric's bitstream size is inadequate for gauging security.

show abstract

“…For our experiments, we use the number of relation terms in the key relation as a proxy for its complexity. We define our budget in terms of it and use a budget threshold for the key relation in the range [12][13][14] latent terms and depth of expression selection in range [2][3][4]. We use a timeout of 20 minutes for locking and 4 days for attacks.…”

Section: Experimental Evaluationmentioning

confidence: 99%

“…Such transitions can only happen with a specific input sequence. Differently from [14], we extract the relation directly from the analysis of a single RTL design, making the approach independent of the design flow. None of these methods consider the possibility of hiding a relation among the key bits.…”

Section: Related Workmentioning

confidence: 99%

HOLL: Program Synthesis for Higher OrderLogic Locking

Takhar¹,

Karri²,

Pilato³

et al. 2022

Preprint

View full text Add to dashboard Cite

Logic locking "hides" the functionality of a digital circuit to protect it from counterfeiting, piracy, and malicious design modifications. The original design is transformed into a "locked" design such that the circuit reveals its correct functionality only when it is "unlocked" with a secret sequence of bits-the key bit-string. However, strong attacks, especially the SAT attack that uses a SAT solver to recover the key bitstring, have been profoundly effective at breaking the locked circuit and recovering the circuit functionality. We lift logic locking to Higher Order Logic Locking (HOLL) by hiding a higher-order relation, instead of a key of independent values, challenging the attacker to discover this key relation to recreate the circuit functionality. Our technique uses program synthesis to construct the locked design and synthesize a corresponding key relation. HOLL has low overhead and existing attacks for logic locking do not apply as the entity to be recovered is no more a value. To evaluate our proposal, we propose a new attack (SynthAttack ) that uses an inductive synthesis algorithm guided by an operational circuit as an input-output oracle to recover the hidden functionality. SynthAttack is inspired by the SAT attack, and similar to the SAT attack, it is verifiably correct, i.e., if the correct functionality is revealed, a verification check guarantees the same. Our empirical analysis shows that SynthAttack can break HOLL for small circuits and small key relations, but it is ineffective for real-life designs.

show abstract

DECOY: DEflection-Driven HLS-Based Computation Partitioning for Obfuscating Intellectual PropertY

Cited by 25 publications

References 16 publications

From FPGAs to Obfuscated eASICs: Design and Security Trade-offs

From FPGAs to Obfuscated eASICs: Design and Security Trade-offs

Not All Fabrics Are Created Equal: Exploring eFPGA Parameters For IP Redaction

HOLL: Program Synthesis for Higher OrderLogic Locking

Contact Info

Product

Resources

About