Functional Obfuscation of Hardware Accelerators through Selective Partial Design Extraction onto an Embedded FPGA

Abstract

The protection of Intellectual Property (IP) has emerged as one of the most serious areas of concern in the semiconductor industry. To address this issue, we present a method and architecture to map selective portions of a design, given as a behavioral description for High-Level Synthesis (HLS) to a high-security embedded Field-Programmable Gate Array (eFPGA). In this manner, only the end-user has access to the full functionality of the chip. Using six benchmark circuits, we show that our approach is effective. In all cases, the Time-To-Break (TT B) is so long (at least 8 million hours) that for all practical purposes the designs are secure, while incurring area overheads of around 5%. Further, latencies were only slightly increased, while the computation times are under one minute. CCS CONCEPTS • Security and privacy → Security in hardware; Hardwarebased security protocols;

Not All Fabrics Are Created Equal: Exploring eFPGA Parameters For IP Redaction

“…This ensures that a designer should have an idea of how much resources in terms of logic and I/Os are available in a fabric. This will lead to a better resource utilization in the fabric when one redacts a module, especially if one adopts a High Level Synthesis (HLS)-based "top-down" approach [6], [7]. There can be two cases which limits the choice of a fabric: (1) Logic: This constitute the number of CLBs required to map a design; (2) I/Os: The number of inputs and outputs of a modules.…”

“…On one hand, structural attacks are difficult to be applied because the eFPGA is regular and generic, able to implement an arbitrary functionality. On the other hand, the size of the configuration bitstream grows exponentially with the complexity of the eFPGA architecture, significantly enlarging the key space and so thwarting SAT-based attacks [5], [7], [14].…”

“…For insight into the security offered by using eFPGA-based redaction, we explore SAT-attack resilience of the various fabrics (as described earlier in Section III-C), as this has been used to gauge the security of redaction in prior work [5] and has proven to be a challenge to overcome for prior IP protection approaches [3]. Previous work suggests that large FPGA bitstream lengths make SAT-based attacks impractical [7] and the evaluation results in [5] appear to support this claim.…”

“…We endow the attacker with these capabilities although there are orthogonal efforts to mitigate this Oraclebased threat model [11]. Third, the adversary cannot extract the FPGA bitstream [7], i.e., the attacker does not have access to the configuration flip-flops, so cannot simply steal the bitstream directly. While there are a number of attacks on FPGA security [40], we consider such attacks orthogonal to this study.…”

“…Recently, redacting parts of an IP by using embedded field programmable gate arrays (eFPGAs), as depicted in Fig. 1(b), has emerged as a promising, SAT-attack resilient defense [5], [7]. The intuition is that even small eFPGAs fabrics are insurmountable for SAT solvers because of their complexity and their size when converted into a representation for SAT solving [5].…”