Hardware reverse engineering: Overview and open challenges

Abstract

Hardware reverse engineering is a universal tool for both legitimate and illegitimate purposes. On the one hand, it supports confirmation of IP infringement and detection of circuit malicious manipulations, on the other hand it provides adversaries with crucial information to plagiarize designs, infringe on IP, or implant hardware Trojans into a target circuit. Although reverse engineering is commonplace in practice, the quantification of its complexity is an unsolved problem to date since both technical and human factors have to be accounted for. A sophisticated understanding of this complexity is crucial in order to provide a reasonable threat estimation and to develop sound countermeasures, i.e. obfuscation transformations of the target circuit, to mitigate risks for the modern IC landscape.The contribution of our work is threefold: first, we systematically study the current research branches related to hardware reverse engineering ranging from decapsulation to gate-level netlist analysis. Based on our overview, we formulate several open research questions to scientifically quantify reverse engineering, including technical and human factors. Second, we survey research on problem solving and on the acquisition of expertise and discuss its potential to quantify human factors in reverse engineering. Third, we propose novel directions for future interdisciplinary research encompassing both technical and psychological perspectives that hold the promise to holistically capture the complexity of hardware reverse engineering.

Towards cognitive obfuscation

“…Reverse engineering in the field of hardware security is conducted for legitimate as well as illegitimate purposes [10]. On the one hand, security engineers are often forced to conduct reverse engineering to identify counterfeited hardware, security vulnerabilities, or malicious manipulations like hardware Trojans [25].…”

“…On the one hand, security engineers are often forced to conduct reverse engineering to identify counterfeited hardware, security vulnerabilities, or malicious manipulations like hardware Trojans [25]. On the other hand, hardware reverse engineering is also associated with illegitimate actions such as the analysis of hardware designs on various levels to understand their functionality in order to commit IP infringement, weaken security functions, or to inject Trojans [10].…”

“…In order to detect fabrication faults, copyright infringements, counterfeit products, or malicious manipulations hardware reverse engineering is usually the tool-of-choice [2,10,14]. While hardware reverse engineering is a highly complex and universal tool for legitimate purposes, it can also be employed with illegitimate intentions, undermining the integrity of ICs via piracy, subsequent weakening of security functions, or insertion of hardware Trojans [10,19]. In particular, Intellectual Property (IP) piracy has become a major concern for the semiconductor industry which causes losses in the range of several billion dollars [14].…”

“…In particular, Intellectual Property (IP) piracy has become a major concern for the semiconductor industry which causes losses in the range of several billion dollars [14]. Governments and armed forces classify hardware reverse engineering as a major security threat, since malicious manipulations of hardware components in mission-critical systems can even have lethal consequences [10].…”

Teaching Hardware Reverse Engineering: Educational Guidelines and Practical Insights

“…In the context of hardware security [9], security engineers (as well as adversaries) are forced to employ reverse engineering to make sense of a proprietary hardware design (e.g., to identify security vulnerabilities or security-circuitry for Trojan insertion [10]). During this task, analysis of the gate-level netlist is a crucial step for human reverse engineers [11].…”