Identification of deterministic sequential finite state machines in unknown CMOS ICs

Abstract

Until now the efficient identification of unknown CMOS integrated circuits (ICs) has attracted a lot of interest. In particular, different invasive and non-invasive strategies have been developed for IC identification. However, invasive procedures always lead to the destruction of device under test. The non-invasive approaches published so far have the disadvantage that ICs are analysed by using very complex and time consuming algorithms. This paper presents a novel non-invasive procedure to determine nonlinear binary multi-input multi-output (MIMO) ICs solely by their input-output behaviour. The algorithm presented in this paper identifies unknown ICs by the abstraction of traditional automata theory. The overall identification procedure was simulated and fully tested on IEEE ISCAS benchmark models as well as user defined models of real ICs. The results are presented in this paper. For every circuit analysed the function has been successfully determined by the proposed identification procedure.

Non-Invasive Reverse Engineering of Finite State Machines Using Power Analysis and Boolean Satisfiability

“…Table IV summarizes the average run-times for different machines with a set of 100 and 1000 input vectors and Figure 4 shows the recovery percentage at the end of first iteration. The brute-force recovery technique [8] based on input-output analysis could recover machines with a single input bit and up to 25 transitions in 1 minute, whereas technique [7] could take several hours and lacks applicability due to the requirement of terminating states. Our technique can handle machines that are 64x larger and also achieve much faster convergence.…”

“…Relations between the other states are also revealed during power analysis which translate to InferredHD constraint. Both these constraints are applied in lines (6)(7)(8)(9)(10)(11)(12), depending on the inferred Hamming distances. In addition, functional analysis reveals input-output behavior which helps determine distinct states within the unknown machine.…”

Reverse Engineering Integrated Circuits Using Finite State Machine Analysis

“…The Brustcheck method follows several stages. The first of these is the pin determination based on electrostatic discharge theory, as described in [9], [17], and applied in both [15], [18], followed by a determination of the IC type: combinatorial, sequential linear, or sequential nonlinear. The FSM is then divided into Mealy or Moore automata.…”

Reverse engineering concurrent UML state machines using black box testing and genetic programming

“…There is ample motivation to reverse engineer FSMs, with applications ranging from security [4,13] and verification [3,5] to the representation of client-side behavior of rich Internet applications [2].…”