Identification of State Registers of FSM Through Full Scan by Data Analytics

Abstract

Finite-state machine (FSM) is widely used as control unit in most digital designs. Many intellectual property protection and obfuscation techniques leverage on the exponential number of possible states and state transitions of large FSM to secure a physical design with the reason that it is challenging to retrieve the FSM design from its downstream design or physical implementation without knowledge of the design. In this paper, we postulate that this assumption may not be sustainable with big data analytics. We demonstrate by applying a data mining technique to analyze sufficiently large amount of data collected from a full scan design to identify its FSM state registers. An impact metric is introduced to discriminate FSM state registers from other registers. A decision tree algorithm is constructed from the scan data for the regression analysis of the dependency of other registers on a chosen register to deduce its impact. The registers with the greater impact are more likely to be the FSM state registers. The proposed scheme is applied on several complex designs from OpenCores. The experiment results show the feasibility of our scheme in correctly identifying most FSM state registers with a high hit rate for a large majority of the designs.

Identification of FSM State Registers by Analytics of Scan-Dump Data

“…To address this problem, we introduce the notion of coherency later in this paper to identify a pair of correlated register sequences. We also leverage on our previous work [29] to shortlist registers that have higher impact on other registers. They are R2, R4 and R5 in this example.…”

“…The limitations that led to its poor hit rate and trade-off between false-positive rate and false-negative rate have been overcome by the different and more comprehensive mining methodology proposed in this paper. Experimental evaluations conducted based on several benchmark designs from OpenCores show that our new mining method can more accurately identify the state registers of most designs with a lower false positive rate than [29]. Also, the proposed method can correctly cluster and identify the state registers of multiple FSMs within a design, which is not possible by [29].…”

“…A coherency matrix is constructed to cluster the registers into FSM registers and non-FSM registers.  The impact factor defined in our previous work [29] is used only to reduce the dimension of the coherency matrix. The registers are clustered by minimizing the within-cluster variances of FSM registers based on their coherency values, starting from some seed pairs of registers with the minimum mutual coherency.…”

“…The registers are clustered by minimizing the within-cluster variances of FSM registers based on their coherency values, starting from some seed pairs of registers with the minimum mutual coherency.  The same problem was tackled in our preliminary method [29] but with severe limitations. The limitations that led to its poor hit rate and trade-off between false-positive rate and false-negative rate have been overcome by the different and more comprehensive mining methodology proposed in this paper.…”

“…Experimental evaluations conducted based on several benchmark designs from OpenCores show that our new mining method can more accurately identify the state registers of most designs with a lower false positive rate than [29]. Also, the proposed method can correctly cluster and identify the state registers of multiple FSMs within a design, which is not possible by [29]. The rest of this paper is organized as follows.…”