The Key is Left under the Mat: On the Inappropriate Security Assumption of Logic Locking Schemes

Rahman, Mir Tanjidur; Tajik, Shahin; Rahman, M. Sazadur; Tehranipoor, Mohammad; Asadizanjani, Navid

doi:10.1109/host45689.2020.9300258

Cited by 64 publications

(25 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While there are a number of attacks on FPGA security [40], we consider such attacks orthogonal to this study. Physical attacks (e.g., optical probing [41]) are out of scope. Our threat model and assumptions are consistent with prior work [5].…”

Section: A Assumptions and Threat Modelmentioning

confidence: 99%

Not All Fabrics Are Created Equal: Exploring eFPGA Parameters For IP Redaction

Bhandari¹,

Moosa²,

Tan³

et al. 2021

Preprint

View full text Add to dashboard Cite

Semiconductor design houses rely on third-party foundries to manufacture their integrated circuits (IC). While this trend allows them to tackle fabrication costs, it introduces security concerns as external (and potentially malicious) parties can access critical parts of the designs and steal or modify the Intellectual Property (IP). Embedded FPGA (eFPGA) redaction is a promising technique to protect critical IPs of an ASIC by redacting (i.e., removing) critical parts and mapping them onto a custom reconfigurable fabric. Only trusted parties will receive the correct bitstream to restore the redacted functionality. While previous studies imply that using an eFPGA is a sufficient condition to provide security against IP threats like reverseengineering, whether this truly holds for all eFPGA architectures is unclear, thus motivating the study in this paper. We examine the security of eFPGA fabrics generated by varying different FPGA design parameters. We characterize the power, performance, and area (PPA) characteristics and evaluate each fabric's resistance to SAT-based bitstream recovery. Our results encourage designers to work with custom eFPGA fabrics rather than off-the-shelf commercial FPGAs and reveals that only considering a redaction fabric's bitstream size is inadequate for gauging security.

show abstract

Section: A Assumptions and Threat Modelmentioning

confidence: 99%

Not All Fabrics Are Created Equal: Exploring eFPGA Parameters For IP Redaction

Bhandari¹,

Moosa²,

Tan³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Third, the attacker cannot trivially extract the FPGA bitstream [6]. Physical attacks (e.g., optical probing [33]) are out of scope.…”

Section: A Threat Model and Assumptionsmentioning

confidence: 99%

Exploring eFPGA-based Redaction for IP Protection

Bhandari¹,

Moosa²,

Tan³

et al. 2021

Preprint

View full text Add to dashboard Cite

Recently, eFPGA-based redaction has been proposed as a promising solution for hiding parts of a digital design from untrusted entities, where legitimate end-users can restore functionality by loading the withheld bitstream after fabrication. However, when deciding which parts of a design to redact, there are a number of practical issues that designers need to consider, including area and timing overheads, as well as security factors. Adapting an open-source FPGA fabric generation flow, we perform a case study to explore the trade-offs when redacting different modules of open-source intellectual property blocks (IPs) and explore how different parts of an eFPGA contribute to the security. We provide new insights into the feasibility and challenges of using eFPGA-based redaction as a security solution.

show abstract

“…4) Optical Resolution: The optical resolution of laserassisted side-channel techniques has been discussed extensively by the research community in numerous publications, e.g., in [4], [21], [45]- [48]. Nonetheless, we discuss the most important and new insights in the following.…”

Section: B Applicability Of Llsimentioning

confidence: 99%

Trojan Awakener: Detecting Dormant Malicious Hardware Using Laser Logic State Imaging

Krachenfels¹,

Seifert²,

Tajik³

2021

Preprint

Self Cite

View full text Add to dashboard Cite

The threat of hardware Trojans (HTs) and their detection is a widely studied field. While the effort for inserting a Trojan into an application-specific integrated circuit (ASIC) can be considered relatively high, especially when trusting the chip manufacturer, programmable hardware is vulnerable to Trojan insertion even after the product has been shipped or during usage. At the same time, detecting dormant HTs with small or zero-overhead triggers and payloads on these platforms is still a challenging task, as the Trojan might not get activated during the chip verification using logical testing or physical measurements. In this work, we present a novel Trojan detection approach based on a technique known from integrated circuit (IC) failure analysis, capable of detecting virtually all classes of dormant Trojans. Using laser logic state imaging (LLSI), we show how supply voltage modulations can awaken inactive Trojans, making them detectable using laser voltage imaging techniques. Therefore, our technique does not require triggering the Trojan. To support our claims, we present two case studies on 28 nm SRAM-and flash-based field-programmable gate arrays (FPGAs). We demonstrate how to detect with high confidence small changes in sequential and combinatorial logic as well as in the routing configuration of FPGAs in a non-invasive manner. Finally, we discuss the practical applicability of our approach on dormant analog Trojans in ASICs.

show abstract

The Key is Left under the Mat: On the Inappropriate Security Assumption of Logic Locking Schemes

Cited by 64 publications

References 27 publications

Not All Fabrics Are Created Equal: Exploring eFPGA Parameters For IP Redaction

Not All Fabrics Are Created Equal: Exploring eFPGA Parameters For IP Redaction

Exploring eFPGA-based Redaction for IP Protection

Trojan Awakener: Detecting Dormant Malicious Hardware Using Laser Logic State Imaging

Contact Info

Product

Resources

About