Any type of engineered design requires metrics for trading off both desirable and undesirable properties. For integrated circuits, typical properties include circuit size, performance, power, etc., where for example, performance is a desirable property and power consumption is not. Security metrics, on the other hand, are extremely difficult to develop because there are active adversaries that intend to compromise the protected circuitry. This implies metric values may not be static quantities, but instead are measures that degrade depending on attack effectiveness. In order to deal with this dynamic aspect of a security metric, a general attack model is proposed that enables the effectiveness of various security approaches to be directly compared in the context of an attack. Here, we describe, define and demonstrate that the metrics presented are both meaningful and measurable.

Recent reports indicate that existing fault models and test metrics result in substantial manufacturing test escapes that cause major system-level challenges such as silent data corruption resulting from incorrect computations. Such test escapes are often detected today after system deployment (e.g., in the field) using a variety of synthetic and application workloads. In this work, a new test metric is investigated for detecting defects that escape existing test approaches. PEPR (Pseudo-Exhaustive Physically-Aware Region) testing comprehensively analyzes both the physical layout and the logic netlist to identify single- or multi- output sub-circuits. The resulting sub-circuits are exhaustively tested to detect timing-independent combinational (TIC) defects. Analyses demonstrate that PEPR-based scan tests detect TIC defects perfectly (100%) when examining fail data from over 30,000 14nm failing chips. In contrast, existing fault models and test metrics might result in up to 95 % of TIC defects being detected fortuitously. Strategies for addressing increased test pattern count resulting from the pseudo-exhaustive nature of PEPR testing are also discussed.

—Integrated circuits (ICs) are the foundation of all computing systems. They comprise high-value hardware intellectual property (IP) that are at risk of piracy, reverse- engineering, and modifications while making their way through the geographically-distributed IC supply chain. On the frontier of hardware security are various design-for-trust techniques that claim to protect designs from untrusted entities across the design flow. In this work, we review and reflect on the emergence of logic locking, a technique that promises protection from the gamut of threats to the IC manufacturing supply-chain. We perform a critical review of logic locking techniques in the literature, and expose several shortcomings. Taking inspiration from other cybersecurity competitions, we devise a community- led benchmarking exercise to address the evaluation deficiencies. In reflecting on this process, we shed new light on deficiencies in evaluation of logic locking and reveal potential future directions. The lessons learned can guide future endeavors in other areas of hardware security.

The outsourcing of portions of the integrated circuit design chain, mainly fabrication, to untrusted parties has led to an increasing concern regarding the security of fabricated ICs. To mitigate these concerns a number of approaches have been developed, including logic locking. The development of different logic locking methods has influenced research looking at different security evaluations, typically aimed at uncovering a secret key. In this paper, we make the case that corruptibility for incorrect keys is an important metric of logic locking. To measure corruptibility for circuits too large to exhaustively simulate, we describe an ATPG-based method to measure the corruptibility of incorrect keys. Results from applying the method to various circuits demonstrate that this method is effective at measuring the corruptibility for different locks.

The outsourcing of the design and manufacturing of integrated circuits (IC) involves various untrusted entities, which can pose many security threats such as overproduction of ICs, sale of out-of-specification/rejected ICs, and piracy of Intellectual Properties (IPs). As a result, various design-for-trust techniques have been developed. Logic locking has recently gained significant interest from the research community due to its capability to provide defense against the threats from untrusted manufacturing. In logic locking, the original circuit is locked using a secret key to make it into a key-dependent circuit. However, various attacks on the extraction of secret keys associated with locking have undermined the security of logic locking techniques. Even after a decade of research, the security of logic locking is still under risk as none of the countermeasures can simultaneously provide resiliency against different attacks, such as tampering, probing, and oracle or oracle-less attacks. This paper presents an overview of novel attacks on logic locking apart from SAT-based analysis. We will present three different techniques to break a secure lock, and they are hardware Trojan based attacks, optical probing based attacks, and the ATPG oriented attacks.

Integrated circuits (ICs) are the foundation of all computing systems. They comprise high-value hardware intellectual property (IP) that are at risk of piracy, reverse-engineering, and modifications while making their way through the geographically-distributed IC supply chain. On the frontier of hardware security are various design-for-trust techniques that claim to protect designs from untrusted entities across the design flow. Logic locking is one technique that promises protection from the gamut of threats in IC manufacturing. In this work, we perform a critical review of logic locking techniques in the literature, and expose several shortcomings. Taking inspiration from other cybersecurity competitions, we devise a community-led benchmarking exercise to address the evaluation deficiencies. In reflecting on this process, we shed new light on deficiencies in evaluation of logic locking and reveal important future directions. The lessons learned can guide future endeavors in other areas of hardware security.

Hardware security-related threats such as the insertion of malicious circuits, overproduction, and reverse engineering are of increasing concern in the IC industry. To mitigate these threats, various design-for-trust techniques have been developed, including sequential logic locking. Sequential logic locking protects a non-scanned design by employing a key-controlled entrance FSM, key-controlled transitions, or a combination of both techniques. Current methods for characterizing (attacking) the security of sequentially locked circuits do not have the scalability to be applicable to modern circuits. In addition, current methods often require the use of an oracle, which is a working, unlocked circuit that is assumed to be fully initializable and controllable. In this work, an oracle-free, ATPG-based approach is proposed for characterizing the security of a locked sequential circuit. This method is of several in a tool box called CLIC-A (Characterization of Locked ICs via ATPG). Experiments using CLIC-A demonstrate it is effective at recovering the key sequence from various sequentially locked circuits that have been locked using different locking methods.

Threats to integrated circuits exist due to the outsourcing of IC design and fabrication to third parties. As a result, various design-for-trust techniques have been developed including logic locking. Current methods of characterizing the security of logic locking require multiple tools and expertise for the various locking types now in existence. In this paper, we propose an ATPG-based toolbox called CLIC-A (Characterization of Locked Integrated Circuits via ATPG) that can be used to determine the level of security effectiveness for a given instance of a locked circuit. Experiments demonstrate that CLIC-A is effective across a multitude of locking methods.