Effectiveness of Adversarial Component Recovery in Protected Netlist Circuit Designs

Hardware security has become a concern as the risk of intellectual property (IP) theft, malicious alteration, and counterfeiting has increased. Malicious reverse engineering is a common tool used to achieve such goals; thus, the need arises to quantify effectiveness and limits of both circuit protection techniques and adversarial analysis tools. Aspects of physical reverse engineering are well studied and these techniques result in netlist extraction that details gate-level information from an integrated circuit (IC) artifact. Specification recovery from the netlist is a harder problem with more open research questions. In this paper, we focus on the more narrow question of how to recover design-level logic components that were used to build an IC. Such analysis assumes the library of known component building blocks can be identified and that an adversary has successfully accomplished netlist extraction. Likewise, techniques exist to harden IC's against reverse engineering through obfuscating transformations, particularly those that target component hiding. We report results of a case study analysis that compares effectiveness of component hiding algorithms against adversarial recovery approaches. As a contribution, we delineate six new approaches for subcircuit enumeration that extend a known algorithm for enumerating candidate components, seeking to improve number of potential candidates in obfuscated circuits. Our study examines algorithm performance in terms of ability to correctly identify original components and analysis time overhead. The study uses four different obfuscation approaches that target component hiding in a set of four benchmark circuits with well defined building blocks. Results indicate that all four hiding approaches are effective at increasing analysis run-time when algorithmic component identification is used, and two of the four were able to hide 95% of original components from our seven studied algorithms.