Xueyan Wang

Secure and Low-Overhead Circuit Obfuscation Technique with Multiplexers

Circuit obfuscation techniques have been proposed to conceal circuits functionality in order to thwart reverse engineering (RE) attacks to integrated circuits (IC). We believe that a good obfuscation method should have low design complexity and low performance overhead, yet, causing high RE attack complexity. However, existing obfuscation techniques do not meet all these requirements. In this paper, we propose a polynomial obfuscation scheme which leverages special designed multiplexers (MUXs) to replace judiciously selected logic gates. Candidate to-be-obfuscated logic gates are selected based on a novel gate classification method which utilizes IC topological structure information. We show that this scheme is resilient to all the known attacks, hence it is secure. Experiments are conducted on ISCAS 85/89 and MCNC benchmark suites to evaluate the performance overhead due to obfuscation.

An accurate detailed routing routability prediction model in placement

Routability is one of the primary objectives in placement. There have been many researches on forecasting routing problems and improving routability in placement but no perfect solution is found. Most traditional routability-driven placers aim to improve global routing result, but true routability lies in detailed routing. Predicting detailed routing routability in placement is extremely difficult due to the complexity and uncertainty of routing. In this paper, we propose a new detailed routing routability prediction model based on supervised learning. After extracting key features in placement and detailed routing, multivariate adaptive regression is performed to train the connection between these two stages. Using a well-trained model, most design rule violations after detailed routing can be foreseen in placement stage. Experiments show that our average prediction accuracy is 79.8%, which is comparable with other state-of-art routability estimation techniques.

Gate Camouflaging-Based Obfuscation

Circuit camouflaging is a layout-level technique to protect VLSI design from being attacked by reverse engineering. It hides design information by configurable logic units that can be configured to perform different functionalities with identical looks to the attackers. In this chapter, after introducing the primitive for gate camouflaging-based obfuscation, we analyze its vulnerability to one specific attack based on circuit partitioning. We then elaborate this attack and discuss two practical countermeasure methods. We explain that the security of gate camouflaging-based obfuscation not only depends on the number of gates being obfuscated, but also which gates we select for obfuscation and the number of different functionalities these gates can implement. As an example, we show how to perform a multiplexer-based gate camouflaging.

An Efficient Technique to Reverse Engineer Minterm Protection Based Camouflaged Circuit

Integrated circuit (IC) camouflaging technique has been applied as a countermeasure against reverse engineering (RE). However, its effectiveness is threatened by a boolean satisfiability (SAT) based de-camouflaging attack, which is able to restore the camouflaged circuit within only minutes. As a defense to the SAT-based de-camouflaging attack, a brand new camouflaging strategy (called CamoPerturb) has been proposed recently, which perturbs one minterm by changing one gate’s functionality and then restores the perturbed circuit with a separated camouflaged block, achieving good resistance against the SAT-based attack. In this paper, we analyze the security vulnerabilities of CamoPerturb by illustrating the mechanism of minterm perturbation induced by gate replacement, then propose an attack to restore the changed gate’s functionality, and recover the camouflaged circuit. The attack algorithm is facilitated by sensitization and implication principles in automatic test pattern generation (ATPG) techniques. Experimental results demonstrate that our method is able to restore the camouflaged circuits with very little time consumption.

Spear and Shield: Evolution of Integrated Circuit Camouflaging

Intellectual property (IP) protection is one of the hardcore problems in hardware security. Semiconductor industry still lacks effective and proactive defense to shield IPs from reverse engineering (RE) based attacks. Integrated circuit (IC) camouflaging technique fills this gap by replacing some conventional logic gates in the IPs with specially designed logic cells (called camouflaged gates) without changing the functions of the IPs. The camouflaged gates can perform different logic functions while maintaining an identical look to RE attackers, thus preventing them from obtaining the layout information of the IP directly from RE tools. Since it was first proposed in 2012, circuit camouflaging has become one of the hottest research topics in hardware security focusing on two fundamental problems. How to choose the types of camouflaged gates and decide where to insert them in order to simultaneously minimize the performance overhead and optimize the RE complexity? How can an attacker de-camouflage a camouflaged circuit and complete the RE attack? In this article, we review the evolution of circuit camouflaging through this spear and shield race. First, we introduce the design methods of four different kinds of camouflaged cells based on true/dummy contacts, static random access memory (SRAM), doping, and emerging devices, respectively. Then we elaborate four representative de-camouflaging attacks: brute force attack, IC testing based attack, satisfiability-based (SAT-based) attack, and the circuit partition based attack, and the corresponding countermeasures: clique-based camouflaging, CamoPerturb, AND-tree camouflaging, and equivalent class based camouflaging, respectively. We argue that the current research efforts should be on reducing overhead introduced by circuit camouflaging and defeating de-camouflaging attacks. We point out that exploring features of emerging devices could be a promising direction. Finally, as a complement to circuit camouflaging, we conclude with a brief review of other state-of-the-art IP protection techniques.

Cell spreading optimization for force-directed global placers

Wirelength is a traditional optimization objective in global placement algorithms. To eliminate cell overlaps, spreading forces need to be added to pull cells away from highly congested areas. At the same time, to optimize wirelength, the quadratic nature should be maintained. In this paper, several techniques are proposed to optimize spreading force orientation and modulation. Specifically, a percentage-driven method is proposed to cluster overfilled bins, followed by a center-uniformization algorithm to demarcate the expand region for the cluster. Finally, cells are distributed evenly within each expand region while maintaining relative cell positions and minimizing cell displacements. Experimental results show that the global placer that integrated with the proposed strategies achieves 13.0% and 2.1% less wirelength compared with Capo10.5 and Aplace3, respectively.

An Empirical Study on Gate Camouflaging Methods Against Circuit Partition Attack

Gate camouflaging has emerged as a leading proactive countermeasure for reverse engineering (RE) attacks. However, a recently proposed circuit partition attack (CPA) can significantly reduce the complexity of revealing the original design from a camouflaged circuit. In this paper, we first conduct an empirical study on how CPA can facilitate the state-of-the-art de-camouflaging methods to perform more efficient attacks. We then study how an equivalent class guided camouflaging approach may thwart these de-camouflaging attempts and re-establish the defense against RE. Experimental results demonstrate that (1) CPA is an effective pre-processing technique to boost de-camouflaging methods, and (2) Equivalent class guided camouflaging technique is resilient against the union of CPA and existing de-camouflaging methods.