skip to main content
research-article

AFIA: ATPG-Guided Fault Injection Attack on Secure Logic Locking

Published: 01 October 2022 Publication History

Abstract

The outsourcing of the design and manufacturing of integrated circuits has raised severe concerns about the piracy of Intellectual Properties and illegal overproduction. Logic locking has emerged as an obfuscation technique to protect outsourced chip designs, where the circuit netlist is locked and can only be functional once a secure key is programmed. However, Boolean Satisfiability-based attacks have shown to break logic locking, simultaneously motivating researchers to develop more secure countermeasures. In this paper, we present a novel fault injection-based attack to break any locking technique that relies on a stored secret key, and denote this attack as AFIA, ATPG-guided Fault Injection Attack. The proposed attack is based on sensitizing a key bit to the primary output while injecting faults at a few other key lines that block the propagation of the targeted key bit. AFIA is very effective in determining a key bit as there exists a stuck-at fault pattern that detects a stuck-at 1 (or stuck-at 0) fault at any key line. The average complexity of the number of injected faults for AFIA is linear with the key size K and requires only K test patterns to determine a secret key K. AFIA requires fewer injected faults to sensitize a bit to the primary output, compared to 2K-1 faults for the differential fault analysis attack illustrated in our previous work.

References

[1]
Alkabani Y, Koushanfar F (2007) Active hardware metering for intellectual property protection and security. In: USENIX Security Symposium, pp 291–306
[2]
Alrahis L, Patnaik S, Khalid F, Hanif MA, Saleh H, Shafique M, Sinanoglu O (2021a) GNNUnlock: Graph Neural Networks-based Oracle-less Unlocking Scheme for provably secure logic locking. In: 2021 Design, Automation & Test in Europe Conference & Exhibition (DATE), IEEE, pp 780–785
[3]
Alrahis L, Patnaik S, Knechtel J, Saleh H, Mohammad B, Al-Qutayri M, and Sinanoglu O UNSAIL: Thwarting oracle-less machine learning attacks on logic locking IEEE Trans Inf Forensics and Secur 2021 16 2508-2523
[4]
Alrahis L, Yasin M, Limaye N, Saleh H, Mohammad B, Alqutayri M, Sinanoglu O (2019) ScanSAT: Unlocking static and dynamic scan obfuscation. Trans Emerg Topics Computing 9(4):1867-1882
[5]
Azar KZ, Kamali HM, Homayoun H, Sasan A (2019) SMT attack: Next generation attack on obfuscated circuits with capabilities and performance beyond the SAT attacks. In: IACR Transactions on Cryptographic Hardware and Embedded Systems, pp 97–122
[6]
Azar KZ, Kamali HM, Homayoun H, and Sasan A From cryptography to logic locking: a survey on the architecture evolution of secure scan chains IEEE Access 2021 9 73133-73151
[7]
Azar KZ, Kamali HM, Roshanisefat S, Homayoun H, Sotiriou CP, Sasan A (2021b) Data flow obfuscation: a new paradigm for obfuscating circuits. IEEE Trans Very Large Scale Integr Syst 29(4):643–656
[8]
Barenghi A, Bertoni GM, Breveglieri L, Pellicioli M, Pelosi G (2010) Low voltage fault attacks to AES. In: International Symposium on Hardware-Oriented Security and Trust (HOST), pp 7–12
[9]
Barenghi A, Bertoni GM, Breveglieri L, Pelosi G (2013) A fault induction technique based on voltage underfeeding with application to attacks against AES and RSA. J Syst Softw 1864–1878
[10]
Barenghi A, Breveglieri L, Koren I, Naccache D (2012) Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures. Proceedings of the IEEE, pp 3056–3076
[11]
Baumgarten A, Tyagi A, and Zambreno J Preventing IC piracy using reconfigurable logic barriers IEEE Des Test Comput 2010 27 1 66-75
[12]
Beerel P, Georgiou M, Hamlin B, Malozemoff AJ, Nuzzo P (2022) Towards a formal treatment of logic locking. Cryptology ePrint Archive
[13]
Blömer J, Seifert JP (2003) Fault based cryptanalysis of the advanced encryption standard (AES). In: International Conference on Financial Cryptography, Springer, pp 162–181
[14]
Boneh D, DeMillo RA, Lipton RJ (1997) On the importance of checking cryptographic protocols for faults. In: International Conference on the Theory and Applications of Cryptographic Techniques, pp 37–51
[15]
Bushnell ML, Agrawal VD (2004) Essentials of electronic testing for digital, memory and mixed-signal VLSI circuits, Frontiers in Electronic Testing Series Volume 17. Springer Science & Business Media
[16]
Canivet G, Maistri P, Leveugle R, Clédière J, Valette F, Renaudin M (2011) Glitch and laser fault attacks onto a secure AES implementation on a SRAM-based FPGA. J Cryptol 247–268
[17]
Castillo E, Meyer-Baese U, García A, Parrilla L, Lloris A (2007) IPP@HDL: Efficient intellectual property protection scheme for IP cores. IEEE Trans VLSI (TVLSI) 578–591
[18]
Chakraborty RS, Bhunia S (2008) Hardware protection and authentication through netlist level obfuscation. In: Proceedings of IEEE/ACM International Conference on Computer-Aided Design, pp 674–677
[19]
Charbon E (1998) Hierarchical watermarking in IC design. In: Proceedings of the IEEE Custom Integrated Circuits Conference, pp 295–298
[20]
Cormen T, Leiserson C, Rivest R, and Stein C Introduction to algorithms 2009 Computer Science MIT Press
[21]
Dehbaoui A, Dutertre JM, Robisson B, Tria A (2012) Electromagnetic transient faults injection on a hardware and a software implementations of AES. In: Workshop on Fault Diagnosis and Tolerance in Cryptography, pp 7–15
[22]
Dusart P, Letourneux G, Vivolo O (2003) Differential fault analysis on AES. In: International Conference on Applied Cryptography and Network Security, pp 293–306
[23]
Duvalsaint D, Jin X, Niewenhuis B, Blanton R (2019a) Characterization of locked combinational circuits via ATPG. In: IEEE International Test Conference (ITC), pp 1–10
[24]
Duvalsaint D, Liu Z, Ravikumar A, Blanton RD (2019b) Characterization of locked sequential circuits via ATPG. In: 2019 IEEE International Test Conference in Asia (ITC-Asia), IEEE, pp 97–102
[25]
Dworkin MJ, Barker EB, Nechvatal JR, Foti J, Bassham LE, Roback E, Dray Jr JF (2001) Advanced Encryption Standard (AES). NIST Publication Series: Federal Information Processing Standards (NIST FIPS)-197, pp 1–51
[26]
El Massad M, Garg S, Tripunitara M (2017) Reverse engineering camouflaged sequential circuits without scan access. In: 2017 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), IEEE, pp 33–40
[27]
Fukunaga T, Takahashi J (2009) Practical fault attack on a cryptographic LSI with ISO/IEC 18033-3 block ciphers. In: Workshop on Fault Diagnosis and Tolerance in Cryptography, pp 84–92
[28]
Guilley S, Sauvage L, Danger JL, Selmane N, Pacalet R (2008) Silicon-level solutions to counteract passive and active attacks. In: Workshop on Fault Diagnosis and Tolerance in Cryptography, pp 3–17
[29]
Guin U, Shi Q, Forte D, Tehranipoor MM (2016) FORTIS: a comprehensive solution for establishing forward trust for protecting IPs and ICs. ACM Transactions on Design Automation of Electronic Systems (TODAES), p 63
[30]
Guin U, Zhou Z, Singh A (2017) A novel Design-for-Security (DFS) architecture to prevent unauthorized IC overproduction. In: VLSI Test Symposium (VTS), pp 1–6
[31]
Guin U, Zhou Z, Singh A (2018) Robust Design-for-Security architecture for enabling trust in IC manufacturing and test. Transactions on Very Large Scale Integration (VLSI) Systems, pp 818–830
[32]
Hsueh MC, Tsai TK, Iyer RK (1997) Fault injection techniques and tools. Computer 30(4):75–82
[33]
Jain A, Rahman T, Guin U (2020) ATPG-guided fault injection attacks on logic locking. In: IEEE Physical Assurance and Inspection of Electronics (PAINE), pp 1–6
[34]
Jain A, Zhou Z, and Guin U TAAL: tampering attack on any key-based logic locked circuits ACM Trans Des Automation Electronic Syst 2021 26 4 1-22
[35]
Jarvis RW, McIntyre MG (2007) Split manufacturing method for advanced semiconductor circuits. US Patent 7,195,931
[36]
Kahng AB, Lach J, Mangione-Smith WH, Mantik S, Markov IL, Potkonjak M, Tucker P, Wang H, Wolfe G (2001) Constraint-based watermarking techniques for design IP protection. IEEE Transactions on CAD of Integrated Circuits and Systems, pp 1236–1252
[37]
Kamali HM, Azar KZ, Gaj K, Homayoun H, Sasan A (2018) LUT-Lock: a novel LUT-based logic obfuscation for FPGA-Bitstream and ASIC-Hardware protection. In: 2018 IEEE Computer Society Annual Symposium on VLSI (ISVLSI), IEEE, pp 405–410
[38]
Kamali HM, Azar KZ, Homayoun H, Sasan A (2019) Full-lock: Hard distributions of sat instances for obfuscating circuits using fully configurable logic and routing blocks. In: Proceedings of the 56th Annual Design Automation Conference 2019, pp 1–6
[39]
Kamali HM, Azar KZ, Homayoun H, Sasan A (2020) Interlock: an intercorrelated logic and routing locking. In: 2020 IEEE/ACM International Conference On Computer Aided Design (ICCAD), IEEE, pp 1–9
[40]
Kamali HM, Azar KZ, Farahmandi F, Tehranipoor M (2022) Advances in logic locking: Past, present, and prospects. Cryptology ePrint Archive
[41]
Karmakar R, Chatopadhyay S, Kapur R (2018) Encrypt flip-flop: a novel logic encryption technique for sequential circuits. arXiv preprint: arXiv:1801.04961
[42]
Lee CY, Xie J (2019) High capability and low-complexity: Novel fault detection scheme for finite field multipliers over gf (2 m) based on mspb. In: 2019 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), IEEE, pp 21–30
[43]
Lee J, Tebranipoor M, Plusquellic J (2006) A low-cost solution for protecting IPs against scan-based side-channel attacks. In: 24th IEEE VLSI Test Symposium, IEEE, p 6
[44]
Limaye N, Sengupta A, Nabeel M, Sinanoglu O (2019) Is robust Design-for-Security robust enough? Attack on locked circuits with restricted scan chain access. arXiv preprint: arXiv:1906.07806
[45]
Paar C, Pelzl J (2009) Understanding cryptography: a textbook for students and practitioners. Springer Science & Business Media
[47]
Piret G, Quisquater JJ (2003) A differential fault attack technique against SPN structures, with application to the AES and KHAZAD. In: International Workshop on Cryptographic Hardware and Embedded Systems, pp 77–88
[48]
Pouget V, Douin A, Lewis D, Fouillat P, Foucard G, Peronnard P, Maingot V, Ferron J, Anghel L, Leveugle R et al (2007) Tools and methodology development for pulsed laser fault injection in SRAM-based FPGAs. In: Latin-American Test Workshop (LATW)
[49]
Qu G, Potkonjak M (2007) Intellectual property protection in VLSI designs: Theory and practice. Springer Sc. & Business Media
[50]
Rahman MS, Guo R, Kamali HM, Rahman F, Farahmandi F, Abdel-Moneum M (2022) O’Clock: Lock the clock via clock-gating for SoC IP protection. In: Design Automation Conf. (DAC), pp 1–6
[51]
Rahman MS, Nahiyan A, Rahman F, Fazzari S, Plaks K, Farahmandi F, Forte D, and Tehranipoor M Security assessment of dynamically obfuscated scan chain against oracle-guided attacks ACM Trans Des Automation Electronic Syst 2021 26 4 1-27
[52]
Rahman MT, Asadizanjani N (2019) Backside security assessment of modern SoCs. In: International Workshop on Microprocessor/SoC Test, Security and Verification (MTV), pp 18–24
[53]
Rahman MT, Rahman MS, Wang H, Tajik S, Khalil W, Farahmandi F, Forte D, Asadizanjani N, and Tehranipoor M Defense-in-depth: a recipe for logic locking to prevail Integration 2020 72 39-57
[54]
Rahman MT, Tajik S, Rahman MS, Tehranipoor M, Asadizanjani N (2020) The key is left under the mat: on the inappropriate security assumption of logic locking schemes. In: 2020 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), IEEE, pp 262–272
[55]
Rajendran J, Pino Y, Sinanoglu O, Karri R (2012) Security analysis of logic obfuscation. In: Proceedings of Annual Design Automation Conference, pp 83–89
[56]
Rajendran J, Zhang H, Zhang C, Rose GS, Pino Y, Sinanoglu O, Karri R (2015) Fault analysis-based logic encryption. IEEE Transactions on Computers, pp 410–424
[57]
Rajski J, Tyszer J, Kassab M, and Mukherjee N Embedded deterministic test IEEE Trans Comput Aided Des Integr Circ Syst 2004 23 5 776-792
[58]
Roshanisefat S, Mardani Kamali H, Sasan A (2018) SRCLock: SAT-Resistant cyclic logic locking for protecting the hardware. In: Proceedings of 2018 Great Lakes Symposium on VLSI, pp 153–158
[59]
Roy JA, Koushanfar F, Markov IL (2008) EPIC: Ending Piracy of Integrated Circuits. In: Proceedings of the Conference on Design, Automation and Test in Europe, pp 1069–1074
[60]
Roy JA, Koushanfar F, Markov IL (2010) Ending piracy of integrated circuits. Computer 30–38
[61]
Salmani H, Tehranipoor M, Trust-Hub [Online]. Available: https://trust-hub.org/home. Accessed 25 Sep 2022
[62]
Savir J and Patil S Broad-side delay test IEEE Trans Comput Aided Des Integr Circ Syst 1994 13 8 1057-1064
[63]
Schmidt JM, Hutter M (2007) Optical and EM fault-attacks on CRT-based RSA: Concrete results
[64]
Selmane N, Guilley S, Danger JL (2008) Practical setup time violation attacks on AES. In: Seventh European Dependable Computing Conference, pp 91–96
[65]
Selmke B, Heyszl J, Sigl G (2016) Attack on a DFA protected AES by simultaneous laser fault injections. In: Workshop on Fault Diagnosis and Tolerance in Cryptography, pp 36–46
[66]
Sengupta A, Ashraf M, Nabeel M, Sinanoglu O (2018a) Customized locking of IP blocks on a Multi-Million-Gate SoC. In: International Conference on Computer-Aided Design (ICCAD), pp 1–7
[67]
Sengupta A, Nabeel M, Yasin M, Sinanoglu O (2018b) ATPG-based cost-effective, secure logic locking. In: VLSI Test Symposium (VTS), pp 1–6
[68]
Sengupta A, Nabeel M, Limaye N, Ashraf M, and Sinanoglu O Truly stripping functionality for logic locking: a fault-based perspective IEEE Trans Comput Aided Des Integr Circ Syst 2020 39 12 4439-4452
[70]
Shakya B, Xu X, Tehranipoor M, Forte D (2020) Cas-lock: a security-corruptibility trade-off resilient logic locking scheme. IACR Transactions on Cryptographic Hardware and Embedded Systems, pp 175–202
[71]
Shamsi K, Li M, Plaks K, Fazzari S, Pan DZ, Jin Y (2019a) IP protection and supply chain security through logic obfuscation: a systematic overview. ACM Transactions on Design Automation of Electronic Systems (TODAES) 24(6):1–36
[72]
Shamsi K, Pan DZ, Jin Y (2019b) IcySAT: Improved SAT-based attacks on cyclic locked circuits. In: 2019 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), IEEE, pp 1–7
[73]
Shamsi K, Pan DZ, Jin Y (2019c) On the impossibility of approximation-resilient circuit locking. In: 2019 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), IEEE, pp 161–170
[74]
Shannon CE Communication theory of secrecy systems Bell Syst Tech J 1949 28 4 656-715
[75]
Shen H, Asadizanjani N, Tehranipoor M, Forte D (2018) Nanopyramid: an optical scrambler against backside probing attacks. In: Proceedings on International Symposium for Testing and Failure Analysis (ISTFA), p 280
[76]
Sirone D and Subramanyan P Functional analysis attacks on logic locking IEEE Trans Inf Forensics Secur 2020 15 2514-2527
[77]
Sisejkovic D, Merchant F, Reimann LM, Leupers R (2021) Deceptive logic locking for hardware integrity protection against machine learning attacks. IEEE Trans Comput Aided Des Integr Circ Syst pp 1-14
[78]
Skarin D, Barbosa R, Karlsson J (2010) GOOFI-2: a tool for experimental dependability assessment. In: IEEE/IFIP International Conference on Dependable Systems & Networks (DSN), pp 557–562
[79]
Skorobogatov S (2010) Optical fault masking attacks. In: Workshop on Fault Diagnosis and Tolerance in Cryptography, pp 23–29
[80]
Skorobogatov SP, Anderson RJ (2002) Optical fault induction attacks. In: International Workshop on Cryptographic Hardware and Embedded Systems, pp 2–12
[81]
Subramanyan P, Ray S, Malik S (2015) Evaluating the security of logic encryption algorithms. In: IEEE International Symposium on Hardware Oriented Security and Trust (HOST), pp 137–143
[82]
Sweeney J, Zackriya VM, Pagliarini S, Pileggi L (2020) Latch-based logic locking. In: 2020 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), IEEE, pp 132–141
[83]
Synopsys (2021a) Design compiler graphical: Create a better starting point for faster physical implementation. https://www.synopsys.com/implementation-and-signoff/rtl-synthesis-test/design-compiler-graphical.html
[85]
Tehranipoor M, Wang C (2011) Introduction to hardware security and trust. Springer Science & Business Media
[87]
Torrance R, James D (2009) The state-of-the-art in IC reverse engineering. In: International Workshop on Cryptographic Hardware and Embedded Systems, pp 363–381
[88]
Tsai T, Iyer R (1995) FTAPE - a fault injection tool to measure fault tolerance. In: Computing in Aerospace Conference, p 1041
[89]
Vashistha N, Lu H, Shi Q, Rahman MT, Shen H, Woodard DL, Asadizanjani N, Tehranipoor M (2018) Trojan scanner: Detecting hardware trojans with rapid SEM imaging combined with image processing and machine learning. In: Proceedings on International Symposium for Testing and Failure Analysis, p 256
[90]
Wang X, Zhang D, He M, Su D, Tehranipoor M (2018) Secure scan and test using obfuscation throughout supply chain. Transactions on Computer-Aided Design of Integrated Circuits and Systems 37(9):1867–1880
[91]
Wu H, Ferranti D, Stern L (2014) Precise nanofabrication with multiple ion beams for advanced circuit edit. Microelectron Reliab 1779–1784
[92]
Xie Y, Srivastava A (2016) Anti-SAT: Mitigating SAT attack on logic locking. In: International Conference on Cryptographic Hardware and Embedded Systems, pp 127–146
[93]
Xie Y, Srivastava A (2017) Delay locking: Security enhancement of logic locking against IC counterfeiting and overproduction. In: Proceedings of the 54th Annual Design Automation Conference, pp 1–6
[94]
Xie Y and Srivastava A Anti-SAT: Mitigating SAT attack on logic locking IEEE Trans Comput Aided Des Integr Circ Syst 2019 38 2 199-207
[96]
Yasin M, Mazumdar B, Rajendran JJ, Sinanoglu O (2016a) SARLock: SAT attack resistant logic locking. In: IEEE International Symposium on Hardware Oriented Security and Trust (HOST), pp 236–241
[97]
Yasin M, Rajendran JJ, Sinanoglu O, Karri R (2016b) On improving the security of logic locking. Transactions on Computer-Aided Design of Integrated Circuits and Systems 35(9):1411–1424
[98]
Yasin M, Sengupta A, Nabeel MT, Ashraf M, Rajendran JJ, Sinanoglu O (2017) Provably-secure logic locking: from theory to practice. In: Proceedings of ACM SIGSAC Conference on Computer and Communications Security, pp 1601–1618
[99]
Yeh A (2012) Trends in the global IC design service market. DIGITIMES Research
[100]
Zhang J, Yuan F, Wei L, Liu Y, Xu Q (2015) VeriTrust: Verification for Hardware Trust. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems 34(7):1148–1161
[101]
Zhang Y, Cui P, Zhou Z, Guin U (2019) TGA: an oracle-less and topology-guided attack on logic locking. In: Proceedings of the 3rd ACM Workshop on Attacks and Solutions in Hardware Security Workshop, pp 75–83
[102]
Zhang Y, Jain A, Cui P, Zhou Z, Guin U (2020) A novel topology-guided attack and its countermeasure towards secure logic locking. J Cryptogr Eng 1–14
[103]
Zhong Y, Guin U (2022) Complexity analysis of the SAT attack on logic locking. arXiv preprint: arXiv:2207.01808

Cited By

View all

Index Terms

  1. AFIA: ATPG-Guided Fault Injection Attack on Secure Logic Locking
        Index terms have been assigned to the content through auto-classification.

        Recommendations

        Comments

        Information & Contributors

        Information

        Published In

        cover image Journal of Electronic Testing: Theory and Applications
        Journal of Electronic Testing: Theory and Applications  Volume 38, Issue 5
        Oct 2022
        107 pages

        Publisher

        Kluwer Academic Publishers

        United States

        Publication History

        Accepted: 03 October 2022
        Published: 01 October 2022
        Received: 10 June 2022

        Author Tags

        1. Logic locking
        2. Differential fault analysis
        3. Fault injection
        4. IP Piracy
        5. IC overproduction

        Qualifiers

        • Research-article

        Contributors

        Other Metrics

        Bibliometrics & Citations

        Bibliometrics

        Article Metrics

        • Downloads (Last 12 months)0
        • Downloads (Last 6 weeks)0
        Reflects downloads up to 04 Jan 2025

        Other Metrics

        Citations

        Cited By

        View all

        View Options

        View options

        Media

        Figures

        Other

        Tables

        Share

        Share

        Share this Publication link

        Share on social media