| Title | Is Robust Design-for-Security Robust Enough? Attack on Locked Circuits with Restricted Scan Chain Access |
| Publication Type | Conference Paper |
| Year of Publication | 2019 |
| Authors | Limaye, Nimisha, Sengupta, Abhrajit, Nabeel, Mohammed, Sinanoglu, Ozgur |
| Conference Name | 2019 IEEE/ACM International Conference on Computer-Aided Design (ICCAD) |
| Keywords | ATPG, benchmark circuits, Boolean functions, Boolean satisfiability based attack, Chained Attacks, computability, cryptography, IP piracy, locked circuits, logic circuits, logic locking, logic locking attacks, logic locking security, pubcrawl, Resiliency, restricted scan chain access, robust design-for-security architecture, robust DFS design, robust DFS technique, SAT attack, Scalability, scan chain, secret key recovery, security analysis, unauthorized scan access, working chip |
| Abstract | The security of logic locking has been called into question by various attacks, especially a Boolean satisfiability (SAT) based attack, that exploits scan access in a working chip. Among other techniques, a robust design-for-security (DFS) architecture was presented to restrict any unauthorized scan access, thereby, thwarting the SAT attack (or any other attack that relies on scan access). Nevertheless, in this work, we successfully break this technique by recovering the secret key despite the lack of scan access. Our security analysis on a few benchmark circuits protected by the robust DFS architecture demonstrates the effectiveness of our attack; on average 95% of the key bits are correctly recovered, and almost 100% in most cases. To overcome this and other prevailing attacks, we propose a defense by making fundamental changes to the robust DFS technique; the new defense can withstand all logic locking attacks. We observe, on average, lower area overhead ( 1.65%) than the robust DFS design ( 5.15%), and similar test coverage ( 99.88%). |
| DOI | 10.1109/ICCAD45719.2019.8942047 |
| Citation Key | limaye_is_2019 |
Is Robust Design-for-Security Robust Enough? Attack on Locked Circuits with Restricted Scan Chain Access