If you are interested to be involved in one of my research topics as part of your Bachelor Thesis, Master Thesis or research internship, feel free to contact me.
The aim of sequential gate-level netlist reverse engineering is to identify and extract the control logic out of a gate-level design netlist. Thereto, first, the registers have to be classified into state and data registers, i.e. registers which belong to the control logic and registers which do not belong to the control logic. The identified state registers are then used as a starting point to extract the finite state machine (FSM) [1]. The extraction of the control logic might support an attacker to retrieve secret design information or enable product piracy. Therefore, a number of sequential locking techniques, like for example Harpoon [2], are already developed which aim to obfuscate FSMs and prevent control logic extraction. Usually, a secret locking key has to be applied such that the correct FSM behavior is achieved.
In this work, first an already existing tool of the Neta toolset [3] for inserting a sequential locking scheme should be applied and analyzed. Possible helper tools to make the usage of the existing tool easier and more generally applicable should be developed. Finally, a concept for an automatic insertion of different sequential locking methods should be determined and implemented.
References: [1] McElvain, K. S. Methods and apparatuses for automatic extraction of finite state machines Google Patents, 2001 [2] Chakraborty, R. S. & Bhunia, S. HARPOON: an obfuscation-based SoC design methodology for hardware protection IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, IEEE, 2009, 28, 1493-1502 [3] Meade, T.; Portillo, J.; Zhang, S. & Jin, Y. NETA: when IP fails, secrets leak Proceedings of the 24th Asia and South Pacific Design Automation Conference, 2019, 90-95
Voraussetzungen
Basic knowledge in the synthesis flow
Interested in graph theory and automata theory
Kontakt
Michaela Brunner, M.Sc.
Technical University of Munich, Chair of Security in Information Technology
The aim of sequential gate-level netlist reverse engineering is to identify and extract the control logic out of a gate-level design netlist. Thereto, first, the registers have to be classified into state and data registers, i.e. registers which belong to the control logic and registers which do not belong to the control logic. The identified state registers are then used as a starting point to extract the finite state machine (FSM) [1]. The extraction of the control logic might support an attacker to retrieve secret design information or enable product piracy. Therefore, a number of sequential locking techniques, like for example Harpoon [2], are already developed which aim to obfuscate FSMs and prevent control logic extraction. Usually, a secret locking key has to be applied such that the correct FSM behavior is achieved.
In this work, first an already existing tool of the Neta toolset [3] for inserting a sequential locking scheme should be applied and analyzed. Possible helper tools to make the usage of the existing tool easier and more generally applicable should be developed. Finally, a concept for an automatic insertion of different sequential locking methods should be determined and implemented.
References: [1] McElvain, K. S. Methods and apparatuses for automatic extraction of finite state machines Google Patents, 2001 [2] Chakraborty, R. S. & Bhunia, S. HARPOON: an obfuscation-based SoC design methodology for hardware protection IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, IEEE, 2009, 28, 1493-1502 [3] Meade, T.; Portillo, J.; Zhang, S. & Jin, Y. NETA: when IP fails, secrets leak Proceedings of the 24th Asia and South Pacific Design Automation Conference, 2019, 90-95
Voraussetzungen
Basic knowledge in the synthesis flow
Interested in graph theory and automata theory
Kontakt
Michaela Brunner, M.Sc.
Technical University of Munich, Chair of Security in Information Technology
Zhang, G. L. and Li, B. and Li, M. and Yu, B. and Pan, D. Z. and Brunner, M. and Sigl, G. and Schlichtmann, U.: TimingCamouflage+: Netlist Security Enhancement with Unconventional Timing. IEEE Transactions on Computer-Aided Design of Integrated
Circuits and Systemsde
IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems
, 2020, 1-1 mehr…BibTeX
Zhang, G. L. and Brunner, M. and Li, B. and Sigl, G.and Schlichtmann, U.: Timing Resilience for Efficient and Secure Circuits. 2020 25th Asia and South Pacific Design Automation Conference (ASP-DAC), 2020Beijing, China, 623-628 mehr…BibTeX
2019
Brunner, M. and Baehr, J. and Sigl, G.: Improving on State Register Identification in Sequential Hardware Reverse Engineering. 2019 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), 2019Washington, D.C., USAmehr…BibTeX
