Aric Fowler
University of Texas at Dallas, Richardson, TX, USA

Shayan Mohammed
University of Texas at Dallas, Richardson, TX, USA

Mustafa Shihab
University of Texas at Dallas, Richardson, TX, USA

Thomas Broadfoot
University of Texas at Dallas, Richardson, TX, USA

Peter Beerel
University of Southern California, Los Angeles, CA, USA

Carl Sechen
University of Texas at Dallas, Richardson, TX, USA

Yiorgos Makris
University of Texas at Dallas, Richardson, TX, USA

Keywords: Logic Redaction, SAT Attack, TRAP

Abstract

Locking-based intellectual property (IP) protection for integrated circuits (ICs) being manufactured at untrusted facilities has been largely defeated by the satisfiability (SAT) attack, which can retrieve the secret key needed for instantiating proprietary functionality on locked circuits. As a result, redaction-based methods have gained popularity as a more secure way of protecting hardware IP. Among these methods, transistor-level programming (TRAP) prohibits the outright use of SAT attacks due to the mismatch between the logic-level at which SAT attack operates and the switch-level at which the TRAP fabric is programmed. Herein, we discuss the challenges involved in launching SAT attacks on TRAP and we propose solutions which enable expression of TRAP in propositional logic modeling in a way that accurately reflects switch-level circuit capabilities. Results obtained using a transistor-level SAT attack tool-set that we developed and are releasing corroborate that SAT attacks can be launched against TRAP. However, the increased complexity of switch-level circuit modeling prevents the attack from realistically compromising all but the most trivial IP-protected designs.