Introduction

Layout-level gate camouflaging has attracted interest as a countermeasure against reverse engineering of combinational logic. In order to minimize area overhead, typically only a subset of gates in a circuit is camouflaged, and each camouflaged gate layout can implement a few different logic functions. The security of camouflaging relies on the difficulty of learning the overall combinational logic function without knowing which logic functions the camouflaged gates implement.

In this work, we present an incremental-SAT approach to reconstruct the logic function of a circuit with camouflaged gates. Our algorithm uses the standard attacker model in which an adversary knows only the non-camouflaged gate functions, and has the ability to query the circuit to learn the correct output vector for any input vector. Our results demonstrate a 5x speedup over the best known existing deobfuscation algorithm.
Beyond demonstrating speedup, we use our powerful approach to produce new insights about the strength of obfuscation. First we show that deobfuscation is feasible even in the more challenging setting where layout reveals nothing about the possible logic function of camouflaged gates. Additionally, selectively camouflaging gates to maximize output corruption under incorrect deobfuscation hypotheses typically reduces the number of vectors needed to deobfuscate the circuit.

Publications

• Duo Liu, Cunxi Yu, Xiangyu Zhang, Daniel E. Holcomb: Oracle-guided incremental SAT solving to reverse engineer camouflaged logic circuits. DATE 2016: 433-438. Dresden, Germany, March,2016. (DATE'16)

• Cunxi Yu, Xiangyu Zhang, Duo Liu, Maciej Ciesielski, Daniel Holcomb. Incremental SAT-based Reverse Engineering of Camouflaged Logic Circuits. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems. (TCAD'16)
  

Tool

Our tool is implemented using C/C++ (g++ 4.9 required). It has been tested on Ubuntu-64bit system.

• Source code : Click here to download the source code (zip file). Or check the source code online.

  • User Mnaual

• Benchmarks:

  • 1) NAND-NOR-XOR Camouflaging
  • 2) Fully Camouflaging.