A redundancy pruning method for solving multi-value problem of bitstream mapping unit of FPGA device

Abstract

The application discloses a redundant pruning method for solving the multivalued problem of a bit stream mapping unit of an FPGA device, and relates to the field of hardware security. First, the FPGA bit stream file is parsed, the configuration option set is extracted, and the configuration option set is subjected to module division. Second, the circuit model of each site module is restored according to the logic unit configuration resource, and the network connection relationship between the modules is established. Third, the redundant modules caused by the unit multivalued problem are finely pruned based on the connection between the modules. Specifically, the upstream and downstream connection conditions of the modules and the overall connection relationship of the cascaded modules are judged, and it is ensured that only necessary functional modules are reserved. Finally, the pruned module set and the network connection are output, and the optimized parsing of the FPGA bit stream file is realized. The method effectively solves the redundancy caused by the unit multivalued problem in the FPGA bit stream file parsing process, improves the accuracy and efficiency of circuit restoration, and provides a new technical means for FPGA reverse engineering.

Description

Technical Field

[0001] This invention relates to the field of hardware security, and in particular to an efficient redundancy pruning method for addressing the problem of cell multi-values ​​caused by the multiplexing of control bits in the bit stream of FPGA design. Background Technology

[0002] Field-Programmable Gate Arrays (FPGAs) are widely used in civilian and military fields in my country due to their high flexibility, high integration, and high speed. However, FPGAs face increasingly serious security risks, and effective security protection measures are lacking at the user end. Therefore, to effectively investigate FPGA security risks from the user end, it is necessary to first reverse engineer the FPGA bitstream file and then perform security analysis on the reverse-generated netlist file. However, during FPGA design, due to resource reuse and optimization strategies, the Multi-Value One-Element (MVOE) problem may occur, where one configuration bit corresponds to multiple device states, making it difficult to accurately determine whether a module is actually used. This problem poses a significant challenge to FPGA bitstream reverse engineering.

[0003] In 2012, Benz et al. proposed an FPGA reverse engineering toolchain called BIL. By combining a mapping database of FPGA configurable points with a database of FPGA structural information, it extracts and reverse-engineers bitstream control bits. Experiments showed that this tool was effective on AMD Xilinx Virtex-5 chips, but could only reverse-engineer some circuit modules. In 2014, Chemerisinov proposed an automated bitstream reverse engineering tool, DAT, for Xilinx FPGAs, but this tool did not cover the reverse engineering of on-chip network resources.

[0004] In 2021, Yu et al. studied the bitstream mapping relationship of AMD Xilinx's Artix-7 FPGA chip, although they only reverse engineered a small number of components, such as the 3-bit adder. In 2022, Yao Rui et al. from Nanjing University of Aeronautics and Astronautics proposed a method for resolving the mapping relationship between FPGA bitstream configuration data and underlying resource units. This method models the mapping relationship between FPGA bitstream configuration data and logic units and establishes a device model parameter library.

[14] In 2023, Zhang et al. proposed a new reverse engineering tool for FPGA bitstream formats, BitFREE, which makes the analysis and processing of FPGA bitstream files more efficient.

[0005] In summary, although existing research has enabled the reverse engineering of various AMD Xilinx FPGA chips (Spartan-3, Spartan-6, Virtex-2, Virtex-5, and Artix-7, etc.) and Microsemi FPGA chips, these studies mostly focus on the reverse engineering of partial resources or circuit modules. They often fail to cover various configurations in large-scale complex designs, and there are few verification results for large-scale samples with multi-valued cells, meaning the multi-valued cell problem has not been effectively solved. Summary of the Invention

[0006] This invention proposes an efficient redundancy trimming method to solve the problem of multi-valued cells in FPGA bitstream reverse engineering. This method addresses the difficulty in accurately determining the usage status of circuit modules caused by multi-valued cells in existing technologies. Compared to existing technologies, this method does not rely on complex algorithms or manual intervention, is applicable to various FPGA reverse engineering scenarios, and allows researchers to achieve efficient and accurate circuit module reconstruction and optimization under simple experimental conditions, thus providing effective support for FPGA bitstream file resource analysis and security assessment.

[0007] This invention first parses the FPGA bitstream file, extracts the set of configuration options, and divides it into modules. Second, it reconstructs the circuit model of each site module based on the configuration resources of the logic units and establishes network connections between modules. Third, it performs fine-tuning of redundant modules caused by multi-valued units based on the connectivity between modules. Specifically, by judging the upstream and downstream connections of modules and the overall connection relationship of cascaded modules, it ensures that only necessary functional modules are retained. Finally, it outputs the pruned module set and network connections, achieving optimized parsing of the FPGA bitstream file. This method effectively solves the redundancy caused by multi-valued units during FPGA bitstream file parsing, improves the accuracy and efficiency of circuit reconstruction, and provides a new technical means for FPGA reverse engineering.

[0008] Depend on Figure 1 As can be seen, the redundancy trimming method for solving the multi-value problem of FPGA reverse cells requires the following 7 steps, each of which corresponds to the number in the figure.

[0009] The technical solution of this invention is a redundancy pruning method to solve the multi-value problem of bitstream mapping units in FPGA devices. This method is implemented under the condition that a bitstream mapping database for the target FPGA chip has already been established. The steps of this method include:

[0010] Step 1: Parse the bitstream file and extract the configuration options;

[0011] Step 2: Divide the configuration option set P into modules;

[0012] The FPGA chip is divided into several tiles in the form of a two-dimensional matrix. These tiles are arranged in a grid and connected to each other by wires. Inside each tile, there are several logical resource units (Sites).

[0013] Step 3: Traverse P plp,j Generate the corresponding circuit module set R;

[0014] Step 4: Build R j Network connections between them;

[0015] When the circuit module set of all Sites R j After being generated, the resource configuration set P is configured using the connection. pip Further reconstruct the network connectivity between sites; P pip It contains configurable interconnection point information between tiles, which is obtained by recursively searching for P layer by layer from the output or input connection of each site. pip Using fixed connection resources, a global network connection relationship between sites is constructed using a depth-first search algorithm, and a circuit connection graph G is generated. The circuit connection graph G includes circuit modules R. j Internal connections and R j The connections between circuit modules are shown in (11), where N represents the set of nodes, corresponding to all circuit modules r. jk E represents the set of connection relationships, defining the connection structure between modules;

[0016] G={Ν,E} (11)

[0017] Step 5: Traverse R j The tag module r in jk ', perform redundant pruning;

[0018] Step 6: Determine if all circuit module sets R have been traversed. j If yes, then the process ends; otherwise, continue to step 5.

[0019] Step 7: Finally, obtain the circuit after redundancy processing.

[0020] Furthermore, the specific method for step 1 is as follows:

[0021] Step 1.1: Extract the set of reversed bits B by parsing the bitstream file, where B = {b1, b2, ..., b} N}, each element b i This indicates the specific bits in the bitstream file;

[0022] Step 1.2: By searching the FPGA bitstream mapping database, convert B into a set of configuration options P used by the chip, as shown in Equation (1); set P contains all active programmable options in the target FPGA chip, where p i Indicates the usage status of a specific resource;

[0023] P = {p1, p2, ..., p} i ,...,p W} , 1≤i≤W (1).

[0024] Furthermore, the specific method for step 2 is as follows:

[0025] Step 2.1: Divide the configuration option set P into two types of resources: programmable interconnect resources PIP and logic unit configuration resources PLP, as shown in equation (2); use P pip P represents the set of inter-tile interconnect resources used by the chip. plp This represents the set of site-specific logic unit configurations used by the chip;

[0026] P = P pip ∪P plp (2)

[0027] Step 2.2: Set P pip and P plp Further division;

[0028] First, using Tile blocks as units, P pip Divide into several Tile subsets P pip,i See equation (3); where P pip,i Let Tile represent the set of connected resources of the i-th Tile block, satisfying equation (4). i (p) indicates the tile to which the configuration option p belongs;

[0029]

[0030] Secondly, using Site as the unit, P plp Divide into several Site subsets P plp,j See equation (5); where P plp,j Let the set of logical unit configurations of the j-th Site block satisfy equation (6). j (p) indicates the Site to which the configuration option p belongs;

[0031]

[0032] Furthermore, the specific method for step 3 is as follows:

[0033] Iterate through each P plp,jP plp,j For the configuration options corresponding to the j-th site, the set of circuit modules R for that site is restored based on the configuration options used, as shown in equation (7); where R j Let r represent the set of circuit modules of the j-th site, as shown in equation (8). jk R represents j The k-th basic circuit module;

[0034] R = {R1, R2, ..., R} j ,...,R M} 1≤j≤M (7)

[0035] R j ={r j1 ,r j2 ,...,r jk ,...,r jT 1≤k≤T (8)

[0036] Where M represents the total number of logic resource modules and T represents the total number of basic circuit modules;

[0037] In the generation circuit module set R j During the process, when the specific status of a device cannot be determined based on existing information, the configuration option is defaulted to being in a used state, meaning all possible circuit modules are considered active to ensure the integrity of circuit functionality, and it is marked as r. jk See equations (9) and (10);

[0038] R' j ={r' jk ∈R j |r' jk For the marker unit} (9)

[0039] R' j ={r' j1 ,r' j2 ,...,r' jk ,...,r' jS} 1≤k≤S (10)

[0040] S represents the total number of devices whose specific status cannot be determined based on the available information.

[0041] Furthermore, the specific method for step 5 is as follows:

[0042] Step 5.1: For R j Each tag module r in jk ', get all those that have passed through r jk The set of pathways E jk See equation (12), where el Indicates after r jk The lth pathway;

[0043] E jk ={e1,e2,...,e l ,...,e Q} 1≤l≤Q (12)

[0044] Where Q represents the total number of pathways;

[0045] Step 5.2: Traverse through r jk All pathways of ', determine in e l on r jk Does it belong to a cascaded module?

[0046] If it belongs to a cascade module, then obtain the set C of cascade modules on this path, as shown in equation (13); treat the set C of cascade modules as a whole; determine whether C has both upstream and downstream connections. If there are upstream and downstream connections, then mark r. jk 'To retain module r jk save If C has no upstream or downstream connection, it is not retained and the traversal of the next path of the module continues.

[0047] C={r ju ,r j(u+1) ,...r jk ,...,r jv} (u≤k≤v) (13)

[0048] If it does not belong to a cascaded module, determine the r jk 'Whether there are both upstream and downstream connections. If there are both upstream and downstream connections, mark r.' jk 'To reserve module r jk save If there is no upstream or downstream connection, no retention is made, and the traversal of the next path of the module continues;

[0049] Step 5.3: If there exists a path containing module r jk save Then retain module r jk save If r has been traversed jk If all paths are unmarked after checking all paths, then remove r. jk '; When R has been traversed j All r in jk After that, we obtain the set of modules after redundancy trimming.

[0050] This invention proposes a redundancy pruning method to address the multi-value problem in FPGA cells. Aiming to improve the accuracy and efficiency of FPGA circuit structure reconstruction, this method targets redundant modules introduced by the multi-value problem. It employs a combination of hierarchical analysis and global path connectivity judgment to effectively identify and remove invalid modules. By parsing bitstream configuration options and recovering the network of circuit modules, combined with the redundancy pruning algorithm, the functional integrity and logical correctness of the retained modules are ensured. This invention significantly reduces redundant interference during circuit reconstruction, improves the accuracy of module partitioning and the availability of network connections, and provides reliable technical support for the accurate reconstruction of complex FPGA circuits. Attached Figure Description

[0051] Figure 1 This is a flowchart of the overall method of the present invention.

[0052] Figure 2 This is a flowchart of the redundancy pruning algorithm of the present invention. Detailed Implementation

[0053] This invention employs the methods described in the invention to conduct experiments on Xilinx Spartan3 series models xc3s200ft256-5, xc3s200aft256-5, and xc3s250etq144-5; Spartan6 series model xc6slx9ftg256-2; Virtex-5 series model xc5vlx50tff1136-1; and Artix-7 series model xc7a200tffg1156-3. Circuit samples from the ISCAS'85 standard test set were selected for the experiments, and reverse engineering and redundancy pruning algorithms were performed on the aforementioned target chips. The table below records the time cost of the entire reverse engineering process. The success of the reverse engineering result is verified by comparing the netlist functionality before and after reverse engineering, and the number of circuit modules before and after redundancy pruning is also counted. Experimental results show that this invention can effectively solve the problem of multi-valued cells and significantly reduce redundant modules. Meanwhile, it was verified that the circuit function of the reverse restoration was consistent with the original design, proving that the method optimized the circuit while ensuring functional integrity, thus verifying its efficiency and reliability.

[0054] Table 1. Pruning results of the embodiments

[0055]

Claims

1. A redundancy pruning method for solving the multi-value problem of bitstream mapping units in FPGA devices, wherein the method is implemented on the condition that a bitstream mapping database of the target FPGA chip has been established, and the method includes the following steps: Step 1: Parse the bitstream file and extract the configuration options; Step 2: Divide the configuration option set P into modules; The FPGA chip is divided into several tiles in the form of a two-dimensional matrix. These tiles are arranged in a grid and connected to each other by wires. Inside each tile, there are several logical resource units (Sites). Step 3: Iterate through the configuration options P of the j-th site. plp,j Generate the corresponding circuit module set R; Step 4: Construct the set R of circuit modules for the j-th site. j Network connections between them; When the circuit module set of all Sites R j After being generated, the resource configuration set P is configured using the connection. pip Further reconstruct the network connectivity between sites; P pip It contains configurable interconnection point information between tiles, which is obtained by recursively searching for P layer by layer from the output or input connection of each site. pip Using fixed connection resources, a global network connection relationship between sites is constructed using a depth-first search algorithm, and a circuit connection graph G is generated. The circuit connection graph G includes circuit modules R. j Internal connections and R j The connections between circuit modules are shown in (11), where N represents the set of nodes, corresponding to all circuit modules r. jk E represents the set of connection relationships, r jk R represents j The k-th basic circuit module defines the connection structure between modules; G={Ν,E} (11) Step 5: Traverse R j The tag module r in jk Redundancy pruning is performed; in the generated circuit module set R j During the process, when the specific status of a device cannot be determined based on existing information, the configuration option is defaulted to being in a used state, meaning all possible circuit modules are considered active to ensure the integrity of circuit functionality, and it is marked as r. jk '; Step 6: Determine if all circuit module sets R have been traversed. j If yes, then the process ends; otherwise, continue to step 5. Step 7: Finally, obtain the circuit after redundancy processing.

2. The redundancy trimming method for solving the multi-value problem of bitstream mapping units in FPGA devices as described in claim 1, characterized in that, The specific method for step 1 is as follows: Step 1.1: Extract the set of reversed bits B by parsing the bitstream file, where B = {b1, b2, ..., b} N }, each element b i This indicates the specific bits in the bitstream file; Step 1.2: By searching the FPGA bitstream mapping database, convert B into a set of configuration options P used by the chip, as shown in Equation (1); set P contains all active programmable options in the target FPGA chip, where p i Indicates the usage status of a specific resource; P={p1,p2,...,p i ,...,p W },1≤i≤W (1)。 3. The redundancy trimming method for solving the multi-value problem of bitstream mapping units in FPGA devices as described in claim 1, characterized in that, The specific method for step 2 is as follows: Step 2.1: Divide the configuration option set P into two types of resources: programmable interconnect resources PIP and logic unit configuration resources PLP, as shown in equation (2); use P pip P represents the set of inter-tile interconnect resources used by the chip. plp This represents the set of site-specific logic unit configurations used by the chip; P=P pip ∪P plp (2) Step 2.2: Set P pip and P plp Further division; First, using Tile blocks as units, P pip Divide into several Tile subsets P pip,i See equation (3); where P pip,i Let Tile represent the set of connected resources of the i-th Tile block, satisfying equation (4). i (p) indicates the tile to which the configuration option p belongs; Secondly, using Site as the unit, P plp Divide into several Site subsets P plp,j See equation (5); where P plp,j Let the set of logical unit configurations of the j-th Site block satisfy equation (6). j (p) indicates the Site to which the configuration option p belongs; 4. The redundancy trimming method for solving the multi-value problem of bitstream mapping units in FPGA devices as described in claim 1, characterized in that, The specific method for step 3 is as follows: Iterate through each P plp,j P plp,j For the configuration options corresponding to the j-th site, the set of circuit modules R for that site is restored based on the configuration options used, as shown in equation (7); where R j Let r represent the set of circuit modules of the j-th site, as shown in equation (8). jk R represents j The k-th basic circuit module; R={R1,R2,...,R j ,...,R M } 1≤j≤M (7) R j ={r j1 ,r j2 ,...,r jk ,...,r jT } 1≤k≤T (8) Where M represents the total number of logic resource modules and T represents the total number of basic circuit modules; In the generation circuit module set R j During the process, when the specific status of a device cannot be determined based on existing information, the configuration option is defaulted to being in a used state, meaning all possible circuit modules are considered active to ensure the integrity of circuit functionality, and it is marked as r. jk See equations (9) and (10); R' j ={r' jk ∈R j |r' jk For the marker unit} (9) R' j ={r' j1 ,r' j2 ,...,r' jk ,...,r' jS } 1≤k≤S (10) S represents the total number of devices whose specific status cannot be determined based on the available information.

5. The redundancy trimming method for solving the multi-value problem of bitstream mapping units in FPGA devices as described in claim 1, characterized in that, The specific method for step 5 is as follows: Step 5.1: For R j Each tag module r in jk ', get all those that have passed through r jk The set of pathways E jk See equation (12), where e l Indicates after r jk The lth pathway; THE jk ={e1,e2,...,e l ,...,the Q } 1≤l≤Q (12) Where Q represents the total number of pathways; Step 5.2: Traverse through r jk All pathways of ', determine in e l on r jk Does it belong to a cascaded module? If it belongs to a cascade module, then obtain the set C of cascade modules on this path, as shown in equation (13); treat the set C of cascade modules as a whole; determine whether C has both upstream and downstream connections. If there are upstream and downstream connections, then mark r. jk 'To reserve module r jk save If C has no upstream or downstream connection, it is not retained and the traversal of the next path of the module continues. C={r ju ,r j(u+1) ,...r jk ,...,r jv } (u≤k≤v) (13) If it does not belong to a cascaded module, determine the r jk 'Whether there are both upstream and downstream connections. If there are both upstream and downstream connections, mark r.' jk 'To reserve module r jk save If there is no upstream or downstream connection, no retention is made, and the traversal of the next path of the module continues; Step 5.3: If there exists a path containing module r jk save Then retain module r jk save If r has been traversed jk If all paths are unmarked after checking all paths, then remove r. jk '; When R has been traversed j All r in jk After that, we obtain the set of modules after redundancy trimming.

Images