A method for cracking an integrated circuit encryption circuit state machine

Abstract

The application belongs to the technical field of integrated circuits, and discloses a cracking method of an integrated circuit encryption circuit state machine, which comprises the following steps: 1, applying excitation to a netlist to extract information; 2, regarding the process of solving a key as a process of state machine reconstruction, and converting the problem into a constraint programming problem; 3, if the number of keys solved by the CP-SAT solver is 1, the attack is ended, and the unique correct key is obtained, otherwise, timing equivalence checking is performed by using Synopsys VC Formal SEQ Application, and further incorrect keys are excluded in combination with Oracles until the unique correct key or multiple equivalent keys are obtained. The attack duration of the application mainly depends on the size of the state machine and the inherent jump relationship in the state machine, and the attack time is short and the efficiency is high.

Description

Technical Field

[0001] The present invention belongs to the technical field of integrated circuits, and in particular relates to a method for cracking an integrated circuit encryption circuit state machine. Background Art

[0002] In recent years, many methods of encrypting circuits have emerged to protect the intellectual property rights of integrated circuits. Figure 1 As shown, these methods control the behavior of the circuit by taking the key as an additional input of the circuit; and introduce tamper-proof memory and use it as the physical medium for storing the key to ensure the security of the key storage, that is, the key cannot be read directly from the memory.

[0003] Finite state machines (FSMs) are one of the most common structures in sequential circuits. Consequently, numerous circuit encryption methods have been developed. For example, some states and transitions are added before the state machine's true reset state, ensuring that only a specific input sequence can cause the circuit to operate properly. This sequence is considered a key. Another example is adding an error state and a transition relationship between it and the normal state, ensuring that the circuit will operate properly only when the key is correct.

[0004] For encrypted sequential circuits, attacks typically require a combination of an encrypted netlist and an activated chip. The latter is primarily used to obtain input-output pairs (oracles) to eliminate incorrect keys. A more common attack method is sequential circuit unfolding. By unfolding the sequential circuit according to clock cycles, the circuit is modeled as a combinational circuit and further converted into a Boolean satisfiability problem and fed into the solver. Since a single solver iteration can only eliminate two incorrect keys at most, and the number of clock cycles required for unfolding is unknown, the solver's computational scale increases as the number of unfolded clock cycles increases, resulting in low solution efficiency. Other attack methods generally target the characteristics of the encryption method itself, cracking it by studying its coverage, structure, and netlist traces.

[0005] JANUS-HD is a newly proposed method for circuit encryption using a state machine. It divides the reachable states in the state machine into groups D and T, and uses XOR logic in the code to modify the sub-states of all states in group T: if state A belongs to group T and the original sub-state is B, the modified sub-state is A^B. Figure 2 As shown, the gray represents the T group state and the state transition relationship that needs to be modified. The modified encryption state machine is as follows Figure 3 As shown, states 11 and 13 are unreachable states in the circuit before encryption.

[0006] If B is a next state of A, that is, there is a state transition relationship A→B, then it is outgoing for A and incoming for B, and the type of this transition relationship is defined by A: if A belongs to group D, it is called a D-type transition relationship, otherwise it is a T-type transition relationship. If a state receives an incoming state that is not in the same group as itself, it is an entry state. When encoding, it must meet the condition that the Hamming distance with the key is a specific value h. This type of encoding is also called on-set encoding, such as Figure 2 The reachable states in the other state machines cannot satisfy the requirement of a Hamming distance h from the key. This type of encoding is also called off-set encoding. Specifically, the value of h is the minimum value that provides sufficient on-set encoding.

[0007] To ensure the normal operation of the state machine, JANUS-HD introduces a configuration signal controlled by the current state and a key. It only flips at the entry state to meet the following characteristics: if the current state belongs to group D, the value of the configuration signal is 0, also known as D-type configuration; if the current state belongs to group T, the value of the configuration signal is 1, also known as T-type configuration.

[0008] Because JANUS-HD uses as little on-set coding as possible, which weakens the solver's pruning capabilities, and the configurations between states are independent of each other, there is currently no effective cracking method for it. The cracking complexity using existing methods is equivalent to traversing the state machine, which is particularly difficult for large circuits. Summary of the Invention

[0009] The purpose of the present invention is to provide a method for cracking the state machine of an integrated circuit encryption circuit to solve the above-mentioned technical problems.

[0010] To solve the above technical problems, the specific technical solution of the method for cracking the integrated circuit encryption circuit state machine of the present invention is as follows:

[0011] A method for cracking an integrated circuit encryption circuit state machine comprises the following steps:

[0012] Step 1: Apply stimulus to the netlist and extract information;

[0013] Step 2: The key-solving process is considered as a state machine reconstruction process, and this problem is transformed into a constraint programming problem. By converting the obtained encryption state machine into a matrix and converting its structural characteristics on the state machine into constraints, the CP-SAT solver is iteratively called to obtain all potential correct keys.

[0014] Step 3: If the number of keys solved by the CP-SAT solver is 1, the attack ends and a unique correct key is obtained. Otherwise, use the Synopsys VC Formal SEQ Application to perform timing equivalence checks and combine Oracles to further eliminate incorrect keys until a unique correct key or multiple equivalent keys are obtained.

[0015] Furthermore, the information extracted in step 1 includes the encryption state machine under the D-type configuration, the reset state of the state machine, the Hamming distance value h, and the configuration signal reset value. The encryption state machine under the T-type configuration is derived from the encryption state machine under the D-type configuration, that is, the next state of all states is modified to be exclusive-OR with the current state.

[0016] Furthermore, the method of converting the encryption state machine in step 2 into a matrix includes the following steps:

[0017] The size of the matrix is ​​n*n, where n=2^(number of DFFs). For an encryption state machine consisting of 4 flip-flops, a 16*16 matrix needs to be created. If FSM[i][j]=1, it means that there is a connection relationship from state i to state j in the state machine; if FSM[i][j]=0, it means there is no connection relationship. If the FSM is large, compress the FSM matrix and store it. For any state, only its next state is recorded.

[0018] Furthermore, the method of converting the structural characteristics into constraints in step 2 includes the following steps:

[0019] Step 2.1: Create variables to indicate whether each state is reachable, whether it belongs to group D or group T, and whether it is an entry state. Create variables to indicate the potential correct key. Use five Boolean variables: U, D, T, E, K, where U represents unreachable, D and T represent group D and group T states, E represents entry state, and K represents the potential correct key.

[0020] Step 2.2: Add constraints based on the clues.

[0021] Furthermore, the clues of step 2.2 include:

[0022] 1) Determine whether the state machine reset state belongs to group D or group T based on the reset value of the configuration signal. If the reset value is 0, it belongs to group D, otherwise it belongs to group T;

[0023] 2) The entry state receives an input that does not belong to the same group as itself;

[0024] 3) Each state receives only one type of input, but can send outbound traffic to states in the same group or to the entry state of another group;

[0025] 4) Under asynchronous reset, the reset state is not an entry;

[0026] 5) Among the reachable states, only the encoding of the entry state belongs to the on-set, and the Hamming distance between the entry states is between 2 and 2*h;

[0027] 6) The number of entry states is greater than the number of on-set codes provided by h-1, but not greater than the number of on-set codes provided by h;

[0028] 7) The number of unreachable states is greater than the number of remaining on-set codes, and all the next states are real states;

[0029] 8) In a D-type configuration, both the unreachable state and the reachable state receiving T-type incoming traffic may be unreachable. Once they are reachable, the incoming traffic must not come from the D-group state, and only the T-group state will be transmitted to the unreachable state;

[0030] 9) In a T-type configuration, both the unreachable state and the reachable state receiving D-type input may be unreachable. Once they are reachable, the input must not come from the T-group state, and the T-group state will not be transmitted to the unreachable state;

[0031] 10) After the state machine is rebuilt according to the state attribute allocation, except for the reset state, all D group and T group states are reachable, and other states are unreachable, and there is a key derived from them.

[0032] Furthermore, the method of iteratively calling the solving tool CP-SAT solver in step 2 includes: each time the CP-SAT solver is called, only one feasible solution is obtained, the corresponding key is recorded, and a new constraint is added so that the same key cannot be derived in subsequent feasible solutions.

[0033] Furthermore, the method for checking the timing equivalence in step 3 includes the following steps:

[0034] Instantiate two identical netlists and set the key to different values. Run Synopsys VC Formal SEQApplication. If the two netlists are completely consistent, keep any key and compare it with other keys. If the two netlists are inconsistent, apply the same stimulus as the returned input sequence to the chip, observe the chip output, and compare it with the output of the two netlists to eliminate the incorrect key. Repeat this process until multiple equivalent keys are obtained or only one key remains.

[0035] The method for cracking an integrated circuit encryption circuit state machine of the present invention has the following advantages:

[0036] First, unlike other attack methods, the attack duration of the present invention mainly depends on the scale of the state machine and its internal inherent jump relationship, and secondly on the overall scale of the circuit.

[0037] Second, since the model built by the CP-SAT solver cannot exceed 2GB, the number of triggers contained in the solvable state machine cannot exceed 12.

[0038] Third, when the number of unreachable states in a state machine is not much greater than the number of reachable states, in most cases CP-SAT only returns the correct solution. Even if it includes an incorrect solution, there is generally only one. If the number of unreachable states in a state machine is much greater than the number of reachable states (which usually occurs in the scenario of one-hot encoding), due to the sparsity of the internal connections of the state machine, the number of incorrect keys contained in the solution returned by CP-SAT may increase, but generally does not exceed 30, even for a state machine with 12 triggers.

[0039] Fourth, when running CP-SAT with four CPUs, for state machines with no more than 11 flip-flops, the solution can be completed within an hour, or even within seconds or minutes; otherwise, it takes up to 4 hours.

[0040] Fifth, when the number of keys returned by CP-SAT is n>1, temporal equivalence checks need to be performed pairwise, and the number of oracles used is less than n-1.

[0041] Sixth, the time required for timing equivalence checking is related to the number of keys returned by CP-SAT and the scale of the circuit. Verifying the consistency of two equivalent small-scale circuits generally takes only a few minutes, while a large-scale circuit may take hours. For two unequal circuits, the completion time will be faster, depending on the different keys. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 Encrypt the schematic diagram for the circuit;

[0043] Figure 2 Schematic diagram of the original state machine; key=6 or 12, h=1;

[0044] Figure 3 This is a diagram of the encryption state machine under the D-type configuration;

[0045] Figure 4 This is a schematic diagram of the encryption state machine under the T-type configuration;

[0046] Figure 5 This is the attack flow chart of the present invention;

[0047] Figure 6 Schematic diagram of the FSM matrix of the present invention. DETAILED DESCRIPTION

[0048] In order to better understand the purpose, structure and function of the present invention, the following is a further detailed description of a method for cracking an integrated circuit encryption circuit state machine of the present invention in conjunction with the accompanying drawings.

[0049] like Figure 5 As shown, a method for cracking an integrated circuit encryption circuit state machine of the present invention includes the following steps:

[0050] First, apply stimulus to the netlist to extract information, including: the encrypted state machine under the D-type configuration (such as Figure 3 ), the reset state of the state machine, the Hamming distance value h, the reset value of the configuration signal, etc. Note that the encryption state machine under the T-type configuration (such as Figure 4 ) can be derived from the encryption state machine in a D-type configuration, that is, the next state of each state is modified to be XOR with the current state. It can be found that the output of all D-group states is correct in the D-type configuration, and the output of T-group states is correct in the T-type configuration.

[0051] Second, we consider the key-solving process as a state machine reconstruction process and transform it into a constraint programming (CP) problem. By converting the resulting encryption state machine into a matrix and translating its structural properties into constraints, we iteratively call the CP-SAT solver to obtain all potential correct keys.

[0052] The method of converting the encryption state machine into a matrix includes the following steps:

[0053] The size of the matrix is ​​n*n, where n=2^(number of DFFs). Figure 3 The encryption state machine composed of 4 flip-flops needs to create a 16*16 matrix, as shown in Figure 6 As shown, for If FSM[i][j]=1, it means there is a connection from state i to state j in the state machine; if FSM[i][j]=0, it means there is no connection. In particular, if the FSM is large, the FSM matrix can be compressed and stored. For any state, only its next state is recorded. For example, FSM[0] can be changed to [0,5].

[0054] The method of converting structural characteristics into constraints includes the following steps:

[0055] First, create variables to indicate whether each state is reachable, whether it belongs to the D or T group, and whether it is an entry state. Additionally, create variables to indicate potentially correct keys. This method uses five Boolean variables: U, D, T, E, and K. U represents unreachable, D and T represent D and T group states, E represents an entry state, and K represents a potentially correct key.

[0056] Secondly, you need to add constraints based on the following clues:

[0057] 11) Determine whether the state machine reset state belongs to group D or group T based on the reset value of the configuration signal. If the reset value is 0, it belongs to group D, otherwise it belongs to group T;

[0058] 12) The entry state receives an input that does not belong to the same group as itself, such as Figure 2 States 4 and 14 in;

[0059] 13) Each state receives only one type of input, but can send outbound traffic to states in the same group or to the entry state of another group;

[0060] 14) Under asynchronous reset, the reset state is not an entry;

[0061] 15) Among the reachable states, only the encoding of the entry state belongs to the on-set, and the Hamming distance between the entry states is between 2 and 2*h;

[0062] 16) The number of entry states is greater than the number of on-set codes that h-1 can provide, but not greater than the number of on-set codes that h can provide;

[0063] 17) The number of unreachable states is greater than the number of remaining on-set codes, and all the next states are real states;

[0064] 18) In the D-type configuration, both the unreachable state and the reachable state receiving the T-type input may be unreachable, e.g. Figure 3 States 4 and 6 in , and once they are reachable, the incoming state must not come from the D group state. In particular, only the T group state will be transmitted to the unreachable state;

[0065] 19) In a T-type configuration, both the unreachable state and the reachable state receiving the D-type input may be unreachable, e.g. Figure 4 State 14 in , and once they are reachable, the incoming state must not come from the T group state, in particular, the T group state will not go out to the unreachable state;

[0066] 20) After the state machine is rebuilt according to the state attribute allocation, except for the reset state, all D group and T group states are reachable, and other states are unreachable, and there is a key derived from them.

[0067] The method of iteratively calling the CP-SAT solver includes: each time the CP-SAT solver is called, only one feasible solution is found, the corresponding key is recorded, and new constraints are added so that the same key cannot be derived in subsequent feasible solutions.

[0068] Third, if the number of keys solved by the CP-SAT solver is 1, the attack ends and a unique correct key is obtained. Otherwise, a timing equivalence check is performed using the Synopsys VC Formal SEQ Application, and Oracles are combined to further eliminate incorrect keys until a unique correct key or multiple equivalent keys are obtained.

[0069] The method for checking the timing equivalence includes the following steps:

[0070] Instantiate two identical netlists, set the key to different values, and run Synopsys VC Formal SEQApplication. If the two netlists are identical, retain any key and compare it with the other keys. If the two netlists are inconsistent, apply a stimulus to the chip that matches the input sequence returned, observe the chip output, and compare it with the output of the two netlists to eliminate the incorrect key. Repeat this process until multiple equivalent keys are obtained or only one key remains.

[0071] It will be understood that the present invention is described by way of some embodiments, and it will be appreciated by those skilled in the art that various changes or equivalent substitutions may be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, under the teachings of the present invention, these features and embodiments may be modified to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are intended to be protected by the present invention.

Claims

1. A method for cracking an integrated circuit encryption circuit state machine, characterized in that: The steps include: Step 1: Apply stimulus to the netlist and extract information; Step 2: The key-solving process is considered as a state machine reconstruction process, and this problem is transformed into a constraint programming problem. By converting the obtained encryption state machine into a matrix and converting its structural characteristics on the state machine into constraints, the CP-SAT solver is iteratively called to obtain all potential correct keys. Step 2.1: Create variables to indicate whether each state is reachable, whether it belongs to group D or group T, and whether it is an entry state. Create variables to indicate the potential correct key. Use five Boolean variables: U, D, T, E, K, where U represents unreachable, D and T represent group D and group T states, E represents entry state, and K represents the potential correct key. Step 2.2: Add constraints based on clues; The clues for step 2.2 include: 1) Determine whether the state machine reset state belongs to group D or group T based on the reset value of the configuration signal. If the reset value is 0, it belongs to group D, otherwise it belongs to group T. 2) The entry state receives an input that does not belong to the same group as itself; 3) Each state only receives one type of input, but can send outbound messages to states in the same group or to the entry state of another group; 4) Under asynchronous reset, the reset state is not an entry; 5) Among the reachable states, only the encoding of the entry state belongs to the on-set, and the Hamming distance between the entry states is between 2 and 2*h; 6) The number of entry states is greater than the number of on-set codes provided by h-1, but not greater than the number of on-set codes provided by h; 7) The number of unreachable states is greater than the number of remaining on-set codes, and all the next states are real states; 8) In a D-type configuration, both the unreachable state and the reachable state receiving T-type incoming traffic may be unreachable. Once they are reachable, the incoming traffic must not come from the D-group state, and only the T-group state will be transmitted to the unreachable state; 9) In a T-type configuration, both the unreachable state and the reachable state receiving D-type input may be unreachable. Once they are reachable, the input must not come from the T group state, and the T group state will not be transmitted to the unreachable state; 10) After the state machine is rebuilt according to the state attribute allocation, all D-group and T-group states are reachable except the reset state, and all other states are unreachable, and there is a key derived from them; Step 3: If the number of keys solved by the CP-SAT solver is 1, the attack ends and a unique correct key is obtained. Otherwise, use the Synopsys VC Formal SEQ Application to perform timing equivalence checks and combine Oracles to further eliminate incorrect keys until a unique correct key or multiple equivalent keys are obtained.

2. The method for cracking the integrated circuit encryption circuit state machine according to claim 1, characterized in that: The information extracted in step 1 includes the encryption state machine under the D-type configuration, the reset state of the state machine, the Hamming distance value h, and the configuration signal reset value. The encryption state machine under the T-type configuration is derived from the encryption state machine under the D-type configuration, that is, the next state of all states is modified to be exclusive OR with the current state.

3. The method for cracking the integrated circuit encryption circuit state machine according to claim 1, characterized in that: The method of converting the encryption state machine into a matrix in step 2 includes the following steps: The size of the matrix is ​​n*n, where n=2^(number of DFFs). For an encryption state machine consisting of 4 flip-flops, a 16*16 matrix needs to be created. , if FSM[i][j]=1, it means there is a connection from state i to state j in the state machine; If FSM[i][j]=0, then there is no such state. If the FSM is large, compress and store the FSM matrix. For any state, only its next state is recorded.

4. The method for cracking the integrated circuit encryption circuit state machine according to claim 1, characterized in that: The method of iteratively calling the solving tool CP-SAT solver in step 2 includes: each time the CP-SAT solver is called, only one feasible solution is found, the corresponding key is recorded, and a new constraint is added so that the same key cannot be derived in subsequent feasible solutions.

5. The method for cracking the integrated circuit encryption circuit state machine according to claim 1, characterized in that: The method for checking the timing equivalence in step 3 includes the following steps: Instantiate two identical netlists and set the key to different values. Run Synopsys VC Formal SEQApplication. If the two netlists are completely consistent, keep any key and compare it with other keys. If the two netlists are inconsistent, apply the same stimulus as the returned input sequence to the chip, observe the chip output, and compare it with the output of the two netlists to eliminate the incorrect key. Repeat this process until multiple equivalent keys are obtained or only one key remains.

Images