Dynamic Scan Chain Obfuscation Against SAT and Bypass Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current logic obfuscation techniques in the semiconductor industry are vulnerable to SAT attacks and bypass attacks, failing to provide robust protection against IP theft and tampering in the semiconductor fabrication process, especially when dealing with sequential circuits and untrusted offshore fabrication facilities.
Innovation Solution
The dynamically obfuscated scan chain (DOSC) structure, comprising a feedback shift register, a control module, and a dynamic Obfuscation Key generator, which generates and updates an Obfuscation Key to protect scan chains, preventing unauthorized access and attacks by scrambling test patterns and responses, and only known by trusted entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If logic obfuscation techniques are used to protect IP, then IP confidentiality is improved, but vulnerability to SAT attacks increases
Solution Approach 1:
The patent implements dynamic key generation using Linear Feedback Shift Registers (LFSRs) that continuously update obfuscation keys during circuit operation. This dynamic key rotation prevents static analysis attacks like SAT attacks because the obfuscation pattern changes over time, making it computationally infeasible for attackers to reverse-engineer the IP through traditional static methods.
Solution Approach 2:
The patent introduces trusted intermediary modules (key management modules) that mediate between the IP core and the external environment. These intermediaries hold and manage the secret keys, providing them to authorized entities while preventing unauthorized access. This intermediary layer adds a security boundary that protects the IP from direct exposure to potential attackers.
2Device complexity
If static obfuscation keys are used, then implementation simplicity is improved, but security against bypass attacks deteriorates
Solution Approach 1:
The system transitions from static obfuscation keys to dynamic keys generated by LFSRs. The LFSRs are initialized with secret seeds and produce continuously changing key sequences, which are fed into the obfuscation logic. This dynamic approach prevents bypass attacks because the obfuscation pattern cannot be statically analyzed or circumvented, while the added complexity is confined to the key generation module rather than the entire system.
3Ease of manufacture
If scan chains are used for testing, then testability is improved, but vulnerability to scan-based attacks increases
Solution Approach 1:
The patent introduces trusted intermediary modules that control and manage access to scan chains. These intermediaries act as gatekeepers, allowing legitimate test operations while preventing malicious scan-based attacks. The intermediaries use dynamic obfuscation keys to protect the scan chain contents, ensuring that even if attackers gain access to the scan infrastructure, they cannot extract meaningful information without the corresponding keys.
Solution Approach 2:
The patent separates the key management functionality from the main IP core by extracting it into dedicated trusted modules. This extraction creates a distinct security domain that manages scan chain access independently, allowing testability to be maintained through controlled scan operations while isolating the security-critical key management from potential attack vectors in the scan infrastructure.
Data Source
AI summary
A dynamically obfuscated scan chain (DOSC) includes a control module designed to control memory loading, a linear feedback shift register (LFSR), a dynamic Obfuscation Key generator configured to use LFSR to generate a φ-bit protected Obfuscation Key, in order to confuse and change the test data into an output scan vectors when the Obfuscation Key update is triggered. The DOSC also includes a shadow chain, configured to input the φ-bit protected Obfuscation Key generated by the LFSR, and output k└φ×α┘-bit protected Obfuscation Keys, and obfuscated scan chains. The DOSC operating method includes: loading control vectors to LFSR from control module during initialization; generating the Obfuscation Key at an output of the LFSR; generating the Obfuscation Key bit by bit based at least in part on the shadow chain and the Obfuscation Key during a first scan clock after reset in order to confuse test patterns.