Hardware IP Steganography via CDFG Partitioning and Merging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hardware intellectual properties (IPs) are vulnerable to piracy, reverse-engineering, and malicious alterations when sent to untrusted parties due to the limitations of traditional protection techniques, which are not applicable in the design, verification, and fabrication processes of hardware IPs.
Innovation Solution
A method and apparatus for modifying hardware IP designs by generating a control and data flow graph (CDFG) representation, partitioning it into sub-graphs, merging them with container sub-graphs using a K-way graph merging algorithm, and implementing data-path locking to create a modified design with enhanced security features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional protection techniques such as encryption are applied to hardware IP, then security against piracy and reverse-engineering is improved, but the techniques become inapplicable during the design, verification, integration, and fabrication process due to the requirement of white-box accessibility by untrusted vendors
Solution Approach 1:
The patent segments the hardware IP design into multiple sub-graphs (control flow sub-graphs, data flow sub-graphs, etc.) that can be independently processed and protected. Each sub-graph can be encrypted or locked separately, allowing the system to maintain security while enabling selective access during different stages of the design and fabrication process.
Solution Approach 2:
The patent implements dynamic protection mechanisms where the level of security can be adjusted based on the stage of the design process. During early design stages, more access is permitted for verification, while later stages implement stricter protection. The protection scheme evolves from static to dynamic, adapting to the changing needs of the development lifecycle.
2Productivity
If hardware IP is sent to untrusted foundries for fabrication, then production capability is improved, but the IP becomes vulnerable to malicious alterations and reverse-engineering
Solution Approach 1:
The patent introduces an intermediary protection layer between the hardware IP and the untrusted foundry. This intermediary takes the form of encrypted design files, locked sub-graphs, or watermarked netlists that the foundry can process but cannot modify or reverse-engineer. The intermediary maintains the necessary information for fabrication while preventing direct access to the core IP.
Solution Approach 2:
The patent applies obfuscation techniques that change the appearance and structure of the hardware IP, similar to color changes. The design is transformed into an obfuscated version with altered logic paths, renamed signals, and restructured circuits that maintain functionality but appear completely different to attackers, making reverse-engineering difficult.
3Reliability
If the hardware IP design is transformed and locked into merged sub-graphs, then security is improved, but the complexity of the design process increases
Solution Approach 1:
The patent divides the complex design process into manageable segments: creating sub-graphs, partitioning the design, applying protection to each segment, and then reassembling. This segmentation reduces the complexity of handling the entire design at once by breaking it into smaller, more manageable units that can be processed independently.
Solution Approach 2:
The patent creates copies of the hardware IP in protected formats (encrypted representations, locked sub-graphs, watermarked versions) that can be stored and manipulated separately from the original design. These copies maintain all necessary functionality while providing security, allowing the original design to remain intact for reference while protected versions are used for fabrication.
Data Source
AI summary
In general, embodiments of the present disclosure provide methods, apparatus, systems, computer program products, computing devices, and computing entities for modifying a design of a hardware IP. According to one embodiment, a method is provided, the method including generating a control and data flow graph (CDFG) representation for portions of the design. The method further includes partitioning the CDFG representation into a set of partitioned sub-graphs. The method further includes, for each partitioned sub-graph, generating a merged sub-graph to form a set of merged sub-graphs. Generating the merged sub-graph for each partitioned sub-graph involves generating a container sub-graph and merging the container sub-graph with the partitioned sub-graph to form the merged sub-graph. The container sub-graph may be a modification of the partitioned sub-graph with respect to an identified feature, in some examples. The method further includes synthesizing a modified design of the hardware IP including the set of merged sub-graphs.