Intellectual Property Protection Using a Transistor-level Programmable Fabric
Over the years, the semiconductor industry has followed the overarching economic trend of globalization and offshore manufacturing. While the widespread utilization of third-party foundries has helped design houses lower manufacturing costs, it has also exposed their products to security threats such as intellectual property (IP) theft and integrated circuit (IC) counterfeiting. Therefore, the ability to hide sensitive designs from a potentially untrusted foundry is becoming paramount for IP protection. In response, the research community has proposed various design obfuscation solutions for thwarting reverse-engineering and unauthorized reproduction/usage of ICs. Unfortunately, while the state-of-the-art design obfuscation schemes can offer protection against brute-force attacks, they remain vulnerable to intelligent attacks, such as ones that leverage a Boolean Satisfiability (SAT) solver. In this work, we present a novel IP protection methodology for structurally obfuscating sensitive parts of a design through pre-fabrication omission and post-fabrication programming. We introduce a transistor-level programmable (TRAP) fabric tailored to replace portions of an ASIC design for our obfuscation purposes. Unfortunately, the state-of-theart computer-aided design (CAD) tools and testing solutions are designed for conventional application-specific ICs (ASICs) and field-programmable gate arrays (FPGAs) and cannot support the new architecture. To this end, we develop the ancillary ancillary infrastructure required for practical adoption of the TRAP fabric. Specifically, we present a full-stack CAD solution that takes an RTL description as input, performs synthesis, placement, routing, and finally generates the bitstream to program the design on a TRAP fabric. We also propose a novel application-agnostic test methodology for TRAP, which consists of a multi-phase, cascadable scheme to efficiently test the programmable transistors, the built-in gates, and the interconnect network in the fabric. We then theoretically analyze the complexity of attacking TRAP-obfuscated designs through both brute-force and intelligent SAT-based attacks. Finally, we present a hardware testbed for experimenting with TRAP and evaluate the efficacy of the proposed method through selective obfuscation of various benchmark circuits and two modern microprocessor designs. Our results corroborate that, as compared to an FPGA implementation, TRAP-based obfuscation offers superior resistance against both brute-force and oracle-guided SAT attacks while incurring an order of magnitude less area, power, and delay overhead.