ScanSAT: Unlocking Static and Dynamic Scan Obfuscation

09/10/2019
by   Lilas Alrahis, et al.
0

While financially advantageous, outsourcing key steps, such as testing, to potentially untrusted Outsourced Assembly and Test (OSAT) companies may pose a risk of compromising on-chip assets. Obfuscation of scan chains is a technique that hides the actual scan data from the untrusted testers; logic inserted between the scan cells, driven by a secret key, hides the transformation functions that map the scan-in stimulus (scan-out response) and the delivered scan pattern (captured response). While static scan obfuscation utilizes the same secret key, and thus, the same secret transformation functions throughout the lifetime of the chip, dynamic scan obfuscation updates the key periodically. In this paper, we propose ScanSAT: an attack that transforms a scan obfuscated circuit to its logic-locked version and applies the Boolean satisfiability (SAT) based attack, thereby extracting the secret key. We implement our attack, apply on representative scan obfuscation techniques, and show that ScanSAT can break both static and dynamic scan obfuscation schemes with 100 and in the presence of scan compression.

READ FULL TEXT
research
01/18/2020

DynUnlock: Unlocking Scan Chains Obfuscated using Dynamic Keys

Outsourcing in semiconductor industry opened up venues for faster and co...
research
06/18/2019

Is Robust Design-for-Security Robust Enough? Attack on Locked Circuits with Restricted Scan Chain Access

The security of logic locking has been called into question by various a...
research
01/28/2021

GF-Flush: A GF(2) Algebraic Attack on Secure Scan Chains

Scan chains provide increased controllability and observability for test...
research
01/15/2014

A Rigorously Bayesian Beam Model and an Adaptive Full Scan Model for Range Finders in Dynamic Environments

This paper proposes and experimentally validates a Bayesian network mode...
research
04/24/2022

A Comprehensive Test Pattern Generation Approach Exploiting SAT Attack for Logic Locking

The need for reducing manufacturing defect escape in today's safety-crit...
research
05/26/2020

SeqL: Secure Scan-Locking for IP Protection

Existing logic-locking attacks are known to successfully decrypt functio...
research
02/17/2021

Scanning the Cycle: Timing-based Authentication on PLCs

Programmable Logic Controllers (PLCs) are a core component of an Industr...

Please sign up or login with your details

Forgot password? Click here to reset