Logic obfuscation can protect designs from reverse engineering and IP piracy. In this paper, a new attack strategy based on applying brute force iteratively to each logic cone is described and shown to significantly reduce the number of brute force key combinations that need to be tried by an attacker. It is shown that inserting key gates based on MUXes is an effective approach to increase security against this type of attack. Experimental results are presented quantifying the threat posed by this type of attack along with the relative effectiveness of MUX key gates in countering it.
In secure computing, sensitive data must be kept private by protecting it from being obtained by an attacker. Existing techniques for computing with encrypted data are either prohibitively expensive (e.g., fully homomorphic encryption) or only work for special cases. (e.g., only for linear circuits). This paper presents a lightweight methodology for computing with noise-obfuscated data by carefully selecting internal locations for noise cancellation in arbitrary logic circuits. Noise is inserted in the data before computation and then partially cancelled during the computation and fully cancelled at the outputs. While the proposed methodology does not provide the level of strong encryption that fully homomorphic encryption would provide, it has the advantage of being lightweight, easy to implement, and can be deployed with relatively minimal performance impact. A key idea in the proposed approach is to reduce the complexity of the noise cancellation logic by carefully selecting internal locations to do local noise canceling. This is done in a way that prevents more than one input per gate from propagating noise thereby avoiding the complexity that arises from reconvergent noise propagation paths. One important application of the proposed scheme is for protecting data inside a computing unit obtained from a third party IP provider where a hidden backdoor access mechanism or hardware Trojan could be maliciously inserted. Experimental results show that noise can be propagated to outputs with overheads ranging from (13%-56%).
This paper investigates the use of multiple-polynomial linear feedback shift registers (MP-LFSRs) for dynamic reseeding in a continuous flow test compression environment to allow a more aggressive expansion of tester channels to scan chains and thereby increase the amount of test compression achieved. A scheme is proposed that does not need any control data to be used to select the polynomial that decompresses each test cube. This problem is formulated as a bipartite matching problem. The amount of hardware used to implement the MP-LFSR is reduced by exploiting the property that the reciprocal of a primitive polynomial is also primitive. Also, a procedure for optimally using an MP-LFSR with retained free-variables [Muthyala 12] is described. Experimental results are presented showing the improvements in test compression that can be obtained with MP-LFSRs.
Conventional approaches for test architecture optimization are based on designing test access mechanisms (TAMs) and core wrappers for a particular test data bandwidth available from the tester. However, constructing three dimensional integrated circuits (3D-ICs) using known-good dies (KGD) and known-good stacks (KGS) requires pre-bond testing of die and optionally partial stack testing in addition to the final post-bond test. In each of these different test periods: pre-bond, partial stack, and final test, the test data bandwidth available for a particular die may be different. A test architecture optimized for one particular test data bandwidth may be very inefficient when the bandwidth changes. Previously proposed test optimization techniques for handling this involve designing different TAM architectures for pre-bond and post-bond test in order to minimize the test time for each different test data bandwidth. This paper describes an approach for designing a single TAM architecture with a "bandwidth adapter" on each die that can be used efficiently for multiple test data bandwidths. Experimental results are presented which show that this approach allows efficient test in all phases from pre-bond, multiple partial stack configurations, and post-bond.
