论文标题
综合测试模式生成方法利用SAT攻击进行逻辑锁定
A Comprehensive Test Pattern Generation Approach Exploiting SAT Attack for Logic Locking
论文作者
论文摘要
减少当今安全至关重要应用中制造缺陷逃逸的需求需要增加故障覆盖范围。但是,使用商业自动测试模式生成(ATPG)工具生成测试集,从而导致零缺失逃生仍然是一个空旷的问题。检测所有卡在断层以达到100%故障覆盖范围是一项挑战。同时,硬件安全社区一直积极参与开发逻辑锁定解决方案以防止IP盗版。锁(例如,Xor门)插入网表的不同位置,以使对手无法确定秘密键。不幸的是,在[1]中引入的基于布尔的满意度(SAT)攻击可以在几分钟内打破不同的逻辑锁定方案。在本文中,我们使用对逻辑锁定的强大SAT攻击提出了一种新颖的测试模式生成方法。卡住的故障被建模为带有秘密钥匙的锁定门。我们对断层的建模保留了故障激活和传播的特性。我们表明,确定密钥的输入模式是对故障的测试。我们提出了两种不同的测试模式生成方法。首先,针对一个单一的卡住故障,并创建一个带有一个键位的相应锁定电路。这种方法每次故障生成一种测试模式。其次,我们考虑一组故障,并使用多个键位将电路转换为锁定版本。从SAT工具获得的输入是用于检测这组故障的测试集。我们的方法能够找到以前在商业ATPG工具中失败的难以检测故障的测试模式。提出的测试模式生成方法可以有效地检测到电路中存在的冗余故障。我们证明了该方法对ITC'99基准的有效性。结果表明,我们可以达到达到100%的完美故障覆盖率。
The need for reducing manufacturing defect escape in today's safety-critical applications requires increased fault coverage. However, generating a test set using commercial automatic test pattern generation (ATPG) tools that lead to zero-defect escape is still an open problem. It is challenging to detect all stuck-at faults to reach 100% fault coverage. In parallel, the hardware security community has been actively involved in developing solutions for logic locking to prevent IP piracy. Locks (e.g., XOR gates) are inserted in different locations of the netlist so that an adversary cannot determine the secret key. Unfortunately, the Boolean satisfiability (SAT) based attack, introduced in [1], can break different logic locking schemes in minutes. In this paper, we propose a novel test pattern generation approach using the powerful SAT attack on logic locking. A stuck-at fault is modeled as a locked gate with a secret key. Our modeling of stuck-at faults preserves the property of fault activation and propagation. We show that the input pattern that determines the key is a test for the stuck-at fault. We propose two different approaches for test pattern generation. First, a single stuck-at fault is targeted, and a corresponding locked circuit with one key bit is created. This approach generates one test pattern per fault. Second, we consider a group of faults and convert the circuit to its locked version with multiple key bits. The inputs obtained from the SAT tool are the test set for detecting this group of faults. Our approach is able to find test patterns for hard-to-detect faults that were previously failed in commercial ATPG tools. The proposed test pattern generation approach can efficiently detect redundant faults present in a circuit. We demonstrate the effectiveness of the approach on ITC'99 benchmarks. The results show that we can achieve a perfect fault coverage reaching 100%.