On the Limitations of Obfuscating Redundant Circuits in Frustrating Hardware Trojan Implantation

Abstract

Split manufacturing is a method to secure circuits by creating layers of a circuit separately—one layer is manufactured at a trusted foundry and the other at an untrusted foundry. The complete circuit is unknowable without both pieces, thus the circuit cannot be effectively manipulated by, e.g., inserting a hardware Trojan at manufacture time. A prominent example of this approach is the work “Securing Computer Hardware Using 3D Integrated Circuit (IC) Technology and Split Manufacturing for Obfuscation” [1]. In the work, it is claimed that even if an attacker knows the exact layout of a circuit before division, the technique set forth would prevent the attacker from inserting an efficient (i.e., undetectable) hardware Trojan into the circuit unless they possessed knowledge of the trusted layer. This paper is notable because it gives strong theoretical reasons, as opposed to only providing empirical results, to suggest that the proposed method provides security for circuits. In this work, we examine whether this particular split manufacturing approach is effective in protecting redundant circuits, such as implementations of cryptographic ciphers, from the implantation of hardware Trojans. We show that it is indeed possible to insert a Trojan with a much higher success rate, and smaller footprint, than the example discussed in [1], which implies that, at least for this class of circuits, obfuscation provides significantly less security than the authors’ theoretical analysis would suggest. To demonstrate its general applicability, our analysis is carried out not only on a the same type of circuit used as an example in [1] (an implementation of the Data Encryption Standard (DES)) but also an Advanced Encryption Standard (AES) circuit. For both circuits, we demonstrate vast improvement for attacker success using the metrics used in [1]