Résumé
The outsourcing business model currentlydominates the semiconductor industry. Ever-shrinkingtechnologies have indeed raised the cost of manufacturingIntegrated Circuits (ICs). Currently, constructing a fabricationplan with advanced technologies (5 nm to 3 nm) costs morethan $10 Billions [1]. Therefore, outsourcing the fabricationprocess to offshore, but possibly unreliable, foundries hasbecome a major trend [2]. This leads to possible securitythreats on hardware, such as IP piracy, Hardware Trojaninsertion and IC overproduction [3].Logic locking has emerged as a solution to protect ICsagainst overproduction – An untrusted foundry fabricatingmore ICs than the required/ordered number in order to sellthe excess on the black market. Logic locking consists inmodifying the circuit structure with additional logic gates,driven by an added input pin: a key with a secret value,required for the IC to function properly [4]. For the pastdecade, logic locking has garnered tremendous attention fromthe research community [5]. Early research in logic lockingfocused on solutions based on key-gate insertion. One of themain goals of these techniques was to attain significant outputcorruption, so that a locked IC is unusable. In 2015, an oracleguided attack broke all previously proposed solutions [6], bydiscovering the value of the secret key thanks to a SAT solverand comparison of the outputs with the ones of an unlocked IC(the oracle). Subsequent locking methods therefore focused onthwarting this so-called SAT attack, often to the detriment ofoutput corruption [5]. The computation time of this type ofattacks indeed increases as corruption decreases. Most recentsolutions have recently begun to propose a satisfactorycompromise between output corruption and protection againstthe attack, making gate insertion algorithms aimed atmaximizing corruption interesting once again [7].In this presentation, we will present a scalable insertionstrategy in which nets for insertion are chosen according totheir output corruption score, computed by measuring thechange in primary outputs’ probabilities to be logic 0 or logic1, upon the insertion of a key gate onto the net or not.Experimental results show that this insertion strategy achievesoptimal results in the three output corruptions metricsevaluated – output corruption rate (the percentage of inputvectors leading to errors at the output of a locked circuit),output corruption coverage (the maximum number of outputsbit that can be corrupted) and output corruptibility (theaverage Hamming distance between the output on applyingany wrong key and the correct key) – while requiring muchless execution time than FLL [8], the initial most effective keygate insertion strategy strategy in terms of output corruption.