Boolean Domain Attack on Corrupt and Correct Based Logic Locking Techniques
Abstract
Logic locking is a potential solution to prevent reverse engineering and integrated circuit (IC) counterfeiting from untrusted third parties within the IC supply chain. Among various techniques, corrupt and correct (CAC) based techniques offer strong security guarantees against SAT based attacks. However, the sparse prime implicant (SPI) attack demonstrated that the random selection of protected input patterns (PIPs) is able to leak information in the Boolean domain for SFLL-HD0 based techniques. This paper proposes a novel attack, the Boolean DERIVativE (DERIVE) attack, that generalizes the Boolean domain leakage. The attack uses a property common to all existing CAC-secured circuits, which is an increased probability for the perturb unit in the corrupted logic cone to create new edges in the Boolean domain. These newly created edges reduce the search space over SAT based attacks, allowing the developed attack to find the PIPs 99.50% faster than SAT based attacks, and to be successful 55.27% more of the time when compared to the SPI attack when tested on benchmark circuits.
