Deep RNN-Oriented Paradigm Shift through BOCANet: Broken Obfuscated Circuit Attack

TL;DR

This paper introduces BOCANet, a deep RNN-based attack that significantly improves the efficiency of breaking obfuscated hardware circuits, even with minimal data, outperforming existing methods in success rate and resource usage.

Contribution

The paper presents BOCANet, the first deep RNN approach to hardware obfuscation attack, achieving over 20 times faster performance with minimal I/O data compared to prior techniques.

Findings

BOCANet successfully breaks multiple benchmark circuits.

It requires less than 0.5% I/O pairs for effective attack.

BOCANet outperforms existing attacks in speed and success rate.

Abstract

This is the first work augmenting hardware attacks mounted on obfuscated circuits by incorporating deep recurrent neural network (D-RNN). Logic encryption obfuscation has been used for thwarting counterfeiting, overproduction, and reverse engineering but vulnerable to attacks. There have been efficient schemes, e.g., satisfiability-checking (SAT) based attack, which can potentially compromise hardware obfuscation circuits. Nevertheless, not only there exist countermeasures against such attacks in the state-of-the-art (including the recent delay+logic locking (DLL) scheme in DAC'17), but the sheer amount of time/resources to mount the attack could hinder its efficacy. In this paper, we propose a deep RNN-oriented approach, called BOCANet, to (i) compromise the obfuscated hardware at least an order-of magnitude more efficiently (>20X faster with relatively high success rate) compared to existing attacks; (ii) attack such locked hardware even when the resources to the attacker are only limited to insignificant number of I/O pairs (< 0.5\%) to reconstruct the secret key; and (iii) break a number of experimented benchmarks (ISCAS-85 c423, c1355, c1908, and c7552) successfully.