# Is Robust Design-for-Security Robust Enough? Attack on Locked Circuits with Restricted Scan Chain Access

## TL;DR

This paper demonstrates that a robust design-for-security architecture for logic locking can be compromised without scan access, and proposes a new defense that significantly improves security with minimal area overhead.

## Contribution

The paper breaks a previously robust DFS security technique without scan access and introduces a new, more secure defense with lower area overhead.

## Key findings

- Successfully recovers ~95% of key bits without scan access
- The new defense withstands all logic locking attacks
- Lower area overhead (~1.65%) compared to previous methods (~5.15%)

## Abstract

The security of logic locking has been called into question by various attacks, especially a Boolean satisfiability (SAT) based attack, that exploits scan access in a working chip. Among other techniques, a robust design-for-security (DFS) architecture was presented to restrict any unauthorized scan access, thereby, thwarting the SAT attack (or any other attack that relies on scan access). Nevertheless, in this work, we successfully break this technique by recovering the secret key despite the lack of scan access. Our security analysis on a few benchmark circuits protected by the robust DFS architecture demonstrates the effectiveness of our attack; on average ~95% of the key bits are correctly recovered, and almost 100% in most cases. To overcome this and other prevailing attacks, we propose a defense by making fundamental changes to the robust DFS technique; the new defense can withstand all logic locking attacks. We observe, on average, lower area overhead (~1.65%) than the robust DFS design (~5.15%), and similar test coverage (~99.88%).