Teaching Hardware Reverse Engineering: Educational Guidelines and Practical Insights

TL;DR

This paper introduces the first systematic course on hardware reverse engineering, combining educational research, practical tools, and an evaluation to guide future teaching in this critical security field.

Contribution

It proposes educational guidelines, develops a practical lab course focused on gate-level netlist reverse engineering, and evaluates its effectiveness.

Findings

The course effectively teaches hardware reverse engineering concepts.

Students gained practical skills in gate-level netlist analysis.

Insights on course structure and content for future education.

Abstract

Since underlying hardware components form the basis of trust in virtually any computing system, security failures in hardware pose a devastating threat to our daily lives. Hardware reverse engineering is commonly employed by security engineers in order to identify security vulnerabilities, to detect IP violations, or to conduct very-large-scale integration (VLSI) failure analysis. Even though industry and the scientific community demand experts with expertise in hardware reverse engineering, there is a lack of educational offerings, and existing training is almost entirely unstructured and on the job. To the best of our knowledge, we have developed the first course to systematically teach students hardware reverse engineering based on insights from the fields of educational research, cognitive science, and hardware security. The contribution of our work is threefold: (1) we propose underlying educational guidelines for practice-oriented courses which teach hardware reverse engineering; (2) we develop such a lab course with a special focus on gate-level netlist reverse engineering and provide the required tools to support it; (3) we conduct an educational evaluation of our pilot course. Based on our results, we provide valuable insights on the structure and content necessary to design and teach future courses on hardware reverse engineering.