SeqL: Secure Scan-Locking for IP Protection

TL;DR

SeqL introduces a scan-locking technique that protects IPs by rendering decrypted keys functionally incorrect, effectively defending against a wide range of state-of-the-art attacks on sequential circuits.

Contribution

SeqL is a novel scan-locking method that achieves functional isolation and locks specific flip-flop pairs, enhancing IP security against advanced decryption attacks.

Findings

SeqL provides 100% resilience against multiple attack types.

SeqL effectively locks selective flip-flops to prevent key decryption.

The method is applicable to various benchmarks and a RISC-V CPU.

Abstract

Existing logic-locking attacks are known to successfully decrypt functionally correct key of a locked combinational circuit. It is possible to extend these attacks to real-world Silicon-based Intellectual Properties (IPs, which are sequential circuits) through scan-chains by selectively initializing the combinational logic and analyzing the responses. In this paper, we propose SeqL, which achieves functional isolation and locks selective flip-flop functional-input/scan-output pairs, thus rendering the decrypted key functionally incorrect. We conduct a formal study of the scan-locking problem and demonstrate automating our proposed defense on any given IP. We show that SeqL hides functionally correct keys from the attacker, thereby increasing the likelihood of the decrypted key being functionally incorrect. When tested on pipelined combinational benchmarks (ISCAS,MCNC), sequential benchmarks (ITC) and a fully-fledged RISC-V CPU, SeqL gave 100% resilience to a broad range of state-of-the-art attacks including SAT[1], Double-DIP[2], HackTest[3], SMT[4], FALL[5], Shift-and-Leak[6] and Multi-cycle attacks[7].