Stealing Maggie's Secrets -- On the Challenges of IP Theft Through FPGA Reverse Engineering

TL;DR

This paper investigates the real-world challenges of FPGA IP theft through reverse engineering, using a case study on an iPhone 7 FPGA, and introduces generalized techniques and tools to assess and mitigate this threat.

Contribution

It provides the first detailed case study of FPGA IP theft on a real device and develops generalized, automated reverse engineering methods applicable across FPGA architectures.

Findings

Reverse engineering FPGA IP requires significant effort, but can be streamlined with new techniques.

The proposed methods successfully reverse engineered multiple FPGA benchmarks.

Open-source tools facilitate realistic threat assessments and countermeasure evaluations.

Abstract

Intellectual Property (IP) theft is a cause of major financial and reputational damage, reportedly in the range of hundreds of billions of dollars annually in the U.S. alone. Field Programmable Gate Arrays (FPGAs) are particularly exposed to IP theft, because their configuration file contains the IP in a proprietary format that can be mapped to a gate-level netlist with moderate effort. Despite this threat, the scientific understanding of this issue lacks behind reality, thereby preventing an in-depth assessment of IP theft from FPGAs in academia. We address this discrepancy through a real-world case study on a Lattice iCE40 FPGA found inside iPhone 7. Apple refers to this FPGA as Maggie. By reverse engineering the proprietary signal-processing algorithm implemented on Maggie, we generate novel insights into the actual efforts required to commit FPGA IP theft and the challenges an attacker faces on the way. Informed by our case study, we then introduce generalized netlist reverse engineering techniques that drastically reduce the required manual effort and are applicable across a diverse spectrum of FPGA implementations and architectures. We evaluate these techniques on six benchmarks that are representative of different FPGA applications and have been synthesized for Xilinx and Lattice FPGAs, as well as in an end-to-end white-box case study. Finally, we provide a comprehensive open-source tool suite of netlist reverse engineering techniques to foster future research, enable the community to perform realistic threat assessments, and facilitate the evaluation of novel countermeasures.