Logic locking refers to a set of techniques that can protect integrated circuits (ICs) from counterfeiting, piracy and malicious functionality changes by an untrusted foundry. It achieves these goals by introducing new inputs, called key inputs, and additional logic to an IC such that the circuit produces the correct output only when the key inputs are set to specific values. The correct values of the key inputs are kept secret from the untrusted foundry and programmed after manufacturing and before distribution, thus rendering piracy, counterfeiting and malicious design changes infeasible. The security of logic locking relies on the assumption that the untrusted foundry cannot infer the correct values of the key inputs by analysis of the circuit. In this paper, we introduce a new attack on state-of-the-art logic locking schemes which invalidates the above assumption. We propose Functional Analysis attacks on Logic Locking algorithms (abbreviated as FALL attacks). FALL attacks have two stages. Their first stage is dependent on the locking algorithm and involves analyzing structural and functional properties of locked circuits to identify a list of potential locking keys. The second stage is algorithm agnostic and introduces a powerful addition to SAT-based attacks called key confirmation. Key confirmation can identify the correct key from a list of alternatives and works even on circuits that are resilient to the SAT attack. In comparison to past work, the FALL attack is more practical as it can often succeed (90% of successful attempts in our experiments) by only analyzing the locked netlist, without requiring oracle access to an unlocked circuit. Our experimental evaluation shows that FALL attacks are able to defeat 65 out of 80 (81%) circuits locked using Stripped-Functionality Logic Locking (SFLL-HD).

中文翻译：

---

对逻辑锁定的功能分析攻击


逻辑锁定是指一组可以保护集成电路 (IC) 免受不可信代工厂的假冒、盗版和恶意功能更改的技术。它通过向 IC 引入新的输入（称为按键输入）和附加逻辑来实现这些目标，这样电路仅在按键输入设置为特定值时才能产生正确的输出。关键输入的正确值对不受信任的代工厂保密，并在制造后和分销前进行编程，从而使盗版、伪造和恶意设计更改变得不可行。逻辑锁定的安全性依赖于这样的假设：不受信任的代工厂无法通过分析电路来推断关键输入的正确值。在本文中，我们引入了对最先进逻辑锁定方案的新攻击，该攻击使上述假设无效。我们提出针对逻辑锁定算法的功能分析攻击（缩写为 FALL 攻击）。 FALL 攻击有两个阶段。他们的第一阶段取决于锁定算法，并涉及分析锁定电路的结构和功能特性，以识别潜在锁定密钥的列表。第二阶段与算法无关，并为基于 SAT 的攻击引入了一个强大的附加功能，称为密钥确认。密钥确认可以从一系列备选密钥中识别出正确的密钥，甚至可以在对 SAT 攻击具有弹性的电路上工作。与过去的工作相比，FALL 攻击更加实用，因为它通常可以通过仅分析锁定的网表而成功（我们实验中的成功尝试中有 90％），而不需要预言机访问未锁定的电路。 我们的实验评估表明，FALL 攻击能够击败使用剥离功能逻辑锁定 (SFLL-HD) 锁定的 80 个电路中的 65 个 (81%)。