Are proximity attacks a threat to the security of split manufacturing of integrated circuits?
Are proximity attacks a threat to the security of split manufacturing of integrated circuits?
复制标题
邻近攻击是否对集成电路分片制造的安全构成威胁？
DOI：
10.1145/2966986.2967006
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
A. Davoodi
中科院分区：
文献类型：
--
作者：
Jonathon Magaña;Daohang Shi;A. Davoodi
分体式制造是一种技术，它允许在高端、不可信的铸造厂制造集成电路的晶体管级和较低的金属层，而在较小的、可信的铸造厂只制造较高的金属层。只有当不受信任的铸造厂不能从较低的层对较高的金属层连接(从而整个IC设计)进行反向工程时，使用拆分制造才是可行的。这项工作研究了邻近攻击的有效性，将其作为在不可信的代工厂进行设计逆向工程的关键步骤。根据如何为每个断开的连接定义一组候选对象，我们提出并研究了不同的邻近攻击。攻击使用放置和路由信息，以及捕获路由器行为的因素，如每层路由拥塞。我们的研究是基于在9个金属层上布线数百万个网的设计，并且每层线的大小有很大的差异。我们的结果表明，常见的基于汉明距离的邻近攻击很少能达到5%以上的匹配率。但我们提议的攻击会产生一个相对较小的候选列表，其中通常包含正确的匹配。最后，我们提出了一种程序，在不造成任何区域开销的情况下，在所需的拆分级别人为地在设计中插入布线阻塞，以欺骗路由器使基于邻近的逆向工程更具挑战性。
Split manufacturing is a technique that allows manufacturing the transistor-level and lower metal layers of an IC at a high-end, untrusted foundry, while manufacturing only the higher metal layers at a smaller, trusted foundry. Using split manufacturing is only viable if the untrusted foundry cannot reverse engineer the higher metal layer connections (and thus the overall IC design) from the lower layers. This work studies the effectiveness of proximity attack as a key step to reverse engineer a design at the untrusted foundry. We propose and study different proximity attacks based on how a set of candidates are defined for each broken connection. The attacks use both placement and routing information along with factors which capture the router's behavior such as per-layer routing congestion. Our studies are based on designs having millions of nets routed across 9 metal layers and significant layer-by-layer wire size variation. Our results show that a common, Hamming Distance-based proximity attack seldom achieves a match rate over 5%. But our proposed attack yields a relatively-small list of candidates which often contains the correct match. Finally, we propose a procedure to artificially insert routing blockages in a design at a desired split level, without causing any area overhead, in order to trick the router to make proximity-based reverse engineering significantly more challenging.