Evaluating the Robustness of Large scale eFPGA-based Hardware Redaction

The distributed model of Integrated Circuit (IC) design has allowed rouge entities from offshore fabs to pose security threats. Logic locking is proposed as a countermeasure to obfuscate the IC from such threats. However, powerful attacks have constantly challenged logic-locking techniques over the years. One of the recent techniques for obfuscating a logic design is embedded FPGA (eFPGA)-based redaction, that replaces a sensitive sub-circuit with an eFPGA, that is later integrated into the original design. In this technique, the configuration bits of eFPGA are the secret keys known only by the IC design hub. This technique incurs no area overhead even when large portions are redacted, making it an admired security technique. Even though attacks have been proposed to decrypt such obfuscation methods, they are not scalable. In this work, we combine two strategies to make a scalable attack on eFPGA-based redaction. Firstly we propose a couple of divide-and-conquer heuristics on top of the Boolean SAT attack. Secondly, a combination of a statistical approach combined with our modified SAT attack is used for the scalability of our attack. Our attacks were successfully mounted on three varied-sized benchmarks provided by HeLLO: CTF’22.