Reverse Engineering Digital Circuits Using Structural and Functional Analyses

TLDR

Integrated circuits are vulnerable to malicious design changes, hardware Trojans, and IP theft, and algorithmic reverse engineering can detect such threats and verify IC integrity. The paper proposes algorithms that transform an unstructured netlist into a high‑level netlist containing functional components such as register files, counters, adders, and subtractors. The approach uses automated algorithms that parse the unstructured netlist and reconstruct a high‑level representation of the circuit. Experiments show the algorithms automatically recover 45–93% of gates in small test circuits, 68% of gates in a 375,000‑element SOC, and help analysts detect hardware Trojans.

Abstract

Integrated circuits (ICs) are now designed and fabricated in a globalized multivendor environment making them vulnerable to malicious design changes, the insertion of hardware Trojans/malware, and intellectual property (IP) theft. Algorithmic reverse engineering of digital circuits can mitigate these concerns by enabling analysts to detect malicious hardware, verify the integrity of ICs, and detect IP violations. In this paper, we present a set of algorithms for the reverse engineering of digital circuits starting from an unstructured netlist and resulting in a high-level netlist with components such as register files, counters, adders, and subtractors. Our techniques require no manual intervention and experiments show that they determine the functionality of >45% and up to 93% of the gates in each of the test circuits that we examine. We also demonstrate that our algorithms are scalable to real designs by experimenting with a very large, highly-optimized system-on-chip (SOC) design with over 375000 combinational elements. Our inference algorithms cover 68% of the gates in this SOC. We also demonstrate that our algorithms are effective in aiding a human analyst to detect hardware Trojans in an unstructured netlist.