Split manufacturing is a security measure for semiconductor products against potential attacks at an untrusted foundry. The goal of this research is to significantly improve the security over a straightforward deployment of split manufacturing, concurrently address conventional design objectives and develop attack techniques for effectively evaluating the security.

• Placement perturbation for improving the security of split manufacturing

A Pareto optimization based placement perturbation defense technique is developed. It is composed by two phases. In phase I, a subset of logic gates are selected for the perturbation and the choice is decided based on the impact to security. In phase II, a tree of selected gates are placed considering the tradeoff between security and degree of perturbation. Less perturbation can largely retain the wirelength and timing of a given design but may restrict the freedom for improving security. The proposed technique reduces attack correct connection rate from 82% to about 60%, and increases output error rate from 50% to over 80%. The associated wirelength overhead is only a few percent and the critical path delay increase is only a few picoseconds.

• Routing perturbation for improving the security of split manufacturing

Routing perturbation defense techniques are developed, including layer elevation, routing detour and decoy. The proposed routing perturbation algorithm consists five steps: (1) ripping up global wires, (2) ripping up local wires, (3) generating detour near net drivers, (4) creating decoys near net sinks and (5) BEOL (Back-End-Of-Line) wire rerouting. The routing perturbation technique considers the tradeoff with conventional design objectives. It reduces attack correct connection rate from 89% to 74%, and increases output error rate from 73% to 100%. The wirelength overhead from the perturbation is within a few percent.

• Synergistic improvement of security and manufacturability in split manufacturing

A rerouting technique considering both CMP(Chemical-Mechanical Polishing), which is a design for manufacturability technique, and split manufacturing security is developed. Compared to a recent previous work, which may increase wire density variations by 18%, our technique can reduce wire density variations by 24% and 37% for BEOL (Back-End-Of-Line) and FEOL (Front-End-Of-Line), respectively. At the same time, it achieves similar security level as the previous work in terms of attack connection errors and attacked circuit output Hamming distance. An ILP (Integer Linear Programming) based rerouting for simultaneous security and SADP (Self-Aligned Double Patterning) compliance is developed. It further increases attack error rate from 78% to 91% compared to the previous work. Meanwhile, it reduces the number of SADP violations from 157 to 3 on average. For both techniques, the wirelength overhead is a few percent and the delay overhead is within 1%.

• Network flow-based attack to split manufacturing

A network flow-based attack technique is developed. Compared to previous work using proximity attack, the network flow attack is a more systematic approach, and can increase correct connection rate in reverse engineering from 28% to 82% according to simulations on benchmark circuits. It can also reduce output error rate from more than 90% to around 50%. The software of this network flow attack is released in Github.

• Front-end-of-line attack in split manufacturing

Previous works on split manufacturing attacks are mostly restricted to BEOL (Back-End-Of-Line). A geometric pattern matching based FEOL (Front-End-Of-Line) attack technique is developed. Experimental results on benchmark circuits show that it can successfully recover all designs. A camouflaging-based defense technique is developed. It can increase attack errors and attack circuit output errors to 78% and 99.9%, respectively. The delay overhead of this defense technique is 2.7%.

• Structural pattern matching based attack technique

For the Trojan-oriented layout recognition attack in split manufacturing, attackers have the circuit netlist and attempts to identify key components in the incomplete layout for Trojan insertion. Although defense techniques have been reported for this attack scenario, the techniques are mostly evaluated with K-security without actual attack. In our study, the SAT-based bijective mapping attack is implemented and applied to circuits with K-security defense. Moreover, a structural pattern mapping-based attack, inspired from technology mapping, is developed. It is more scalable and more flexible than the bijective mapping attack. Experimental comparison with bijective mapping attack shows that the new attack technique achieves about the same success rate with much faster speed for cases without the K-security defense, and has a much better success rate at the same runtime for cases with K-security defense.

Broader Impact

This research significantly advances the state-of-the-art for the split manufacturing technology on various aspects, including the improvement on security, tradeoff with conventional design objectives and comprehensive study on attack techniques. The knowledge obtained in this project has been disseminated through technical journal, conference publications and software release. Students are trained with interdisciplinary skills on circuit design, optimization and security. 

Last Modified: 10/03/2020
Modified by: Jiang Hu