Using scan side channel for detecting IP theft

Leonid Azriel, Ran Ginosar, Shay Gueron, Avi Mendelson

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


We present a process for detection of IP theft in VLSI devices that exploits the internal test scan chains. The IP owner learns implementation details in the suspect device to find evidence of the theft, while the top level function is public. The scan chains supply direct access to the internal registers in the device, thus making it possible to learn the logic functions of the internal combinational logic chunks. Our work introduces an innovative way of applying Boolean function analysis techniques for learning digital circuits with the goal of IP theft detection. By using Boolean function learning methods, the learner creates a partial dependency graph of the internal flip-flops. The graph is further partitioned using the SNN graph clustering method, and individual blocks of combinational logic are isolated. These blocks can be matched with known building blocks that compose the original function. This enables reconstruction of the function implementation to the level of pipeline structure. The IP owner can compare the resulting structure with his own implementation to confirm or refute that an IP violation has occurred. We demonstrate the power of the presented approach with a test case of an open source Bitcoin SHA-256 accelerator, containing more than 80,000 registers. With the presented method we discover the microarchitecture of the module, locate all the main components of the SHA-256 algorithm, and learn the module's flow control.

Original languageEnglish
Title of host publicationHardware and Architectural Support for Security and Privacy, HASP 2016
PublisherAssociation for Computing Machinery
ISBN (Electronic)9781450347693
StatePublished - 18 Jun 2016
Event5th International Workshop on Hardware and Architectural Support for Security and Privacy, HASP 2016 - Seoul, Korea, Republic of
Duration: 18 Jun 2016 → …

Publication series

NameACM International Conference Proceeding Series


Conference5th International Workshop on Hardware and Architectural Support for Security and Privacy, HASP 2016
Country/TerritoryKorea, Republic of
Period18/06/16 → …

Bibliographical note

Publisher Copyright:
© 2016 ACM.

ASJC Scopus subject areas

  • Software
  • Human-Computer Interaction
  • Computer Vision and Pattern Recognition
  • Computer Networks and Communications


Dive into the research topics of 'Using scan side channel for detecting IP theft'. Together they form a unique fingerprint.

Cite this