Knowledge Is Power: A Knowledge-Guided Oracle-Less Attack on Logic Locking

Abstract Logic locking has emerged as a technique for safeguarding intellectual property (IP) in chip designs. The continuous cat-and-mouse game between logic locking techniques and attackers has led to the development of new protection mechanisms and subsequent attack methods. However, existing attack scenarios fail to capture the real-world threats that logic locking techniques face. This paper investigates a previously overlooked attack scenario against logic locking in which the knowledgeable attacker possesses the locked netlist, knowledge about chip designs (represented as a library of designs), but no working system (as assumed by SAT and other attacks). We also propose a Knowledge-guided Oracle-Less Attack (KOLA) which leverages an adversary’s prior knowledge represented by a library of previously encountered designs and employs commercial synthesis tools to measure similarity between the locked design and each library design. Our approach is applicable to both direct locked versions of library designs and modified/upgraded locked designs derived from the library. Experimental results demonstrate KOLA’s ability to identify locked designs, even when significant changes have been made from the original library designs. This analysis sheds light on the vulnerabilities of logic locking techniques against knowledgeable attackers even if a working system is unavailable, highlighting the need for enhanced logic locking techniques that are able to thwart attacks from knowledgeable fab houses which can unlock systems even if a working system is unavailable.