ORCA: Oracle-less CNN-based Structural Attack on Hardware Obfuscation and Reverse Engineering to RTL

In this paper, we propose ORCA, an oracle-less, CNN-based structural attack methodology that circumvents logic locking by predicting the key of a locked gate-level netlist and reversing it to RTL. The proposed methodology learns the features of a local gate near the root node in the obfuscated design to predict the key of the locked netlist. This methodology is evaluated on different standard benchmark suites such as ISCAS-85, ITC-99, and EPFL. ORCA predicts the key with an average accuracy of 96.69%, outperforming the state-of-the-art deep learning oracle-less attacks SAIL, SnapShot, OMLA, and LIPSTICK by 21.28%, 15.43%, 9.11%, and 0.75%, respectively. To check the effectiveness of ORCA in real scenarios, it is evaluated on netlists synthesized using the complete technology libraries of different foundries, such as TSMC (40nm, 65nm, and 90nm) and GlobalFoundries (40nm), unlike the limited standard cells used in the state-of-the-art attack methods. In the case of a complete technology library, our attack methodology predicts the correct key with an average KPA of more than 70%, demonstrating that it can perform well even when the locked netlist is synthesized using the entire technology library. In addition to traditional Random Logic Locking (RLL), the proposed methodology is also tested on the ML-resilient DECOR logic locking scheme, which predicts the key with an average KPA of 69.61%, outperforming OMLA by 17.18%. In addition to key prediction, the locked netlist is converted to RTL, making ORCA a complete reverse engineering attack flow.