1. HOLLA: DIGITAL LOGIC and the Program encryption toolkit
Dr. Todd McDonald
Professor of Computer Science
School of Computing

2. Sponsored by NSF Grants DUE-1303384 and DGE-1303384
The material in this HOLLA has been supported by funds from the National Science Foundation.
Sponsored by NSF Grants DUE and DGE

3. What is Logic?
Logic: systematic study of the form of valid arguments
Based on statements which can be proven true or false
Assume that you can drive a car IF you have a valid license AND the car has enough gas.
Let A represent: Has a valid license
Let B represent: The gas tank is not empty
You have a valid license: A = ????
: B = ????
You can drive the car: A AND B =
TRUE
FALSE
FALSE

4. You can build any circuit based on these 3 functions!
What is Logic?
You intuitively know the meaning of the 3 most basic logic functions
NOT: true if input is false
NOT (It is raining) =
NOT (It is daylight outside) =
AND: true if all values must be true
AND (You are 16, You are in the 11th grade) =
AND ( 1+1 = 2, 1+2 = 3, 2+1 = 4 ) =
OR: true if any value is true
OR (You are 16, You are in the 11th grade) =
You can build any circuit based on these 3 functions!

5. Computers are built from digital logic components
What is Digital Logic?
Digital logic: electronic circuits that handle information encoded in binary form (deal with signals that have only two values, 0 and 1 or false and true)
Computers are built from digital logic components
The number system that has two values is the binary number system
All information processed by computers, and therefore digital logic components, are encoded in two values!
False / true
Electrically, off / on

6. Understanding Logic Components
Gate Symbol
Electrical View
Physical Hardware
Functional View A B
Q = AND(A,B) 1
Q = A  B
Q = AND(A, B)

7. Understanding Digital Logic Functions
1) Represented as an equation
A’ = not A = NOT (A)
A  B = A * B = A and B = AND (A,B)
A  B = A + B = A or B = OR (A,B)
A  B = A  B = A xor B = XOR (A,B)
2) Represented as a truth table A B A’ B’
A and B
A or B
A xor B
(A and B)’ 1 ??

8. Basic Logic Gates (Single Input)
BUFFER
INVERTER

9. Basic Logic Gates (Dual Input)
Y = AND (A,B))
Y = NOT (AND (A,B) )
AND
NAND OR
NOR
XOR
NXOR

10. # 3 inputs # 2 outputs INPUT(A) INPUT(B) INPUT(C) OUTPUT(D) OUTPUT(E)
Logic Programs
Representing circuits as a program
# 3 inputs
# 2 outputs
INPUT(A)
INPUT(B)
INPUT(C)
OUTPUT(D)
OUTPUT(E)
D = NAND(A, B)
E = OR(C, D)
# = comment
INPUTS:
At least 1
OUTPUTS:
At least 1
A distinguished intermediate GATE-ID
INTERMEDIATE GATES:
We use *.bench.txt for all file BENCH file extensions

11. Program Encryption Toolkit
Significant Technology Investment in Reconfigurable
and Embedded Hardware Devices
Manipulate
Clone
Subvert / DoS
Shortens
technological
advantage and
costs $$$$$
Recover lost design information for legal, economical, and defensive purposes
Reverse Engineering: Reconstructing schematic or netlist to understand and possibly improve the design
Malicious reverse engineering shortens technological advantage
Adversaries can manipulate, clone, subvert, introduce denial of service
In reverse engineering a competitor will not only extract the raw data from a device (as in cloned systems), but will also reverse engineer the programming code to extract explicit details on how the design works. This may be done by disassembling microcontroller codes and reconstructing assembly code from the raw hex file or from photographic analysis of an ASIC layout as each layer is stripped off the metalization. Reverse engineering techniques will give a competitor all of the IP used in a design and allow them to reuse it, improve on it and easily disguise it to thwart possible legal action.
Hardware hacking is reasonably affordable
No longer requires massive resources
Netlist
Protection Tools
Physical access
Encryption
Tamper-proofing
Watermarking / fingerprinting (copy detection/prevention)
Obfuscation
We explore obfuscation of combinational circuit logic
Reverse Engineering: Reconstructing schematic or netlist to understand the design

12. Program Encryption Toolkit
Traditional Attacks
Protection Techniques
Piracy / cloning entire circuit
Copy or reuse parts of a circuit
Insert malicious logic / trojans into circuit
Subvert cryptography to discover hidden keys or data
Watermarking / fingerprinting
Obfuscation
Tamper-proofing

13. Program Encryption Toolkit
Provides visualization support for experiments and studies in polymorphic variation
Provides basic functionality for logic circuit design and analysis
PET = Program Encryption Toolkit
Supports basic research into adversarial analysis and protection of logic circuits
Around 10 years of Master’s thesis research

14. Rules: 2 inputs 1 output 1 intermediate gate
Hands On
Let’s build an AND gate using a BENCH file
Rules:
2 inputs
1 output
1 intermediate gate
File -> New -> Bench File
Pick File Name
Edit
File -> Save
BENCH-> Compile Combinational
BENCH-> View Graph

15. Let’s build a HALF ADDER using the circuit builder # One bit adder
Hands On
Let’s build a HALF ADDER using the circuit builder
# One bit adder
INPUT(A)
INPUT(B)
OUTPUT(SUM)
OUTPUT(CARRY)
SUM = XOR(A,B)
CARRY = AND(A,B)

16. Let’s analyze the half adder: Truth Table Boolean Expression Tree
Hands On
Let’s analyze the half adder:
Truth Table
Boolean Expression Tree
Implicants/Terms
MROBDD
Simulate

17. Let’s do some transformations: Product of Sums Sum of Products
Hands On
Let’s do some transformations:
Product of Sums
Sum of Products

18. Let’s compare the half-adder variants
Hands On
Let’s compare the half-adder variants

19. Let’s create a FULL ADDER from our component library
Hands On
Let’s create a FULL ADDER from our component library

20. Polymorphism = an alternate version
Working Definitions
Polymorphism = an alternate version
Functionally equivalent (white-box)
Functionally recoverable (black-box)
Variation = the process of applying polymorphism to some original program
Obfuscation = A measurable loss of abstract information relative to the original

21. Structural Polymorphism
Structural Polymorphic generation is easy…
ONE FUNCTION, MANY FORMS…
Combinational logic = straight-line program code / basic blocks
P’1 P
P’2
P’3 …
P’5
P’4

22. Let’s generate some polymorphic variants of our full adder!
Hands On
Let’s generate some polymorphic variants of our full adder! 5 1 5

23. Hands On

24. Compare the original full-adder with one of your variants
Hands On
Compare the original full-adder with one of your variants

25. Rules: 4 inputs 5 outputs 7 gates
Hands On
Let’s build a small circuit using circuit builder
Rules:
4 inputs
5 outputs
7 gates
AND OR
XOR
NAND
NOR
NXOR
mycomponent.bench.txt

26. Let’s build a component-based circuit: using concat
Hands On
Let’s build a component-based circuit: using concat
YOUR COMPONENT
c17 5 2 10 5
c17 5 2

27. Let’s build a component-based circuit: using concat
Hands On
Let’s build a component-based circuit: using concat
Let’s call this circuit our P P
mynewcircuit.bench.txt

28. Let’s build a component-based circuit: using concat
Hands On
Let’s build a component-based circuit: using concat

29. Component Identification
What if you wanted to prevent someone from knowing how this circuit was constructed?
????
Given this starting point….
Can someone recover this?

30. Let’s see if we can identify the c17 components in our circuit
Hands On
Let’s see if we can identify the c17 components in our circuit

31. Hands On

32. Some variation techniques are geared at hiding components
Iterative Selection/Replacement
Boundary Blurring
Component Fusion
Component Encryption
Some variation techniques can hide the full function of a circuit, if the circuit input size is small enough
“Program Encryption”
Polygate Transformation

33. Let’s perform program encryption transformation on our circuit
Hands On
Let’s perform program encryption transformation on our circuit
Number of inputs: 10
Number of outputs: 5
Number of constant1: 0
Number of constant0: 0
Intermediate gates: 21
ANDs: 2
ORs: 2
XORs: 2
NANDs: 13
NORs: 1
NXORs: 1
BUFFERs: 0
NOTs: 0
DFF: 0
JKFF: 0
TFF: 0
SRFF: 0
Circuit Depth: 7
Size of Largest Level: 10
Size of Largest Intermediate Level: 4
Maximum Fan-In: 2
Maximum Fan-Out: 3
Average Fan-In: 1.3
Average Fan-Out: 1.3 P

34. Canonical Form (SOP/POS)
Hands On
Let’s perform program encryption transformation on our circuit P EK
10 INPUTS
5 OUTPUTS +
P’’
Canonical Form (SOP/POS)
QM Minimization
fP’’ P’

35. Let’s the run the component identifier on our P’
Hands On
Let’s the run the component identifier on our P’

36. Summary of Program Encryption+ Ek P’

37. Summary of Program Encryption
A legitimate user of P’ can reproduce the functionality of P with the decryption circuit D: P’ D fP

38. What’s the relationship between P and P’?
Some things about P’
There is no seam ( P + E )
There are no components related to P or E
There is no topology related to P or E
There is nothing directly tied to the structure/configuration of P or E
There is ONLY the information necessary to compute:
P’(x) = EK(P(x)), x

39. Some Things You Learned Today
How to write a logic circuit program
How to analyze a circuit’s function or structure
Why circuit protection is a problem
Key Concepts
Evaluating logic statements
Digital logic components
Logic functions and truth tables
Canonical circuit forms
Circuit protection techniques
Polymorphism / obfuscation
Program encryption

40. Thank You for Coming!