side-channel analysis

Existing hardware IP protection mechanisms exhibit fundamental vulnerabilities against highly capable adversaries with supply-chain privileges. This paper introduces a novel reverse-engineering methodology: first constructing a candidate library based on known IP signatures, then leveraging commercial EDA tools—specifically Synopsys Design Compiler—for structural comparison and netlist similarity measurement to accurately identify and reconstruct target IPs. This work establishes the first updated threat model explicitly targeting privileged supply-chain adversaries and pioneers the “design knowledge base + structural matching” paradigm for IP recovery. It systematically exposes the failure mechanisms of mainstream protection techniques—including obfuscation and camouflaging—under realistic supply-chain conditions. Experimental validation on transformed ISCAS’89 benchmark circuits confirms the method’s efficacy. The approach provides a more pragmatic and quantifiable framework for hardware security evaluation.

This study addresses the lack of a unified, quantifiable evaluation framework for hardware reverse engineering attacks, which hinders effective comparison and mitigation of diverse threats. Through expert interviews, the authors extend the qualitative CRESS scoring system into the first computable quantitative severity model by incorporating expert-derived weights into a formal scoring formula. The proposed approach integrates weight analysis, quantitative modeling, and empirical validation, demonstrating successful application across six real-world attack scenarios. Results show that CRESS offers greater expressiveness and adaptability compared to CVSS, thereby providing robust support for assessing emerging hardware-level threats and informing defensive design strategies.

Hardware reverse engineering (HRE) research has long suffered from fragmentation and a lack of systematic integration, impeding rigorous technical evaluation and reproducibility. This work presents the first systematization of knowledge (SoK) based on a comprehensive review of 187 peer-reviewed publications over the past two decades, focusing on integrated circuits, FPGAs, and netlist-level reverse engineering. We introduce an artifact-centric reproducibility framework, complemented by benchmark analyses and a survey of relevant legal and policy considerations. Empirical assessment reveals that only seven studies (4%) are fully reproducible. Building on these findings, we propose three key recommendations: enhancing artifact reusability, establishing unified evaluation benchmarks, and clarifying the legal boundaries of HRE research. Collectively, these contributions offer a roadmap to foster interdisciplinary collaboration and advance the field in a principled, reproducible manner.

Existing runtime side-channel vulnerability mitigation techniques often overlook hardware-specific characteristics, leading to over-mitigation, under-mitigation, or outright failure. This work proposes a novel hardware-software co-designed automated repair approach that, for the first time, integrates actual timing measurements from target embedded devices into the mitigation process. By combining empirical hardware timing analysis with software code transformation techniques, the method generates precise and efficient countermeasures applicable to C, C++, and Java source code. Experimental evaluation across five embedded and edge platforms demonstrates that the proposed approach significantly outperforms state-of-the-art tools such as PENDULUM and DifFuzzAR in terms of execution overhead, code size, and correctness.

This work addresses the lack of efficient and scalable tamper detection mechanisms for microcontrollers in semiconductor supply chains, where existing high-assurance approaches are often costly and slow. The authors propose a non-invasive screening method that, for the first time, leverages a generative adversarial network (GAN) trained exclusively on benign samples to analyze out-of-band power side-channel signals. This enables one-class anomaly detection without requiring trusted hardware or labeled data. By integrating differential power analysis with generative modeling, the approach demonstrates effectiveness across diverse firmware and hardware Trojan scenarios. It establishes an intermediate assurance tier between rapid screening and expensive forensic analysis, offering a practical tool that balances efficiency and reliability for supply chain security.

This work addresses the challenges of limited scalability and insufficient attribution accuracy in identifying root causes of power side-channel leakage during pre-silicon processor design. The paper introduces SPARC, a novel framework that enables, for the first time, automated and highly accurate end-to-end leakage detection and root-cause tracing in the pre-silicon phase. SPARC achieves this by performing macrocell-level information flow tracking and employing enhanced shadow logic to tag key-dependent switching activity, which is then correlated with software instructions through statistical leakage testing. Evaluation on multiple open-source RISC-V processors demonstrates that SPARC not only reproduces known vulnerabilities but also uncovers previously unknown microarchitectural side channels, while achieving an 8× speedup in single-trace simulation compared to existing approaches.

This study addresses the growing threat to hardware supply chain security and the longstanding absence of systematic educational frameworks and skilled professionals in hardware reverse engineering. To bridge this gap, the authors designed and iteratively refined an undergraduate course focused on digital circuit analysis and extraction, implemented over nine academic cycles spanning nine years. The work proposes design principles for curricula in rapidly evolving technical domains, emphasizing continuous content updates and sustainable workload management for both instructors and students. Integrating hands-on reverse engineering exercises, dynamic instructional development, and a closed-loop assessment mechanism, the course has successfully prepared multiple cohorts for careers in the field. Furthermore, it yields a transferable set of teaching priorities and a replicable curriculum model, effectively filling a critical void in structured hardware reverse engineering education.

This study addresses the instability of side-channel leakage detection caused by variations in electromagnetic probe placement, which severely limits the transferability of cross-device attacks. To overcome this challenge, the authors propose a unified deep learning model trained on electromagnetic traces collected simultaneously from multiple probe positions, enabling, for the first time, effective capture of leakage information across a larger area of the target chip. This approach significantly enhances the robustness and transferability of side-channel attacks under varying probe locations and across different devices. The method’s stability and effectiveness in cross-environment attack scenarios are rigorously validated using datasets acquired independently in two distinct laboratories.

This work addresses a novel threat in the fabless semiconductor model, wherein standard cell libraries themselves are exploited as potential attack vectors for hardware Trojan (HT) insertion. We propose a new threat model in which a malicious foundry activates dormant Trojan cells during manufacturing, thereby evading detection at the design stage. Leveraging both open-source and industrial-grade EDA tools, we construct compromised cell libraries for Saed32nm and Sky130nm technologies capable of embedding arbitrary HTs, and demonstrate their feasibility on real-world circuits such as AES-128 and an Ethernet controller. Experimental results show that circuits synthesized with the infected libraries exhibit negligible deviations from clean counterparts in critical metrics—including area, cell count, and power consumption—rendering them indistinguishable to conventional design-time verification techniques and underscoring the stealth and practicality of this attack.

Existing hardware Trojan detection methods struggle to identify stealthy Trojans embedded within standard cell libraries provided by untrusted vendors, creating a critical blind spot in security verification. This work proposes the first automated framework capable of generating cell-level hardware Trojans by identifying standard cell instances activated under rare input conditions in post-mapping circuits and injecting malicious payloads that trigger only under those specific conditions. By integrating circuit mapping analysis, rare-input pattern detection, and trigger-payload template injection, the approach supports diverse cell types in both combinational and sequential circuits. High-stealth Trojans generated on open-source benchmark circuits demonstrate the practical feasibility of such attacks, exposing a fundamental gap in current zero-trust IC design flows: the absence of cell-level verification mechanisms.