Abstract:

With the horizontalization of integrated circuit (IC) design and globalization of manufacturing,a large number of hardware ICs produced by third-party vendors are used in the chip design,which raises concerns about design backdoors/hardware Trojan horses being inserted into chips.Reverse engineering can recover the design netlist of IC chips,and designers can determine whether the design functions have been tampered with by extracting high-level descriptions and analyzing the key logic.However,the poor readability of the reverse netlist with its data paths and control logic mixed makes it difficult to abstract the high-level descriptions quickly and accurately.In this paper,the problem is equivalently defined as the classification problem of the netlist path structure,and an efficient state register identification algorithm based on the graph neural network is proposed.First,pre-processing of the netlist is conducted to eliminate the differences of the process library and to reduce the modeling complexity.Second,the netlist is modeled as the directed graph and the path structure of each register is extracted.Then the graph neural network model is used to map corresponding features of each register with the path structure inputted.Finally,the features are clustered so as to classify the registers into status registers and control registers.Experimental results prove that the algorithm can run correctly on a million-gate netlist with the average recognition accuracy reaching 88.37%,which is improved in recognition accuracy,operation speed and migratability compared with the existing algorithms.

Key words: reverse engineering, register classification, control logic extraction, graph neural networks