{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,16]],"date-time":"2026-10-16T21:20:21Z","timestamp":1792185621904,"version":"4.4.0"},"reference-count":74,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2019,4,18]],"date-time":"2019-04-18T00:00:00Z","timestamp":1555545600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["1526405"],"award-info":[{"award-number":["1526405"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Des. Autom. Electron. Syst."],"published-print":{"date-parts":[[2019,7,31]]},"abstract":"<jats:p>Fabless semiconductor companies design system-on-chips (SoC) by using third-party intellectual property (IP) cores and fabricate them in offshore, potentially untrustworthy foundries. Owing to the globally distributed electronics supply chain, security has emerged as a serious concern. In this article, we explore electronics computer-aided design (CAD) software as a threat vector that can be exploited to introduce vulnerabilities into the SoC. We show that all electronics CAD tools\u2014high-level synthesis, logic synthesis, physical design, verification, test, and post-silicon validation\u2014are potential threat vectors to different degrees. We have demonstrated CAD-based attacks on several benchmarks, including the commercial ARM Cortex M0 processor\u00a0[1].<\/jats:p>","DOI":"10.1145\/3315574","type":"journal-article","created":{"date-parts":[[2019,4,19]],"date-time":"2019-04-19T16:56:23Z","timestamp":1555692983000},"page":"1-30","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":51,"title":["CAD-Base"],"prefix":"10.1145","volume":"24","author":[{"given":"Kanad","family":"Basu","sequence":"first","affiliation":[{"name":"New York University, Brooklyn, NY, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Samah Mohamed","family":"Saeed","sequence":"additional","affiliation":[{"name":"City University of New York, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Christian","family":"Pilato","sequence":"additional","affiliation":[{"name":"Politecnico di Milano, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mohammed","family":"Ashraf","sequence":"additional","affiliation":[{"name":"New York University, Abu Dhabi, UAE"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mohammed Thari","family":"Nabeel","sequence":"additional","affiliation":[{"name":"New York University, Abu Dhabi, UAE"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Krishnendu","family":"Chakrabarty","sequence":"additional","affiliation":[{"name":"Duke University, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ramesh","family":"Karri","sequence":"additional","affiliation":[{"name":"New York University, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,4,18]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"The Definitive Guide to Arm\u00ae Cortex\u00ae-m0 and Cortex-m0+ Processors","author":"Yiu Joseph","unstructured":"Joseph Yiu . 2015. The Definitive Guide to Arm\u00ae Cortex\u00ae-m0 and Cortex-m0+ Processors . Academic Press . Joseph Yiu. 2015. The Definitive Guide to Arm\u00ae Cortex\u00ae-m0 and Cortex-m0+ Processors. Academic Press."},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.10"},{"key":"e_1_2_1_3_1","volume-title":"Fabless Semiconductor Implementation","author":"Kumar Rakesh","unstructured":"Rakesh Kumar . 2008. Fabless Semiconductor Implementation . McGraw-Hill, Inc. Rakesh Kumar. 2008. Fabless Semiconductor Implementation. McGraw-Hill, Inc."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/HST.2011.5954998"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/HLDVT.2009.5340158"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40349-1_12"},{"key":"e_1_2_1_8_1","unstructured":"https:\/\/iebms.heiexpo.com\/iebms\/oep\/oep_p1_exhibitors.aspx?oc&equals;17&ct&equals;&equals;&equals;OEP&eventid&equals;&equals;&equals;5001.  https:\/\/iebms.heiexpo.com\/iebms\/oep\/oep_p1_exhibitors.aspx?oc&equals;17&ct&equals;&equals;&equals;OEP&eventid&equals;&equals;&equals;5001."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISQED.2014.6783318"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/MDT.2008.166"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2010.284"},{"key":"e_1_2_1_12_1","volume-title":"Counterfeit Integrated Circuits","author":"Tehranipoor Mark Mohammad","unstructured":"Mark Mohammad Tehranipoor , Ujjwal Guin , and Domenic Forte . 2015. Counterfeit integrated circuits . In Counterfeit Integrated Circuits . Springer , 15--36. Mark Mohammad Tehranipoor, Ujjwal Guin, and Domenic Forte. 2015. Counterfeit integrated circuits. In Counterfeit Integrated Circuits. Springer, 15--36."},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2006.20"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2015.2513673"},{"key":"e_1_2_1_15_1","first-page":"903","article-title":"Logic emulator using a disposable wire-wrap interconnect board with an FPGA emulation board. (May 11, 1999)","volume":"5","author":"Hui-Wan Tseng Allen","year":"1999","unstructured":"Allen Hui-Wan Tseng , Hung Van Tang , and Vinh Coung Ta . 1999 . Logic emulator using a disposable wire-wrap interconnect board with an FPGA emulation board. (May 11, 1999) . US Patent 5 , 903 ,744. Allen Hui-Wan Tseng, Hung Van Tang, and Vinh Coung Ta. 1999. Logic emulator using a disposable wire-wrap interconnect board with an FPGA emulation board. (May 11, 1999). US Patent 5,903,744.","journal-title":"US Patent"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0065-2458(03)58003-2"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/TEST.2015.7342387"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2897937.2897992"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/TVLSI.2012.2192457"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/TEST.2011.6139157"},{"key":"e_1_2_1_21_1","first-page":"1","article-title":"Designing and implementing malicious hardware","volume":"8","author":"King Samuel T.","year":"2008","unstructured":"Samuel T. King , Joseph Tucek , Anthony Cozzie , Chris Grier , Weihang Jiang , and Yuanyuan Zhou . 2008 . Designing and implementing malicious hardware . Leet 8 (2008), 1 -- 8 . Samuel T. King, Joseph Tucek, Anthony Cozzie, Chris Grier, Weihang Jiang, and Yuanyuan Zhou. 2008. Designing and implementing malicious hardware. Leet 8 (2008), 1--8.","journal-title":"Leet"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.18"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978396"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.27"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD.2011.6081413"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/1687399.1687425"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/DATE.2011.5763307"},{"key":"e_1_2_1_28_1","volume-title":"Trust in integrated circuits (TIC). DARPA Solicitation BAA07-24","author":"Collins D.","year":"2007","unstructured":"D. Collins . 2007. Trust in integrated circuits (TIC). DARPA Solicitation BAA07-24 ( 2007 ). D. Collins. 2007. Trust in integrated circuits (TIC). DARPA Solicitation BAA07-24 (2007)."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/HST.2009.5224959"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2014.2334493"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/MDT.2010.7"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2007.36"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/HST.2008.4559038"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516654"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.32"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASPDAC.2017.7858388"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/HST.2008.4559052"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/2638555"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/1837274.1837435"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/1278480.1278547"},{"key":"e_1_2_1_41_1","doi-asserted-by":"crossref","unstructured":"W. Chen S. Ray J. Bhadra M. Abadir and L. C. Wang. 2017. Challenges and trends in modern SoC design verification. IEEE Design 8 Test 34 5 (Oct. 2017) 7--22.  W. Chen S. Ray J. Bhadra M. Abadir and L. C. Wang. 2017. Challenges and trends in modern SoC design verification. IEEE Design 8 Test 34 5 (Oct. 2017) 7--22.","DOI":"10.1109\/MDAT.2017.2735383"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516654"},{"key":"e_1_2_1_43_1","doi-asserted-by":"crossref","unstructured":"P. Derbez P.-A. Fouque and J. Jean. 2013. Improved key recovery attacks on reduced-round AES in the single-key setting. In Advances in Cryptology\u2014EUROCRYPT 2013 T. Johansson and P. Nguyen (Eds.). Springer 371--387.  P. Derbez P.-A. Fouque and J. Jean. 2013. Improved key recovery attacks on reduced-round AES in the single-key setting. In Advances in Cryptology\u2014EUROCRYPT 2013 T. Johansson and P. Nguyen (Eds.). Springer 371--387.","DOI":"10.1007\/978-3-642-38348-9_23"},{"key":"e_1_2_1_44_1","doi-asserted-by":"crossref","unstructured":"S. K. Sanadhya and P. Sarkar. 2008. Attacking reduced round SHA-256. In Applied Cryptography and Network Security S. M. Bellovin R. Gennaro A. Keromytis and M. Yung (Eds.). Springer 130--143.   S. K. Sanadhya and P. Sarkar. 2008. Attacking reduced round SHA-256. In Applied Cryptography and Network Security S. M. Bellovin R. Gennaro A. Keromytis and M. Yung (Eds.). Springer 130--143.","DOI":"10.1007\/978-3-540-68914-0_8"},{"key":"e_1_2_1_45_1","volume-title":"Proceedings of the International Conference on Field-Programmable Logic and Applications. 1--4.","author":"Pilato C.","unstructured":"C. Pilato and F. Ferrandi . 2013. Bambu: A modular framework for the high-level synthesis of memory-intensive applications . In Proceedings of the International Conference on Field-Programmable Logic and Applications. 1--4. C. Pilato and F. Ferrandi. 2013. Bambu: A modular framework for the high-level synthesis of memory-intensive applications. In Proceedings of the International Conference on Field-Programmable Logic and Applications. 1--4."},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.2197\/ipsjjip.17.242"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/IISWC.2014.6983050"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/3126564"},{"key":"e_1_2_1_49_1","doi-asserted-by":"crossref","unstructured":"P. Fezzardi C. Pilato and F. Ferrandi. 2018. Enabling automated bug detection for IP-based designs using high-level synthesis. IEEE Design 8 Test 35 5 (2018) 54--62.  P. Fezzardi C. Pilato and F. Ferrandi. 2018. Enabling automated bug detection for IP-based designs using high-level synthesis. IEEE Design 8 Test 35 5 (2018) 54--62.","DOI":"10.1109\/MDAT.2018.2824121"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCAD.2016.2587278"},{"key":"e_1_2_1_51_1","volume-title":"Proceedings of the Design, Automation Test in Europe Conference Exhibition. 1--2.","author":"Subramanyan P.","unstructured":"P. Subramanyan and D. Arora . 2014. Formal verification of taint-propagation security properties in a commercial SoC design . In Proceedings of the Design, Automation Test in Europe Conference Exhibition. 1--2. P. Subramanyan and D. Arora. 2014. Formal verification of taint-propagation security properties in a commercial SoC design. In Proceedings of the Design, Automation Test in Europe Conference Exhibition. 1--2."},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/VLSID.2016.143"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/2744769.2744823"},{"key":"e_1_2_1_54_1","unstructured":"Clifford Wolf. Formal verification with SymbiYosys and Yosys-SMTBMC. Retrieved from http:\/\/www.clifford.at\/papers\/2017\/smtbmc-sby\/.  Clifford Wolf. Formal verification with SymbiYosys and Yosys-SMTBMC. Retrieved from http:\/\/www.clifford.at\/papers\/2017\/smtbmc-sby\/."},{"key":"e_1_2_1_55_1","unstructured":"M. Tehranipoor R. Karri F. Koushanfar and M. Potkonjak. Trusthub. Retrieved from http:\/\/trust-hub.org.  M. Tehranipoor R. Karri F. Koushanfar and M. Potkonjak. Trusthub. Retrieved from http:\/\/trust-hub.org."},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/TC.1972.5009015"},{"key":"e_1_2_1_57_1","volume-title":"Synopsys Users Group Meeting. http:\/\/www.averant.com\/storage\/documents\/Verilog_X_Bugs.pdf.","author":"Turpin Mike","year":"2003","unstructured":"Mike Turpin . 2003 . The dangers of living with an X (bugs hidden in your verilog) . In Synopsys Users Group Meeting. http:\/\/www.averant.com\/storage\/documents\/Verilog_X_Bugs.pdf. Mike Turpin. 2003. The dangers of living with an X (bugs hidden in your verilog). In Synopsys Users Group Meeting. http:\/\/www.averant.com\/storage\/documents\/Verilog_X_Bugs.pdf."},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1109\/43.265680"},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/TEST.2003.1271098"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSE.2007.44"},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.5555\/339492.340030"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.5555\/1191824.1192146"},{"key":"e_1_2_1_63_1","first-page":"53","article-title":"Pattern-related defects become subtler, deadlier","volume":"28","author":"Braun Alexander E.","year":"2005","unstructured":"Alexander E. Braun . 2005 . Pattern-related defects become subtler, deadlier . Semicond. Int. 28 , 6 (2005), 53 -- 60 . Alexander E. Braun. 2005. Pattern-related defects become subtler, deadlier. Semicond. Int. 28, 6 (2005), 53--60.","journal-title":"Semicond. Int."},{"key":"e_1_2_1_64_1","volume-title":"Advanced ASIC Chip Synthesis: Using Synopsys\u00ae Design CompilerTM Physical CompilerTM and PrimeTime\u00ae","author":"Bhatnagar Himanshu","unstructured":"Himanshu Bhatnagar . 2007. Advanced ASIC Chip Synthesis: Using Synopsys\u00ae Design CompilerTM Physical CompilerTM and PrimeTime\u00ae . Springer Science 8 Business Media. Himanshu Bhatnagar. 2007. Advanced ASIC Chip Synthesis: Using Synopsys\u00ae Design CompilerTM Physical CompilerTM and PrimeTime\u00ae. Springer Science 8 Business Media."},{"key":"e_1_2_1_65_1","volume-title":"d.}). Retrieved on","year":"2018","unstructured":"Opencores.org. ({n. d.}). Retrieved on May 31, 2018 from https:\/\/opencores.org\/. Opencores.org. ({n. d.}). Retrieved on May 31, 2018 from https:\/\/opencores.org\/."},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1145\/1120725.1120856"},{"key":"e_1_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1109\/ATS.2012.61"},{"key":"e_1_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.5555\/2132325.2132461"},{"key":"e_1_2_1_69_1","first-page":"93","volume-title":"Atalanta: An Efficient ATPG for Combinational Circuits. Technical Report","author":"Lee H. K.","year":"1993","unstructured":"H. K. Lee and D. S. Ha . 1993 . Atalanta: An Efficient ATPG for Combinational Circuits. Technical Report , 93 - 12 , Dept. of Electrical Eng., Virginia Polytechnic Institute and State University , Blacksburg, VA. H. K. Lee and D. S. Ha. 1993. Atalanta: An Efficient ATPG for Combinational Circuits. Technical Report, 93-12, Dept. of Electrical Eng., Virginia Polytechnic Institute and State University, Blacksburg, VA."},{"key":"e_1_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04138-9_28"},{"key":"e_1_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1145\/266021.266090"},{"key":"e_1_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1109\/MDT.2004.1277905"},{"key":"e_1_2_1_73_1","volume-title":"Symbolic Model Checking","author":"McMillan Kenneth L.","unstructured":"Kenneth L. McMillan . 1993. Symbolic model checking . In Symbolic Model Checking . Springer , 25--60. Kenneth L. McMillan. 1993. Symbolic model checking. In Symbolic Model Checking. Springer, 25--60."},{"key":"e_1_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.1145\/800157.805047"},{"key":"e_1_2_1_75_1","volume-title":"Elmasry","author":"Gebotys Catherine H.","year":"1988","unstructured":"Catherine H. Gebotys and Mohamed I . Elmasry . 1988 . VLSI design synthesis with testability. In Proceedings of the 25th ACM\/IEEE Design Automation Conference. IEEE Computer Society Press , 16--21. Catherine H. Gebotys and Mohamed I. Elmasry. 1988. VLSI design synthesis with testability. In Proceedings of the 25th ACM\/IEEE Design Automation Conference. IEEE Computer Society Press, 16--21."}],"container-title":["ACM Transactions on Design Automation of Electronic Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3315574","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3315574","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3315574","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:53:34Z","timestamp":1750204414000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3315574"}},"subtitle":["An Attack Vector into the Electronics Supply Chain"],"short-title":[],"issued":{"date-parts":[[2019,4,18]]},"references-count":74,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2019,7,31]]}},"alternative-id":["10.1145\/3315574"],"URL":"https:\/\/doi.org\/10.1145\/3315574","relation":{},"ISSN":["1084-4309","1557-7309"],"issn-type":[{"value":"1084-4309","type":"print"},{"value":"1557-7309","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,4,18]]},"assertion":[{"value":"2018-06-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-02-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-04-18","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}