发表机构
Max Planck Institute for Security and Privacy（马克斯·普朗克安全与隐私研究所）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文提出一种布局感知方法，从制造后IC的时钟分配网络中恢复设计意图，通过四阶段流程恢复时钟树拓扑、缓冲、门控等，并在450纳米IC上验证，开源算法以支持复现。
AI 中文摘要
硬件逆向工程通过从集成电路（IC）的物理实现中恢复信息，支持竞争分析和硬件保障。虽然现有技术主要恢复表示逻辑功能的门级网表，但它们往往忽略了物理设计决策，如布局、布线、延迟插入和互连优化。时钟分配网络封装了许多这些决策；然而，先前没有已发表的工作从制造后的IC中恢复该网络以推断设计意图。我们提出了一种布局感知方法，通过将恢复的门级网表与从扫描电子显微镜图像中提取的布局信息相结合，来恢复和分析时钟分配网络。我们的四阶段流程恢复了时钟树拓扑、缓冲、门控和切换、互连延迟以及串扰缓解措施。我们在一个商业450纳米IC上展示了我们的方法，恢复了具有局部X树状分支的全局H树主干，识别了独立的时钟树和全局时钟门控，量化了延迟、偏斜和布线长度，并确认了没有专门的串扰缓解措施。总之，这些发现使我们能够推理设计者的意图。为了鼓励进一步研究并支持可复现性，我们将我们的时钟树恢复算法作为开源发布。
英文摘要
Hardware reverse engineering supports competitive analysis and hardware assurance by recovering information about an integrated circuit (IC) from its physical implementation. While existing techniques primarily recover the gate-level netlist, which represents logical functionality, they often overlook physical design decisions such as placement, routing, delay insertion, and interconnect optimization. The clock distribution network encapsulates many of these decisions; however, no prior published work has recovered this network from a fabricated IC to infer design intent. We present a layout-aware methodology that recovers and analyzes the clock distribution network by integrating a recovered gate-level netlist with layout information extracted from scanning electron microscope imagery. Our four-phase pipeline recovers clock-tree topology, buffering, gating and switching, interconnect delay, and crosstalk-mitigation measures. We demonstrate our methodology on a commercial 450 nm IC, recovering a global H-tree backbone with local X-tree-like branching, identifying an independent clock tree and global clock gating, quantifying latency, skew, and routing lengths, and confirming the absence of dedicated crosstalk mitigation. Together, these findings let us reason about the designer's intent. To encourage further research and support reproducibility, we release our clock tree recovery algorithm as open source.
CommentsAccepted at the IEEE International Conference on Physical Assurance and Inspection of Electronics (PAINE) 2026
