Security through Obscurity: Layout Obfuscation of Digital Integrated Circuits using Don't Care Conditions

Contemporary integrated circuits are designed and manufactured in a globalized environment leading to concerns of piracy, overproduction and counterfeiting. One class of techniques to combat these threats is circuit obfuscation which seeks to modify the gate-level (or structural) description of a circuit without affecting its functionality in order to increase the complexity and cost of reverse engineering. Most of the existing circuit obfuscation methods are based on the insertion of additional logic (called “key gates”) or camouflaging existing gates in order to make it difficult for a malicious user to get the complete layout information without extensive computations to determine key-gate values. However, when the netlist or the circuit layout, although camouflaged, is available to the attacker, he/she can use advanced logic analysis and circuit simulation tools and Boolean SAT solvers to reveal the unknown gate-level information without exhaustively trying all the input vectors, thus bringing down the complexity of reverse engineering. To counter this problem, some ‘provably secure’ logic encryption algorithms that emphasize methodical selection of camouflaged gates have been proposed previously in literature [1,2,3]. The contribution of this paper is the creation and simulation of a new layout obfuscation method that uses don't care conditions. We also present proof-of-concept of a new functional or logic obfuscation technique that not only conceals, but modifies the circuit functionality in addition to the gate-level description, and can be implemented automatically during the design process. Our layout obfuscation technique utilizes don’t care conditions (namely, Observability and Satisfiability Don’t Cares) inherent in the circuit to camouflage selected gates and modify sub-circuit functionality while meeting the overall circuit specification. Here, camouflaging or obfuscating a gate means replacing the candidate gate by a 4X1 Multiplexer which can be configured to perform all possible 2-input/ 1-output functions as proposed by Bao et al. [4]. It is important to emphasize that our approach not only obfuscates but alters sub-circuit level functionality in an attempt to make IP piracy difficult. The choice of gates to obfuscate determines the effort required to reverse engineer or brute force the design. As such, we propose a method of camouflaged gate selection based on the intersection of output logic cones. By choosing these candidate gates methodically, the complexity of reverse engineering can be made exponential, thus making it computationally very expensive to determine the true circuit functionality. We propose several heuristic algorithms to maximize the RE complexity based on don’t care based obfuscation and methodical gate selection. Thus, the goal of protecting the design IP from malicious end-users is achieved. It also makes it significantly harder for rogue elements in the supply chain to use, copy or replicate the same design with a different logic. We analyze the reverse engineering complexity by applying our obfuscation algorithm on ISCAS-85 benchmarks. Our experimental results indicate that significant reverse engineering complexity can be achieved at minimal design overhead (average area overhead for the proposed layout obfuscation methods is 5.51% and average delay overhead is about 7.732%). We discuss the strengths and limitations of our approach and suggest directions that may lead to improved logic encryption algorithms in the future. References: [1] R. Chakraborty and S. Bhunia, “HARPOON: An Obfuscation-Based SoC Design Methodology for Hardware Protection,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 28, no. 10, pp. 1493–1502, 2009. [2] J. A. Roy, F. Koushanfar, and I. L. Markov, “EPIC: Ending Piracy of Integrated Circuits,” in 2008 Design, Automation and Test in Europe, 2008, pp. 1069–1074. [3] J. Rajendran, M. Sam, O. Sinanoglu, and R. Karri, “Security Analysis of Integrated Circuit Camouflaging,” ACM Conference on Computer Communications and Security, 2013. [4] Bao Liu, Wang, B., "Embedded reconfigurable logic for ASIC design obfuscation against supply chain attacks,"Design, Automation and Test in Europe Conference and Exhibition (DATE), 2014 , vol., no., pp.1,6, 24-28 March 2014.

Photonic integrated circuits development: a universal transceiver for NG-PON2

In the last years there has been a clear evolution in the world of telecommunications, which goes from new services that need higher speeds and higher bandwidth, until a role of interactions between people and machines, named by Internet of Things (IoT). So, the only technology able to follow this growth is the optical communications. Currently the solution that enables to overcome the day-by-day needs, like collaborative job, audio and video communications and share of les is based on Gigabit-capable Passive Optical Network (G-PON) with the recently successor named Next Generation Passive Optical Network Phase 2 (NG-PON2). This technology is based on the multiplexing domain wavelength and due to its characteristics and performance becomes the more advantageous technology. A major focus of optical communications are Photonic Integrated Circuits (PICs). These can include various components into a single device, which simpli es the design of the optical system, reducing space and power consumption, and improves reliability. These characteristics make this type of devices useful for several applications, that justi es the investments in the development of the technology into a very high level of performance and reliability in terms of the building blocks. With the goal to develop the optical networks of future generations, this work presents the design and implementation of a PIC, which is intended to be a universal transceiver for applications for NG-PON2. The same PIC will be able to be used as an Optical Line Terminal (OLT) or an Optical Network Unit (ONU) and in both cases as transmitter and receiver. Initially a study is made of Passive Optical Network (PON) and its standards. Therefore it is done a theoretical overview that explores the materials used in the development and production of this PIC, which foundries are available, and focusing in SMART Photonics, the components used in the development of this chip. For the conceptualization of the project di erent architectures are designed and part of the laser cavity is simulated using Aspic™. Through the analysis of advantages and disadvantages of each one, it is chosen the best to be used in the implementation. Moreover, the architecture of the transceiver is simulated block by block through the VPItransmissionMaker™ and it is demonstrated its operating principle. Finally it is presented the PIC implementation.

Photonic packaging: transforming silicon photonic integrated circuits into photonic devices

Dedicated multi-project wafer (MPW) runs for photonic integrated circuits (PICs) from Si foundries mean that researchers and small-to-medium enterprises (SMEs) can now afford to design and fabricate Si photonic chips. While these bare Si-PICs are adequate for testing new device and circuit designs on a probe-station, they cannot be developed into prototype devices, or tested outside of the laboratory, without first packaging them into a durable module. Photonic packaging of PICs is significantly more challenging, and currently orders of magnitude more expensive, than electronic packaging, because it calls for robust micron-level alignment of optical components, precise real-time temperature control, and often a high degree of vertical and horizontal electrical integration. Photonic packaging is perhaps the most significant bottleneck in the development of commercially relevant integrated photonic devices. This article describes how the key optical, electrical, and thermal requirements of Si-PIC packaging can be met, and what further progress is needed before industrial scale-up can be achieved.

Analysis of the gate capacitance measurement technique and its application for the evaluation of hot-carrier degradation in submicrometer MOSFETs

The use of gate-to-drain capacitance (C-gd) measurement as a tool to characterize hot-carrier-induced charge centers in submicron n- and p-MOSFET's has been reviewed and demonstrated. By analyzing the change in C-gd measured at room and cryogenic temperature before and after high gate-to-drain transverse field (high field) and maximum substrate current (I-bmax) stress, it is concluded that the degradation was found to be mostly due to trapping of majority carriers and generation of interface states. These interface states were found to be acceptor states at top half of band gap for n-MOSFETs and donor states at bottom half of band gap for p-MOSFETs. In general, hot electrons are more likely to be trapped in gate oxide as compared to hot holes while the presence of hot holes generates more interface states. Also, we have demonstrated a new method for extracting the spatial distribution of oxide trapped charge, Q(ot), through gate-to-substrate capacitance (C-gb) measurement. This method is simple to implement and does not require additional information from simulation or detailed knowledge of the device's structure. (C) 2001 Elsevier Science Ltd. All rights reserved.

A new method of threshold voltage extraction via MOSFET gate-to-substrate capacitance measurement

A new method to extract MOSFET's threshold voltage VT by measurement of the gate-to-substrate capacitance C-gb of the transistor is presented. Unlike existing extraction methods based on I-V data, the measurement of C-gb does not require de drain current to now between drain and source thus eliminating the effects of source and drain series resistance R-S/D, and at the same time, retains a symmetrical potential profile across the channel. Experimental and simulation results on devices with different sizes are presented to justify the proposed method.

Dopant extraction from scanning capacitance microscopy measurements of p-n junctions using combined inverse modeling and forward simulation

This article proposes a more accurate approach to dopant extraction using combined inverse modeling and forward simulation of scanning capacitance microscopy (SCM) measurements on p-n junctions. The approach takes into account the essential physics of minority carrier response to the SCM probe tip in the presence of lateral electric fields due to a p-n junction. The effects of oxide fixed charge and interface state densities in the grown oxide layer on the p-n junction samples were considered in the proposed method. The extracted metallurgical and electrical junctions were compared to the apparent electrical junction obtained from SCM measurements. (C) 2002 American Institute of Physics.

Characteristics of small-signal capacitances of silicon-on-sapphire MOSFETs

The measured inter-electrode capacitances of silicon-on-sapphire (SOS) MOSFETs are presented and compared with simulation results. It is shown that the variations of capacitances with DC bias differ from those of bulk MOSFETs due to change in body potential variation of the SOS device resulting from electron-hole pair generation through impact ionisation.

Experimental investigation of interface states and photovoltaic effects on the scanning capacitance microscopy measurement for p-n junction dopant profiling

Controlled polishing procedures were used to produce both uniformly doped and p-n junction silicon samples with different interface state densities but identical oxide thicknesses. Using these samples, the effects of interface states on scanning capacitance microscopy (SCM) measurements could be singled out. SCM measurements on the junction samples were performed with and without illumination from the atomic force microscopy laser. Both the interface charges and the illumination were seen to affect the SCM signal near p-n junctions significantly. SCM p-n junction dopant profiling can be achieved by avoiding or correctly modeling these two factors in the experiment and in the simulation. (c) 2005 American Institute of Physics.

A bang-bang PLL employing dynamic gain control for low jitter and fast lock times

Bang-bang phase detector based PLLs are simple to design, suffer no systematic phase error, and can run at the highest speed a process can make a working flip-flop. For these reasons designers are employing them in the design of very high speed Clock Data Recovery (CDR) architectures. The major drawback of this class of PLL is the inherent jitter due to quantized phase and frequency corrections. Reducing loop gain can proportionally improve jitter performance, but also reduces locking time and pull-in range. This paper presents a novel PLL design that dynamically scales its gain in order to achieve fast lock times while improving fitter performance in lock. Under certain circumstances the design also demonstrates improved capture range. This paper also analyses the behaviour of a bang-bang type PLL when far from lock, and demonstrates that the pull-in range is proportional to the square root of the PLL loop gain.

An efficient algorithm for partitioning parameterized polygons into rectangles

In this paper, we propose an algorithm for partitioning parameterized orthogonal polygons into rectangles. The algorithm is based on the plane-sweep technique and can be used for partitioning polygons which contain holes. The input to the algorithm consists of the contour of a parameterized polygon to be partitioned and the constraints for those parameters which reside in the contour. The algorithm uses horizontal cuts only and generates a minimum number of rectangles whose union is the original orthogonal polygon. The proposed algorithm can be used as the basis to build corner stitching data structure for parameterized VLSI layouts and has been implemented in Java programming language. Copyright © 2010 ACM, Inc.