Security through Obscurity: Layout Obfuscation of Digital Integrated Circuits using Don't Care Conditions

Contemporary integrated circuits are designed and manufactured in a globalized environment leading to concerns of piracy, overproduction and counterfeiting. One class of techniques to combat these threats is circuit obfuscation which seeks to modify the gate-level (or structural) description of a circuit without affecting its functionality in order to increase the complexity and cost of reverse engineering. Most of the existing circuit obfuscation methods are based on the insertion of additional logic (called “key gates”) or camouflaging existing gates in order to make it difficult for a malicious user to get the complete layout information without extensive computations to determine key-gate values. However, when the netlist or the circuit layout, although camouflaged, is available to the attacker, he/she can use advanced logic analysis and circuit simulation tools and Boolean SAT solvers to reveal the unknown gate-level information without exhaustively trying all the input vectors, thus bringing down the complexity of reverse engineering. To counter this problem, some ‘provably secure’ logic encryption algorithms that emphasize methodical selection of camouflaged gates have been proposed previously in literature [1,2,3]. The contribution of this paper is the creation and simulation of a new layout obfuscation method that uses don't care conditions. We also present proof-of-concept of a new functional or logic obfuscation technique that not only conceals, but modifies the circuit functionality in addition to the gate-level description, and can be implemented automatically during the design process. Our layout obfuscation technique utilizes don’t care conditions (namely, Observability and Satisfiability Don’t Cares) inherent in the circuit to camouflage selected gates and modify sub-circuit functionality while meeting the overall circuit specification. Here, camouflaging or obfuscating a gate means replacing the candidate gate by a 4X1 Multiplexer which can be configured to perform all possible 2-input/ 1-output functions as proposed by Bao et al. [4]. It is important to emphasize that our approach not only obfuscates but alters sub-circuit level functionality in an attempt to make IP piracy difficult. The choice of gates to obfuscate determines the effort required to reverse engineer or brute force the design. As such, we propose a method of camouflaged gate selection based on the intersection of output logic cones. By choosing these candidate gates methodically, the complexity of reverse engineering can be made exponential, thus making it computationally very expensive to determine the true circuit functionality. We propose several heuristic algorithms to maximize the RE complexity based on don’t care based obfuscation and methodical gate selection. Thus, the goal of protecting the design IP from malicious end-users is achieved. It also makes it significantly harder for rogue elements in the supply chain to use, copy or replicate the same design with a different logic. We analyze the reverse engineering complexity by applying our obfuscation algorithm on ISCAS-85 benchmarks. Our experimental results indicate that significant reverse engineering complexity can be achieved at minimal design overhead (average area overhead for the proposed layout obfuscation methods is 5.51% and average delay overhead is about 7.732%). We discuss the strengths and limitations of our approach and suggest directions that may lead to improved logic encryption algorithms in the future. References: [1] R. Chakraborty and S. Bhunia, “HARPOON: An Obfuscation-Based SoC Design Methodology for Hardware Protection,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 28, no. 10, pp. 1493–1502, 2009. [2] J. A. Roy, F. Koushanfar, and I. L. Markov, “EPIC: Ending Piracy of Integrated Circuits,” in 2008 Design, Automation and Test in Europe, 2008, pp. 1069–1074. [3] J. Rajendran, M. Sam, O. Sinanoglu, and R. Karri, “Security Analysis of Integrated Circuit Camouflaging,” ACM Conference on Computer Communications and Security, 2013. [4] Bao Liu, Wang, B., "Embedded reconfigurable logic for ASIC design obfuscation against supply chain attacks,"Design, Automation and Test in Europe Conference and Exhibition (DATE), 2014 , vol., no., pp.1,6, 24-28 March 2014.

Modeling and simulation of a synthetic genetic circuit that implements a multicelled behavior in a growing microcolony of E. coli

Synthetic Biology is a relatively new discipline, born at the beginning of the New Millennium, that brings the typical engineering approach (abstraction, modularity and standardization) to biotechnology. These principles aim to tame the extreme complexity of the various components and aid the construction of artificial biological systems with specific functions, usually by means of synthetic genetic circuits implemented in bacteria or simple eukaryotes like yeast. The cell becomes a programmable machine and its low-level programming language is made of strings of DNA. This work was performed in collaboration with researchers of the Department of Electrical Engineering of the University of Washington in Seattle and also with a student of the Corso di Laurea Magistrale in Ingegneria Biomedica at the University of Bologna: Marilisa Cortesi. During the collaboration I contributed to a Synthetic Biology project already started in the Klavins Laboratory. In particular, I modeled and subsequently simulated a synthetic genetic circuit that was ideated for the implementation of a multicelled behavior in a growing bacterial microcolony. In the first chapter the foundations of molecular biology are introduced: structure of the nucleic acids, transcription, translation and methods to regulate gene expression. An introduction to Synthetic Biology completes the section. In the second chapter is described the synthetic genetic circuit that was conceived to make spontaneously emerge, from an isogenic microcolony of bacteria, two different groups of cells, termed leaders and followers. The circuit exploits the intrinsic stochasticity of gene expression and intercellular communication via small molecules to break the symmetry in the phenotype of the microcolony. The four modules of the circuit (coin flipper, sender, receiver and follower) and their interactions are then illustrated. In the third chapter is derived the mathematical representation of the various components of the circuit and the several simplifying assumptions are made explicit. Transcription and translation are modeled as a single step and gene expression is function of the intracellular concentration of the various transcription factors that act on the different promoters of the circuit. A list of the various parameters and a justification for their value closes the chapter. In the fourth chapter are described the main characteristics of the gro simulation environment, developed by the Self Organizing Systems Laboratory of the University of Washington. Then, a sensitivity analysis performed to pinpoint the desirable characteristics of the various genetic components is detailed. The sensitivity analysis makes use of a cost function that is based on the fraction of cells in each one of the different possible states at the end of the simulation and the wanted outcome. Thanks to a particular kind of scatter plot, the parameters are ranked. Starting from an initial condition in which all the parameters assume their nominal value, the ranking suggest which parameter to tune in order to reach the goal. Obtaining a microcolony in which almost all the cells are in the follower state and only a few in the leader state seems to be the most difficult task. A small number of leader cells struggle to produce enough signal to turn the rest of the microcolony in the follower state. It is possible to obtain a microcolony in which the majority of cells are followers by increasing as much as possible the production of signal. Reaching the goal of a microcolony that is split in half between leaders and followers is comparatively easy. The best strategy seems to be increasing slightly the production of the enzyme. To end up with a majority of leaders, instead, it is advisable to increase the basal expression of the coin flipper module. At the end of the chapter, a possible future application of the leader election circuit, the spontaneous formation of spatial patterns in a microcolony, is modeled with the finite state machine formalism. The gro simulations provide insights into the genetic components that are needed to implement the behavior. In particular, since both the examples of pattern formation rely on a local version of Leader Election, a short-range communication system is essential. Moreover, new synthetic components that allow to reliably downregulate the growth rate in specific cells without side effects need to be developed. In the appendix are listed the gro code utilized to simulate the model of the circuit, a script in the Python programming language that was used to split the simulations on a Linux cluster and the Matlab code developed to analyze the data.

JKSimFloat V6.1 Plus: Improving flotation circuit performance by simulation

Analyzing, optimizing and designing flotation circuits using models and simulators have improved significantly over the last 15 years. Mineral flotation is now generally better understood through major advances in measuring and modeling the sub-processes within the flotation system. In addition, new and better methods have been derived to represent the floatability of particles as they move around a flotation circuit. A simulator has been developed that combines the effects of all of these sub-processes to predict the metallurgical performance of a flotation circuit. This paper presents an overview of the simulator, JKSimFloat V6.1PLUS, and its use in improving the industrial flotation plant performance. The application of the simulator at various operations is discussed with particular emphasis on the use of JKSimFloat V6.1PLUS in improving the flotation circuit performance.

A Voltage Limiter Circuit for Indoor Light Energy Harvesting Applications

A voltage limiter circuit for indoor light energy harvesting applications is presented. This circuit is a part of a bigger system, whose function is to harvest indoor light energy, process it and store it, so that it can be used at a later time. This processing consists on maximum power point tracking (MPPT) and stepping-up, of the voltage from the photovoltaic (PV) harvester cell. The circuit here described, ensures that even under strong illumination, the generated voltage will not exceed the limit allowed by the technology, avoiding the degradation, or destruction, of the integrated die. A prototype of the limiter circuit was designed in a 130 nm CMOS technology. The layout of the circuit has a total area of 23414 mu m(2). Simulation results, using Spectre, are presented.

Simulation of a-Si PV system grid connected by boost and inverter

This paper is about a PV system connected to the electric grid by power electronic converters, using classical PI controller. The modelling for the converters emulates the association of a DC-DC boost with a two-level power inverter (TwLI) or three-level power inverter (ThLI) in order to follow the performance of a testing experimental system. Pulse width modulation (PWMo) by sliding mode control (SMCo) associated with space vector modulation (SVMo) is applied to the boost and the inverter. The PV system is described by the five parameters equivalent circuit. Parameter identification and simulation studies are performed for comparison with the testing experimental system.

Simulation of a-Si PV system linked to the grid by DC boost and three-level inverter under cloud scope

This paper is about a PV system linked to the electric grid through power converters under cloud scope. The PV system is modeled by the five parameters equivalent circuit and a MPPT procedure is integrated into the modeling. The modeling for the converters models the association of a DC-DC boost with a three-level inverter. PI controllers are used with PWM by sliding mode control associated with space vector modulation controlling the booster and the inverter. A case study addresses a simulation to assess the performance of a PV system linked to the electric grid. Conclusions regarding the integration of the PV system into the electric grid are presented. © IFIP International Federation for Information Processing 2015.

General electromagnetic simulation tool to predict the microwave nonlinear response of planar, arbitrarily-shaped HTS structures

This work describes a simulation tool being developed at UPC to predict the microwave nonlinear behavior of planar superconducting structures with very few restrictions on the geometry of the planar layout. The software is intended to be applicable to most structures used in planar HTS circuits, including line, patch, and quasi-lumped microstrip resonators. The tool combines Method of Moments (MoM) algorithms for general electromagnetic simulation with Harmonic Balance algorithms to take into account the nonlinearities in the HTS material. The Method of Moments code is based on discretization of the Electric Field Integral Equation in Rao, Wilton and Glisson Basis Functions. The multilayer dyadic Green's function is used with Sommerfeld integral formulation. The Harmonic Balance algorithm has been adapted to this application where the nonlinearity is distributed and where compatibility with the MoM algorithm is required. Tests of the algorithm in TM010 disk resonators agree with closed-form equations for both the fundamental and third-order intermodulation currents. Simulations of hairpin resonators show good qualitative agreement with previously published results, but it is found that a finer meshing would be necessary to get correct quantitative results. Possible improvements are suggested.

Development of a simulation tool for torsional vibration of branched power transmission system

In this master's thesis a mechanical model that is driven with variable speed synchronous machine was developed. The developed mechanical model simulates the mechanics of power transmission and its torsional vibrations. The mechanical model was developed for the need of the branched mechanics of a rolling mill and the propulsion system of a tanker. First, the scope of the thesis was to clarify the concepts connected to the mechanical model. The clarified concepts are the variable speed drive, the mechanics of power transmission and the vibrationsin the power transmission. Next, the mechanical model with straight shaft line and twelve moments of inertia that existed in the beginning was developed to be branched considering the case of parallel machines and the case of parallel rolls. Additionally, the model was expanded for the need of moreaccurate simulation to up to thirty moments of inertia. The model was also enhanced to enable three phase short circuit situation of the simulated machine. After that the mechanical model was validated by comparing the results of the developed simulation tool to results of other simulation tools. The compared results are the natural frequencies and mode shapes of torsional vibration, the response of the load torque step and the stress in the mechanical system occurred by the permutation of the magnetic field that is arisen from the three phase short circuit situation. The comparisons were accomplished well and the mechanical model was validated for the compared cases. Further development to be made is to develop the load torque to be time-dependent and to install two frequency converters and two FEM modeled machines to be simulated parallel.

USER'S GUIDE FOR ADVANCED PROCESS SIMULATION SOFTWARE APROS 5

Tässä diplomityössä tehtiin käyttäjän opas kehittyneelle prosessisimulointiohjelmistolle APROS 5. Opas on osa VTT Energialle tehtävää APROS 5 käyttäjän koulutuspakettia, joka julkaistaan myöhemmin CD-ROM -muotoisena. Prosessisimulointiohjelmistoa AAPROS 5 voidaan käyttää termohydraulisten prosessien, automaatiopiirien ja sähköjärjestelmien mallinnuksessa. Ohjelma sisältää myös neutroniikkamallin ydinreaktorin käyttäytymisen mallintamiseksi. APROS:in aikaisemmilla UNIX-ympäristössä toimivilla versioilla on toteutettu useita ydinvoimalaitosten turvallisuustutkimukseen liittyviä analyysejä ja sekä ydinvoimalaitosten että konventionaalisten voimalaitosten koulutussimulaattoreita. APROS 5 toimii Windows NT -ympäristössä ja on oleellisesti erilainen käyttää kuin aikaisemmat versiot. Tämän myötä syntyi tarve uudelle käyttäjän oppaalle. Käyttäjän oppaassa esitetään APROS 5:n tärkeimmät toiminnot, mallinnuksen periaatteet ja termohydraulisten ja neutroniikan ratkaisumallit. Lisäksi oppaassa esitetään esimerkki, jossa mallinnetaan yksinkertaistettu VVER-440 -tyyppisen ydinvoimalaitoksen primääripiiri. Yksityiskohtaisempaa tietoa ohjelmistosta on saatavilla APROS 5 -dokumentaatiosta.

A System-Level Simulation Model for a Protocol Processor

As the development of integrated circuit technology continues to follow Moore’s law the complexity of circuits increases exponentially. Traditional hardware description languages such as VHDL and Verilog are no longer powerful enough to cope with this level of complexity and do not provide facilities for hardware/software codesign. Languages such as SystemC are intended to solve these problems by combining the powerful expression of high level programming languages and hardware oriented facilities of hardware description languages. To fully replace older languages in the desing flow of digital systems SystemC should also be synthesizable. The devices required by modern high speed networks often share the same tight constraints for e.g. size, power consumption and price with embedded systems but have also very demanding real time and quality of service requirements that are difficult to satisfy with general purpose processors. Dedicated hardware blocks of an application specific instruction set processor are one way to combine fast processing speed, energy efficiency, flexibility and relatively low time-to-market. Common features can be identified in the network processing domain making it possible to develop specialized but configurable processor architectures. One such architecture is the TACO which is based on transport triggered architecture. The architecture offers a high degree of parallelism and modularity and greatly simplified instruction decoding. For this M.Sc.(Tech) thesis, a simulation environment for the TACO architecture was developed with SystemC 2.2 using an old version written with SystemC 1.0 as a starting point. The environment enables rapid design space exploration by providing facilities for hw/sw codesign and simulation and an extendable library of automatically configured reusable hardware blocks. Other topics that are covered are the differences between SystemC 1.0 and 2.2 from the viewpoint of hardware modeling, and compilation of a SystemC model into synthesizable VHDL with Celoxica Agility SystemC Compiler. A simulation model for a processor for TCP/IP packet validation was designed and tested as a test case for the environment.

Induction Motor Drive Energy Efficiency - Simulation and Analysis

A coupled system simulator, based on analytical circuit equations and a finite element method (FEM) model of the motor has been developed and it is used to analyse a frequency-converterfed industrial squirrel-cage induction motor. Two control systems that emulate the behaviour of commercial direct-torque-controlled (DTC) and vector-controlled industrial frequency converters have been studied, implemented in the simulation software and verified by extensive laboratory tests. Numerous factors that affect the operation of a variable speed drive (VSD) and its energy efficiency have been investigated, and their significance in the simulation of the VSD results has been studied. The dependency of the frequency converter, induction motor and system losses on the switching frequency is investigated by simulations and measurements at different speeds for both the vector control and the DTC. Intensive laboratory measurements have been carried out to verify the simulation results.

Transient current technique simulation of semiconductor detectors

Nowadays advanced simulation technologies of semiconductor devices occupies an important place in microelectronics production process. Simulation helps to understand devices internal processes physics, detect new effects and find directions for optimization. Computer calculation reduces manufacturing costs and time. Modern simulation suits such as Silcaco TCAD allow simulating not only individual semiconductor structures, but also these structures in the circuit. For that purpose TCAD include MixedMode tool. That tool can simulate circuits using compact circuit models including semiconductor structures with their physical models. In this work, MixedMode is used for simulating transient current technique setup, which include detector and supporting electrical circuit. This technique was developed by RD39 collaboration project for investigation radiation detectors radiation hard properties.

Simulation of wind powered hydraulic heating system

The objective of this master’s thesis was to design and simulate a wind powered hydraulic heating system that can operate independently in remote places where the use of electricity is not possible. Components for the system were to be selected in such a way that the conditions for manufacture, use and economic viability are the as good as possible. Savonius rotor was chosen for wind turbine, due to its low cut in speed and robust design. Savonius rotor produces kinetic energy in wide wind speed range and it can withstand high wind gusts. Radial piston pump was chosen for the flow source of the hydraulic heater. Pump type was selected due to its characteristics in low rotation speeds and high efficiency. Volume flow from the pump is passed through the throttle orifice. Pressure drop over the orifice causes the hydraulic oil to heat up and, thus, creating thermal energy. Thermal energy in the oil is led to radiator where it conducts heat to the environment. The hydraulic heating system was simulated. For this purpose a mathematical models of chosen components were created. In simulation wind data gathered by Finnish meteorological institute for 167 hours was used as input. The highest produced power was achieved by changing the orifice diameter so that the rotor tip speed ratio follows the power curve. This is not possible to achieve without using electricity. Thus, for the orifice diameter only one, the optimal value was defined. Results from the simulation were compared with investment calculations. Different parameters effecting the investment profitability were altered in sensitivity analyses in order to define the points of investment profitability. Investment was found to be profitable only with high average wind speeds.

Real-time simulation of multibody systems with applications for working mobile vehicles

This dissertation describes an approach for developing a real-time simulation for working mobile vehicles based on multibody modeling. The use of multibody modeling allows comprehensive description of the constrained motion of the mechanical systems involved and permits real-time solving of the equations of motion. By carefully selecting the multibody formulation method to be used, it is possible to increase the accuracy of the multibody model while at the same time solving equations of motion in real-time. In this study, a multibody procedure based on semi-recursive and augmented Lagrangian methods for real-time dynamic simulation application is studied in detail. In the semirecursive approach, a velocity transformation matrix is introduced to describe the dependent coordinates into relative (joint) coordinates, which reduces the size of the generalized coordinates. The augmented Lagrangian method is based on usage of global coordinates and, in that method, constraints are accounted using an iterative process. A multibody system can be modelled as either rigid or flexible bodies. When using flexible bodies, the system can be described using a floating frame of reference formulation. In this method, the deformation mode needed can be obtained from the finite element model. As the finite element model typically involves large number of degrees of freedom, reduced number of deformation modes can be obtained by employing model order reduction method such as Guyan reduction, Craig-Bampton method and Krylov subspace as shown in this study The constrained motion of the working mobile vehicles is actuated by the force from the hydraulic actuator. In this study, the hydraulic system is modeled using lumped fluid theory, in which the hydraulic circuit is divided into volumes. In this approach, the pressure wave propagation in the hoses and pipes is neglected. The contact modeling is divided into two stages: contact detection and contact response. Contact detection determines when and where the contact occurs, and contact response provides the force acting at the collision point. The friction between tire and ground is modelled using the LuGre friction model, which describes the frictional force between two surfaces. Typically, the equations of motion are solved in the full matrices format, where the sparsity of the matrices is not considered. Increasing the number of bodies and constraint equations leads to the system matrices becoming large and sparse in structure. To increase the computational efficiency, a technique for solution of sparse matrices is proposed in this dissertation and its implementation demonstrated. To assess the computing efficiency, augmented Lagrangian and semi-recursive methods are implemented employing a sparse matrix technique. From the numerical example, the results show that the proposed approach is applicable and produced appropriate results within the real-time period.

Two-dimensional drift-diffusion simulation of organic solar cells

The aim of this master's thesis is to develop a two-dimensional drift-di usion model, which describes charge transport in organic solar cells. The main bene t of a two-dimensional model compared to a one-dimensional one is the inclusion of the nanoscale morphology of the active layer of a bulk heterojunction solar cell. The developed model was used to study recombination dynamics at the donor-acceptor interface. In some cases, it was possible to determine e ective parameters, which reproduce the results of the two-dimensional model in the one-dimensional case. A summary of the theory of charge transport in semiconductors was presented and discussed in the context of organic materials. Additionally, the normalization and discretization procedures required to nd a numerical solution to the charge transport problem were outlined. The charge transport problem was solved by implementing an iterative scheme called successive over-relaxation. The obtained solution is given as position-dependent electric potential, free charge carrier concentrations and current densities in the active layer. An interfacial layer, separating the pure phases, was introduced in order to describe charge dynamics occurring at the interface between the donor and acceptor. For simplicity, an e ective generation of free charge carriers in the interfacial layer was implemented. The pure phases simply act as transport layers for the photogenerated charges. Langevin recombination was assumed in the two-dimensional model and an analysis of the apparent recombination rate in the one-dimensional case is presented. The recombination rate in a two-dimensional model is seen to e ectively look like reduced Langevin recombination at open circuit. Replicating the J-U curves obtained in the two-dimensional model is, however, not possible by introducing a constant reduction factor in the Langevin recombination rate. The impact of an acceptor domain in the pure donor phase was investigated. Two cases were considered, one where the acceptor domain is isolated and another where it is connected to the bulk of the acceptor. A comparison to the case where no isolated domains exist was done in order to quantify the observed reduction in the photocurrent. The results show that all charges generated at the isolated domain are lost to recombination, but the domain does not have a major impact on charge transport. Trap-assisted recombination at interfacial trap states was investigated, as well as the surface dipole caused by the trapped charges. A theoretical expression for the ideality factor n_id as a function of generation was derived and shown to agree with simulation data. When the theoretical expression was fitted to simulation data, no interface dipole was observed.