Security through Obscurity: Layout Obfuscation of Digital Integrated Circuits using Don't Care Conditions

Contemporary integrated circuits are designed and manufactured in a globalized environment leading to concerns of piracy, overproduction and counterfeiting. One class of techniques to combat these threats is circuit obfuscation which seeks to modify the gate-level (or structural) description of a circuit without affecting its functionality in order to increase the complexity and cost of reverse engineering. Most of the existing circuit obfuscation methods are based on the insertion of additional logic (called “key gates”) or camouflaging existing gates in order to make it difficult for a malicious user to get the complete layout information without extensive computations to determine key-gate values. However, when the netlist or the circuit layout, although camouflaged, is available to the attacker, he/she can use advanced logic analysis and circuit simulation tools and Boolean SAT solvers to reveal the unknown gate-level information without exhaustively trying all the input vectors, thus bringing down the complexity of reverse engineering. To counter this problem, some ‘provably secure’ logic encryption algorithms that emphasize methodical selection of camouflaged gates have been proposed previously in literature [1,2,3]. The contribution of this paper is the creation and simulation of a new layout obfuscation method that uses don't care conditions. We also present proof-of-concept of a new functional or logic obfuscation technique that not only conceals, but modifies the circuit functionality in addition to the gate-level description, and can be implemented automatically during the design process. Our layout obfuscation technique utilizes don’t care conditions (namely, Observability and Satisfiability Don’t Cares) inherent in the circuit to camouflage selected gates and modify sub-circuit functionality while meeting the overall circuit specification. Here, camouflaging or obfuscating a gate means replacing the candidate gate by a 4X1 Multiplexer which can be configured to perform all possible 2-input/ 1-output functions as proposed by Bao et al. [4]. It is important to emphasize that our approach not only obfuscates but alters sub-circuit level functionality in an attempt to make IP piracy difficult. The choice of gates to obfuscate determines the effort required to reverse engineer or brute force the design. As such, we propose a method of camouflaged gate selection based on the intersection of output logic cones. By choosing these candidate gates methodically, the complexity of reverse engineering can be made exponential, thus making it computationally very expensive to determine the true circuit functionality. We propose several heuristic algorithms to maximize the RE complexity based on don’t care based obfuscation and methodical gate selection. Thus, the goal of protecting the design IP from malicious end-users is achieved. It also makes it significantly harder for rogue elements in the supply chain to use, copy or replicate the same design with a different logic. We analyze the reverse engineering complexity by applying our obfuscation algorithm on ISCAS-85 benchmarks. Our experimental results indicate that significant reverse engineering complexity can be achieved at minimal design overhead (average area overhead for the proposed layout obfuscation methods is 5.51% and average delay overhead is about 7.732%). We discuss the strengths and limitations of our approach and suggest directions that may lead to improved logic encryption algorithms in the future. References: [1] R. Chakraborty and S. Bhunia, “HARPOON: An Obfuscation-Based SoC Design Methodology for Hardware Protection,” IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 28, no. 10, pp. 1493–1502, 2009. [2] J. A. Roy, F. Koushanfar, and I. L. Markov, “EPIC: Ending Piracy of Integrated Circuits,” in 2008 Design, Automation and Test in Europe, 2008, pp. 1069–1074. [3] J. Rajendran, M. Sam, O. Sinanoglu, and R. Karri, “Security Analysis of Integrated Circuit Camouflaging,” ACM Conference on Computer Communications and Security, 2013. [4] Bao Liu, Wang, B., "Embedded reconfigurable logic for ASIC design obfuscation against supply chain attacks,"Design, Automation and Test in Europe Conference and Exhibition (DATE), 2014 , vol., no., pp.1,6, 24-28 March 2014.

ENABLING HARDWARE TECHNOLOGIES FOR AUTONOMY IN TINY ROBOTS: CONTROL, INTEGRATION, ACTUATION

The last two decades have seen many exciting examples of tiny robots from a few cm3 to less than one cm3. Although individually limited, a large group of these robots has the potential to work cooperatively and accomplish complex tasks. Two examples from nature that exhibit this type of cooperation are ant and bee colonies. They have the potential to assist in applications like search and rescue, military scouting, infrastructure and equipment monitoring, nano-manufacture, and possibly medicine. Most of these applications require the high level of autonomy that has been demonstrated by large robotic platforms, such as the iRobot and Honda ASIMO. However, when robot size shrinks down, current approaches to achieve the necessary functions are no longer valid. This work focused on challenges associated with the electronics and fabrication. We addressed three major technical hurdles inherent to current approaches: 1) difficulty of compact integration; 2) need for real-time and power-efficient computations; 3) unavailability of commercial tiny actuators and motion mechanisms. The aim of this work was to provide enabling hardware technologies to achieve autonomy in tiny robots. We proposed a decentralized application-specific integrated circuit (ASIC) where each component is responsible for its own operation and autonomy to the greatest extent possible. The ASIC consists of electronics modules for the fundamental functions required to fulfill the desired autonomy: actuation, control, power supply, and sensing. The actuators and mechanisms could potentially be post-fabricated on the ASIC directly. This design makes for a modular architecture. The following components were shown to work in physical implementations or simulations: 1) a tunable motion controller for ultralow frequency actuation; 2) a nonvolatile memory and programming circuit to achieve automatic and one-time programming; 3) a high-voltage circuit with the highest reported breakdown voltage in standard 0.5 μm CMOS; 4) thermal actuators fabricated using CMOS compatible process; 5) a low-power mixed-signal computational architecture for robotic dynamics simulator; 6) a frequency-boost technique to achieve low jitter in ring oscillators. These contributions will be generally enabling for other systems with strict size and power constraints such as wireless sensor nodes.

Holistic Design In High-Speed Optical Interconnects

Integrated circuit scaling has enabled a huge growth in processing capability, which necessitates a corresponding increase in inter-chip communication bandwidth. As bandwidth requirements for chip-to-chip interconnection scale, deficiencies of electrical channels become more apparent. Optical links present a viable alternative due to their low frequency-dependent loss and higher bandwidth density in the form of wavelength division multiplexing. As integrated photonics and bonding technologies are maturing, commercialization of hybrid-integrated optical links are becoming a reality. Increasing silicon integration leads to better performance in optical links but necessitates a corresponding co-design strategy in both electronics and photonics. In this light, holistic design of high-speed optical links with an in-depth understanding of photonics and state-of-the-art electronics brings their performance to unprecedented levels. This thesis presents developments in high-speed optical links by co-designing and co-integrating the primary elements of an optical link: receiver, transmitter, and clocking.

In the first part of this thesis a 3D-integrated CMOS/Silicon-photonic receiver will be presented. The electronic chip features a novel design that employs a low-bandwidth TIA front-end, double-sampling and equalization through dynamic offset modulation. Measured results show -14.9dBm of sensitivity and energy efficiency of 170fJ/b at 25Gb/s. The same receiver front-end is also used to implement source-synchronous 4-channel WDM-based parallel optical receiver. Quadrature ILO-based clocking is employed for synchronization and a novel frequency-tracking method that exploits the dynamics of IL in a quadrature ring oscillator to increase the effective locking range. An adaptive body-biasing circuit is designed to maintain the per-bit-energy consumption constant across wide data-rates. The prototype measurements indicate a record-low power consumption of 153fJ/b at 32Gb/s. The receiver sensitivity is measured to be -8.8dBm at 32Gb/s.

Next, on the optical transmitter side, three new techniques will be presented. First one is a differential ring modulator that breaks the optical bandwidth/quality factor trade-off known to limit the speed of high-Q ring modulators. This structure maintains a constant energy in the ring to avoid pattern-dependent power droop. As a first proof of concept, a prototype has been fabricated and measured up to 10Gb/s. The second technique is thermal stabilization of micro-ring resonator modulators through direct measurement of temperature using a monolithic PTAT temperature sensor. The measured temperature is used in a feedback loop to adjust the thermal tuner of the ring. A prototype is fabricated and a closed-loop feedback system is demonstrated to operate at 20Gb/s in the presence of temperature fluctuations. The third technique is a switched-capacitor based pre-emphasis technique designed to extend the inherently low bandwidth of carrier injection micro-ring modulators. A measured prototype of the optical transmitter achieves energy efficiency of 342fJ/bit at 10Gb/s and the wavelength stabilization circuit based on the monolithic PTAT sensor consumes 0.29mW.

Lastly, a first-order frequency synthesizer that is suitable for high-speed on-chip clock generation will be discussed. The proposed design features an architecture combining an LC quadrature VCO, two sample-and-holds, a PI, digital coarse-tuning, and rotational frequency detection for fine-tuning. In addition to an electrical reference clock, as an extra feature, the prototype chip is capable of receiving a low jitter optical reference clock generated by a high-repetition-rate mode-locked laser. The output clock at 8GHz has an integrated RMS jitter of 490fs, peak-to-peak periodic jitter of 2.06ps, and total RMS jitter of 680fs. The reference spurs are measured to be –64.3dB below the carrier frequency. At 8GHz the system consumes 2.49mW from a 1V supply.

Electro-optical characterization of IC compatible microcantilevers

The aim of this work is to simulate and optically characterize the piezoelectric performance of complementary metal oxide semiconductor (CMOS) compatible microcantilevers based on aluminium nitride (AlN) and manufactured at room temperature. This study should facilitate the integration of piezoelectric micro-electro-mechanical systems (MEMS) such as microcantilevers, in CMOS technology. Besides compatibility with standard integrated circuit manufacturing procedures, low temperature processing also translates into higher throughput and, as a consequence, lower manufacturing costs. Thus, the use of the piezoelectric properties of AlN manufactured by reactive sputtering at room temperature is an important step towards the integration of this type of devices within future CMOS technology standards. To assess the reliability of our fabrication process, we have manufactured arrays of free-standing microcantilever beams of variable dimension and studied their piezoelectric performance. The characterization of the first out-of-plane modes of AlN-actuated piezoelectric microcantilevers has been carried out using two optical techniques: laser Doppler vibrometry (LDV) and white light interferometry (WLI). In order to actuate the cantilevers, a periodic chirp signal in certain frequency ranges was applied between the device electrodes. The nature of the different vibration modes detected has been studied and compared with that obtained by a finite element model based simulation (COMSOL Multiphysics), showing flexural as well as torsional modes. The correspondence between theoretical and experimental data is reasonably good, probing the viability of this high throughput and CMOS compatible fabrication process. To complete the study, X-ray diffraction as well as d33 piezoelectric coefficient measurements were also carried out.

A synthesizable hardware evolutionary algorithm design for unmanned aerial system real-time path planning

The main objective of this paper is to detail the development of a feasible hardware design based on Evolutionary Algorithms (EAs) to determine flight path planning for Unmanned Aerial Vehicles (UAVs) navigating terrain with obstacle boundaries. The design architecture includes the hardware implementation of Light Detection And Ranging (LiDAR) terrain and EA population memories within the hardware, as well as the EA search and evaluation algorithms used in the optimizing stage of path planning. A synthesisable Very-high-speed integrated circuit Hardware Description Language (VHDL) implementation of the design was developed, for realisation on a Field Programmable Gate Array (FPGA) platform. Simulation results show significant speedup compared with an equivalent software implementation written in C++, suggesting that the present approach is well suited for UAV real-time path planning applications.

A ternary Schmitt trigger

A new ternary circuit, namely, a ternary Schmitt trigger, is presented. This novel circuit which is based on the well-known lambda diode, is suitable for integration using CMOS technology. The circuit has been simulated using the SPICE 2G Program. The results of the simulation are presented. The circuit offers a high degree of design flexibility. This circuit is expected to be a very useful functional block in the processing of ternary and pseudoternary signals.

An apparatus for the study of switching characteristics in ferroelectrics

A circuit capable of producing bipolar square pulses of voltages up to +or-400 V, employing an integrated circuit timer and two mercury wetted relays is described. The frequency of the pulses can be varied from a cycle min-1 to 2 kHz. A variable temperature sample chamber and the temperature control and measurement circuits are also described. The performance of the circuit is evaluated using samples of TGS and NaNO2.

A dual-slope analogue-to-digital converter for generating polynomials

A new digital polynomial generator using the principle of dual-slope analogue-to-digital conversion is proposed. Techniques for realizing a wide range of integer as well as fractional coefficients to obtain the desired polynomial have been discussed. The suitability of realizing the proposed polynomial generator in integrated circuit form is also indicated.

An absolute digital positioning numerical control system

A module containing all the functional components required for a digital absolute positioning process of one axis of a machine tool has been designed and constructed. Circuit realization makes use of integrated circuit elements.

On the performance analysis of a class of neuron circuits

A new performance metric, Peak-Error Ratio (PER) has been presented to benchmark the performance of a class of neuron circuits to realize neuron activation function (NAF) and its derivative (DNAF). Neuron circuits, biased in subthreshold region, based on the asymmetric cross-coupled differential pair configuration and conventional configuration of applying small external offset voltage at the input have been compared on the basis of PER. It is shown that the technique of using transistor asymmetry in a cross-coupled differential pair performs on-par with that of applying external offset voltage. The neuron circuits have been experimentally prototyped and characterized as a proof of concept on the 1.5 mu m AMI technology.

On the performance analysis of a class of neuron circuits

A new performance metric, Peak-Error Ratio (PER) has been presented to benchmark the performance of a class of neuron circuits to realize neuron activation function (NAF) and its derivative (DNAF). Neuron circuits, biased in subthreshold region, based on the asymmetric cross-coupled differential pair configuration and conventional configuration of applying small external offset voltage at the input have been compared on the basis of PER. It is shown that the technique of using transistor asymmetry in a cross-coupled differential pair performs on-par with that of applying external offset voltage. The neuron circuits have been experimentally prototyped and characterized as a proof of concept on the 1.5 mu m AMI technology.

Impedance parameters and the state-of-charge. II. Lead-acid battery

The determination of the state-of-charge of the lead-acid battery has been examined from the viewpoint of internal impedance. It is shown that the impedance is controlled by charge transfer and to a smaller extent by diffusion processes in the frequency range 15–100 Hz. The equivalent series/parallel capacitance as well as the a.c. phase-shift show a parabolic dependence upon the state-of-charge, with a maximum or minimum at 50% charge. These results are explained on the basis of a uniform transmission-line analog equivalent circuit for the battery electrodes.

Impedance parameters and the state-of charge. I. Nickel-cadmium battery

The problem of nondestructive determination of the state-of-charge of nickel-cadmium batteries has been examined experimentally as well as theoretically from the viewpoint of internal impedance. It is shown that the modulus of the impedance is mainly controlled by diffusion at all states of charge. Even so, a prediction of the state of charge is possible if the equivalent series/parallel capacitance or the alternating current phase shift is measured at a sufficiently low a.c. test frequency (5–30 Hz) which also avoids inductive effects. These results are explained on the basis of a uniform transmission-line analog equivalent circuit for the battery electrodes.

A novel laser direct write technique for fabrication of thin film MICs

A technique for fabrication of thin-film circuits for microwave integrated circuit (MIC) application is presented. This low-cost fabrication technique utilizes laser direct write of copper patterns on alumina substrates. The method obviates the need for photomasks and photolithography. The film deposition mechanism, deposit film analysis, and MIC fabrication sequence are presented. Performance evaluation of MICs fabricated using this technique is also included