Analog and Mixed-Signal IC Security via Sizing Camouflaging

Abstract

We treat the problem of analog Integrated Circuit (IC) obfuscation towards Intellectual Property (IP) protection against reverse engineering. Obfuscation is achieved by camouflaging the effective geometry of layout components via the use of fake contacts, which originally were proposed for gate camouflaging in digital ICs. We present a library of obfuscated layout components, we give recommendations for effective camouflaging, we discuss foreseen attacks and the achieved resiliency, and we propose security metrics for assessing the hardness of reverse engineering. The proposed methodology is demonstrated on an operational amplifier and an RF Σ∆ Analog-to-Digital Converter (ADC).

Digital-to-Analog Hardware Trojan Attacks

“…The orange curves in Figs. [16][17][18][19] show the HT-infected performances in this scenario. As it can be seen, all performances are degraded.…”

“…The red curves in Figs. [16][17][18][19] show the HT-infected performances in this scenario. As it can be seen, there is no noise shaping and the signal now is buried under the noise floor.…”

“…Pre-silicon prevention methods include: (a) functional verification of 3PIP cores [7]; (b) structural analysis of Hardware Description Language (HDL) codes [7]; (c) targeted automatic test pattern generation algorithms [8] or simulating the circuit using specific test benches, i.e., performing aging simulations along with over-clocking [9] or short-term aging [10] to magnify the effect of the HT without triggering it; (d) searching for unused components during design-time verification and removing them as potentially suspicious [11]; (e) filling in all unused spaces on the layout, which are most likely insertion areas for HTs, with functional filler cells and checking if those have changed [12]; and (f) design obfuscation, for example using locking [13], [14], camouflaging [15], [16], or split manufacturing [17], aiming at obscuring the IC functionality so as to make it difficult for the attacker to insert the HT.…”

Digitally Assisted Mixed-Signal Circuit Security

“…Besides locking methods, other anti-piracy methods include split manufacturing [21] and camouflaging [22], [23]. While locking is an end-to-end protection method against all potential threats, i.e., untrusted SoC integrator, foundry, and end-user, split manufacturing protects only against an untrusted foundry and camouflaging protects only against an untrusted end-user that attempts to clone the circuit via reverse-engineering.…”

Untitled

“…All phases of supply chain rouge can perform different malicious activities such as IP infringement, IC counterfeiting, overbuilding, hardware Trojans, side-channel attacks. It can cause serious security and economic concerns in the semiconductor industry, resulting in billions of dollars lost each year [8][9][10]. A major enabler of these malicious and unlawful activities is reverse engineering (RE), where the rogues usually exploit the advantages of commercially available RE tools that were developed for honest purposes as fault analysis, chip testing and verification.…”