Digital IP protection using threshold voltage control

Abstract

Abstract-This paper proposes a method to completely hide the functionality of a digital standard cell. This is accomplished by a differential threshold logic gate (TLG). A TLG with n inputs implements a subset of Boolean functions of n variables that are linear threshold functions. The output of such a gate is one if and only if an integer weighted linear arithmetic sum of the inputs equals or exceeds a given integer threshold. We present a novel architecture of a TLG that not only allows a single TLG to implement a large number of complex logic functions, which would require multiple levels of logic when implemented using conventional logic primitives, but also allows the selection of that subset of functions by assignment of the transistor threshold voltages to the input transistors. To obfuscate the functionality of the TLG, weights of some inputs are set to zero by setting their device threshold to be a high Vt. The threshold voltage of the remaining transistors is set to low Vt to increase their transconductance. The number of low Vt transistors whose gates are driven by a given input xi determines the weight of that input. The function of a TLG is not determined by the cell itself but rather the signals that are connected to its inputs. This makes it possible to hide the support set of the function by essentially removing some variable from the support set of the function. This is done by selective assignment of high and low Vt to the input transistors. We describe how a standard cell library of TLGs can be mixed with conventional standard cells to realize complex logic circuits, whose function can never be discovered by reverse engineering. A 32-bit Wallace tree multiplier and a 28-bit 4-tap filter were synthesized on an ST 65nm process, placed and routed, then simulated including extracted parastics with and without obfuscation. By obfuscating the cells the delay was shown to increase by approximately 5% at the cell level. Both obfuscated designs had much lower area (25%) lower area and much lower dynamic power (30%) than their nonobfuscated CMOS counterparts, operating at the same frequency.

Boolean Circuit Camouflage

“…Recent hardware advances have opened the possibility for protection of integrated circuits against reverse-engineering attacks via gate camouflaging [12,14,21,24,25,28]. While many of these works consider general Boolean functions in specific attack model, here we consider specific set of Boolean functions in general attack models.…”

“…While the layouts of two distinct physical gates look obviously different (and are hence easy to reverse engineer), the layouts of the same gates, after using dummy contacts, look identical and difficult to differentiate [4,5,7,28]. We refer to papers [12,14,16,24,25,28] for more on the class of dummy contacts and other camouflaging techniques. Adversary model.…”

Benchmarking the Capabilities and Limitations of SAT Solvers in Defeating Obfuscation Schemes

“…Logic obfuscation is the process of hiding the functionality of an IP by building ambiguity or by implementing post manufacturing means of control and programmability into its netlist. Gate camouflaging and circuit locking are two of the widely explored obfuscation mechanisms [3][4] [5]. A camouflaged gate is a gate that after RE (by means of delayering and lithography) could be mapped to any of possible set of gates or may look like one logic gate, however functionally perform as a different gate.…”