SoC: a real platform for IP reuse, IP infringement, and IP protection
TL;DR: The IP-based SoC design flow is discussed to highlight the exact locations and the nature of infringements in the flow, identifies the adversaries, categorizes these infringements, and applies strategic analysis on the effectiveness of the existing IPP techniques for these categories of infringement.
Abstract: Increased design complexity, shrinking design cycle, and low cost--this three-dimensional demandmandates advent of system-onchip (SoC) methodology in semiconductor industry. The key concept of SoC is reuse of the intellectual property (IP) cores. Reuse of IPs on SoC increases the risk of misappropriation of IPs due to introduction of several new attacks and involvement of various parties as adversaries. Existing literature has huge number of proposals for IP protection (IPP) techniques to be incorporated in the IP design flow as well as in the SoC design methodology. However, these are quite scattered, limited in possibilities in multithreat environment, and sometimes mutually conflicting. Existing works need critical survey, proper categorization, and summarization to focus on the inherent tradeoff, existing security holes, and new research directions. This paper discusses the IP-based SoC design flow to highlight the exact locations and the nature of infringements in the flow, identifies the adversaries, categorizes these infringements, and applies strategic analysis on the effectiveness of the existing IPP techniques for these categories of infringements. It also clearly highlights recent challenges and new opportunities in this emerging field of research.
Citations
More filters
24 May 2015
TL;DR: A hierarchical IP protection approach is proposed, which combines the behavioral-level and physical-level design properties to lock each hard IP core with a key, so that illegal redistribution of the IP cores can be traced.
Abstract: Hard IP cores are usually delivered by IP vendors for high value and performance-critical system components used in SoC designs. Although not allowing direct access to the behavioral design, hard IPs still face various IP infringements such as illegal usage and reverse engineering. This paper proposes a hierarchical IP protection approach, which combines the behavioral-level and physical-level design properties to lock each hard IP core with a key. Without the key the IP cores cannot work properly, and the design manipulation at the physical level also makes the IP cores operate incorrectly after reverse engineering, resynthesis and replacement&reroute. In addition, the key is a unique signature representing the IP vendor and the buyer, so that illegal redistribution of the IP cores can be traced. Experimental results demonstrate that the protection approach only introduces small overheads in IP cores' power consumption (< 0.4%), area (< 3.5%) and critical path delay (< 3.8%). The construction of the protection circuit makes the approach secure against possible attacks.
2 citations
Cites background from "SoC: a real platform for IP reuse, ..."
...Being an increasingly popular SoC design methodology, IP reuse faces a development obstacle, which is IP infringement [1]....
[...]
26 Aug 2015
TL;DR: The approach analytically models power consumption, resource usage, execution time and IP protection robustness of hardware designs, and formulates the expanded multi-objective DSE as a constrained optimization problem, demonstrating the capability of the approach in finding optimized designs.
Abstract: Design space exploration (DSE) is now an important phase of the SoC design process, in order to realize high-efficiency design. In conventional DSE, design metrics such as speed, power and area are extensively used to evaluate various design options. As IP-reuse is widely adopted, protection of hardware IPs has been paid more and more attention at advanced design processes. This paper considers IP protection as a new dimension of DSE. The approach analytically models power consumption, resource usage, execution time and IP protection robustness of hardware designs, and formulates the expanded multi-objective DSE as a constrained optimization problem. The resultant design from solving the optimization problem achieves trade-offs between design performance and IP protection robustness. The approach is validated on three application kernels, demonstrating the capability of the approach in finding optimized designs, which actually locates in the Pareto frontier of the design space.
1 citations
Cites background from "SoC: a real platform for IP reuse, ..."
...To meet the demand, various IP protection techniques have been developed to give hardware designs such capability, which can be evaluated by the IP protection robustness [6], [7], [8], [10]....
[...]
...In addition to the typical metrics, the security of hardware designs has gradually drawn much attentions [6], [7], [8]....
[...]
TL;DR: From the simulation of the proposed scheme through SPICE modeling using a Chartered 0.18 mm CMOS process, the results show that the clock predictor produces a predicted clock before a synchronization failure, and the synchronizer samples data correctly using the predicted clock.
Abstract: For the performance-efficient integration of IPs on an SoC utilizing heterochronous multi-clock domains, we propose a synchronization scheme that causes low latency overhead when data are crossing clock boundaries. The proposed synchronization scheme is composed of a clock predictor and a synchronizer. The clock predictor of a sender clock domain produces a predicted clock that is used in a receiver clock domain to detect possible synchronization failures in advance. When the possible synchronization failures are detected, a synchronizer at the receiver delays data-capture times to avoid the possible synchronization failures. From the simulation of the proposed scheme through SPICE modeling using a Chartered 0.18 mm CMOS process, we verified the functionalities and timing behavior of the clock predictor and the synchronizer. The simulation results show that the clock predictor produces a predicted clock before a synchronization failure, and the synchronizer samples data correctly using the predicted clock.
1 citations
Cites background from "SoC: a real platform for IP reuse, ..."
...In a reuse-centric design, each IP contained in an SoC can have an independent clock source and frequency in a hard or soft macro form, and it will be offered by various vendors [1]....
[...]
24 Jul 2022
TL;DR: In this article , an implementation to test monotonic parameters of programmable system on chip (PSoC) utilizing available hybrid bist options and thus reducing the overhead on Automated Testing Equipment (ATE) has been presented.
Abstract: Programmable System on Chip (PSoC) devices coming in to the market in recent times does possess basic elements such as configurable op-amps, counters, multiplexers, onchip capacitors, switch matrix, Advanced High-performance Bus (AHB) etc. This paper presents an implementation to test monotonic parameters of SoC utilizing available hybrid bist options and thus reducing the overhead on Automated Testing Equipment (ATE) which has accounted for Test Time Reduction (TTR). This method has been verified on one of PSoC devices at both wafer (110 units) and package (3 units) level using MAGNUM1 NEXTEST ATE and found that test time has reduced by 28.31% compared to its traditional implementation of measuring voltage for each monotonic code.
24 Jul 2022
TL;DR: In this article , an implementation to test monotonic parameters of programmable system on chip (PSoC) utilizing available hybrid bist options and thus reducing the overhead on Automated Testing Equipment (ATE) has been presented.
Abstract: Programmable System on Chip (PSoC) devices coming in to the market in recent times does possess basic elements such as configurable op-amps, counters, multiplexers, onchip capacitors, switch matrix, Advanced High-performance Bus (AHB) etc. This paper presents an implementation to test monotonic parameters of SoC utilizing available hybrid bist options and thus reducing the overhead on Automated Testing Equipment (ATE) which has accounted for Test Time Reduction (TTR). This method has been verified on one of PSoC devices at both wafer (110 units) and package (3 units) level using MAGNUM1 NEXTEST ATE and found that test time has reduced by 28.31% compared to its traditional implementation of measuring voltage for each monotonic code.
References
More filters
Book•
01 Jan 1996TL;DR: A valuable reference for the novice as well as for the expert who needs a wider scope of coverage within the area of cryptography, this book provides easy and rapid access of information and includes more than 200 algorithms and protocols.
Abstract: From the Publisher:
A valuable reference for the novice as well as for the expert who needs a wider scope of coverage within the area of cryptography, this book provides easy and rapid access of information and includes more than 200 algorithms and protocols; more than 200 tables and figures; more than 1,000 numbered definitions, facts, examples, notes, and remarks; and over 1,250 significant references, including brief comments on each paper.
13,597 citations
20 May 2007
TL;DR: These results show that Trojans that are 3-4 orders of magnitude smaller than the main circuit can be detected by signal processing techniques and provide a starting point to address this important problem.
Abstract: Hardware manufacturers are increasingly outsourcing their IC fabrication work overseas due to their much lower cost structure. This poses a significant security risk for ICs used for critical military and business applications. Attackers can exploit this loss of control to substitute Trojan ICs for genuine ones or insert a Trojan circuit into the design or mask used for fabrication. We show that a technique borrowed from side-channel cryptanalysis can be used to mitigate this problem. Our approach uses noise modeling to construct a set of fingerprints/or an IC family utilizing side- channel information such as power, temperature, and electromagnetic (EM) profiles. The set of fingerprints can be developed using a few ICs from a batch and only these ICs would have to be invasively tested to ensure that they were all authentic. The remaining ICs are verified using statistical tests against the fingerprints. We describe the theoretical framework and present preliminary experimental results to show that this approach is viable by presenting results obtained by using power simulations performed on representative circuits with several different Trojan circuitry. These results show that Trojans that are 3-4 orders of magnitude smaller than the main circuit can be detected by signal processing techniques. While scaling our technique to detect even smaller Trojans in complex ICs with tens or hundreds of millions of transistors would require certain modifications to the IC design process, our results provide a starting point to address this important problem.
741 citations
"SoC: a real platform for IP reuse, ..." refers methods in this paper
...The technique is also capable of detecting trojan of 3-4 orders of magnitude smaller than the main circuit using signal processing [28]....
[...]
...…et al. 2009 [23] Y Y Castillo et al. 2007 [24] Y Abdel-Hamid et al. 2005 [25] Y Saha and Sur-Kolay 2010 [26] Y Majzoobi and Koushanfar 2009 [27] Y Agrawal et al. 2007 [28] Y Y Cui et al. 2008 [29] Y Lach et al. 2001 [30] Y Y Gu et al. 2009 [31] Y Li and Lach 2008 [32] Y Y Potkonjak et al. 2009…...
[...]
TL;DR: Simulation results for a set of ISCAS-89 benchmark circuits and the advanced-encryption-standard IP core show that high levels of security can be achieved at less than 5% area and power overhead under delay constraint.
Abstract: Hardware intellectual-property (IP) cores have emerged as an integral part of modern system-on-chip (SoC) designs. However, IP vendors are facing major challenges to protect hardware IPs from IP piracy. This paper proposes a novel design methodology for hardware IP protection using netlist-level obfuscation. The proposed methodology can be integrated in the SoC design and manufacturing flow to simultaneously obfuscate and authenticate the design. Simulation results for a set of ISCAS-89 benchmark circuits and the advanced-encryption-standard IP core show that high levels of security can be achieved at less than 5% area and power overhead under delay constraint.
468 citations
"SoC: a real platform for IP reuse, ..." refers methods in this paper
...An obfuscation technique discussed in [18], inserts a small FSM and constitutes a preinitialization state space, which is resilient against reverse engineering....
[...]
...…and Sur-Kolay 2009 [13] Y Roy et al. 2008 [14] Y Alkabani et al. 2008 [15] Y Alkabani and Koushanfar 2007 [16] Y Alkabani et al. 2007 [17] Y Y Chakraborty and Bhunia 2009 [18] Y Y Granado-Criado et al. 2010 [19] Y Dyka and Langendoerfer 2005 [20] Y Suzuki et al. 2004 [21] Y Deng et al. 2009…...
[...]
Proceedings Article•
06 Aug 2007TL;DR: The first active hardware metering scheme that aims to protect integrated circuits (IC) intellectual property (IP) against piracy and runtime tampering is introduced and has a low-overhead in terms of power, delay, and area, while it is extremely resilient against the considered attacks.
Abstract: We introduce the first active hardware metering scheme that aims to protect integrated circuits (IC) intellectual property (IP) against piracy and runtime tampering. The novel metering method simultaneously employs inherent unclonable variability in modern manufacturing technology, and functionality preserving alternations of the structural IC specifications. Active metering works by enabling the designers to lock each IC and to remotely disable it. The objectives are realized by adding new states and transitions to the original finite state machine (FSM) to create boosted finite state machines(BFSM) of the pertinent design. A unique and unpredictable ID generated by an IC is utilized to place an BFSM into the power-up state upon activation. The designer, knowing the transition table, is the only one who can generate input sequences required to bring the BFSM into the functional initial (reset) state. To facilitate remote disabling of ICs, black hole states are integrated within the BFSM.
We introduce nine types of potential attacks against the proposed active metering method. We further describe a number of countermeasures that must be taken to preserve the security of active metering against the potential attacks. The implementation details of the method with the objectives of being low-overhead, unclonable, obfuscated, stable, while having a diverse set of keys is presented. The active metering method was implemented, synthesized and mapped on the standard benchmark circuits. Experimental evaluations illustrate that the method has a low-overhead in terms of power, delay, and area, while it is extremely resilient against the considered attacks.
354 citations
"SoC: a real platform for IP reuse, ..." refers background in this paper
...…hardware Charbon and Torunoglu 2000 [10] Y Adi et al. 2006 [12] Y Saha and Sur-Kolay 2009 [13] Y Roy et al. 2008 [14] Y Alkabani et al. 2008 [15] Y Alkabani and Koushanfar 2007 [16] Y Alkabani et al. 2007 [17] Y Y Chakraborty and Bhunia 2009 [18] Y Y Granado-Criado et al. 2010 [19] Y Dyka and…...
[...]
...In its active counterpart [16], design house keeps control of illegal ICs through monitoring of IC property and reuse, and by disabling functionalities of illegal ICs....
[...]
09 Jun 2008
TL;DR: This paper discusses how a technique for precisely measuring the combinational delay of an arbitrarily large number of register-to-register paths internal to the functional portion of the IC can be used to provide the desired authentication and design alteration detection.
Abstract: New attacker scenarios involving integrated circuits (ICs) are emerging that pose a tremendous threat to national security. Concerns about overseas fabrication facilities and the protection of deployed ICs have given rise to methods for IC authentication (ensuring that an IC being used in a system has not been altered, replaced, or spoofed) and hardware Trojan Horse (HTH) detection (ensuring that an IC fabricated in a nonsecure facility contains the desired functionality and nothing more), but significant additional work is required to quell these treats. This paper discusses how a technique for precisely measuring the combinational delay of an arbitrarily large number of register-to-register paths internal to the functional portion of the IC can be used to provide the desired authentication and design alteration (including HTH implantation) detection. This low-cost delay measurement technique does not affect the main IC functionality and can be performed at-speed at both test-time and run-time.
316 citations
"SoC: a real platform for IP reuse, ..." refers methods in this paper
...…2010 [26] Y Majzoobi and Koushanfar 2009 [27] Y Agrawal et al. 2007 [28] Y Y Cui et al. 2008 [29] Y Lach et al. 2001 [30] Y Y Gu et al. 2009 [31] Y Li and Lach 2008 [32] Y Y Potkonjak et al. 2009 [33] Y Wei et al. 2010 [34] Y Dutt and Li 2009 [35] Y Y Potkonjak 2010 [36] Y needs wider space for…...
[...]
...The technique in [32] precisely measures actual combinational delay of large number of paths....
[...]