1. System Integration & Silicon Implementation Group Dept. of Computer Science & Information Engineering NCTU, Taiwan IP Protection : for Digital VLSI Implementations Terng-Yin Hsu Tel : +886-3-5712121 Ext 54789 Email : tyhsu@csie.nctu.edu.tw

2. 2 T.Y. Hsu Outline  Motivation  Protection Issues –Methodology, Policy, Protection level, …  Implementation Examples  Key Hidden, Power Jamming  Summary

3. 3 T.Y. Hsu Motivation  In order to improve the system-on-chip (SOC) turnaround efficiency, IP-based design methodology has widely used in many applications, such as security engine, MPEG codec, networking, and so on.  However, the true is that there isn’t any perfect protection in ASIC implementations.  Currently, how to protect our know-how and related information becomes more and more important.

4. 4 T.Y. Hsu Protection Phases  Data Protection  Know-how Protection  License Protection

5. 5 T.Y. Hsu Protection Level of Silicon IP  Behavior Level  RTL Level  Netlist Level  Layout Level  We can use “Function”, “Timing”, and “Layout” to protect designs

6. 6 T.Y. Hsu Useful Schemes  Modeling  Re-assign Data Path  Re-assign Control Timing  Design a Special “Trap” (most interesting)

7. 7 T.Y. Hsu Behavior Protection  Equivalent Model (Know-how)  WaterMarking (License)  Special assignment of FSM content  Design a Trap (Protection)  Special control pattern in programming (for large system)

8. 8 T.Y. Hsu Example: FSM WaterMarking Casex: 5’b00x00 : begin interupt = 1’b1; counter=0;... end 5’b01001 : begin interrupt=1’b0; counter=5;... end 5’b100x0 : begin interrupt=1’b0 counter=FF;... end ………….. endcase Casex: 5’b00000 : begin interupt = 1’b1; counter=0; marking={define #1}; end 5’b00100 : begin interupt = 1’b1; counter=0; marking={define #2}; end 5’b10000 : begin interrupt=1’b0 counter=FF; version={define #1}; end ………….. endcase Original FSMModified FSM

9. 9 T.Y. Hsu RTL Protection  Behavior Model + “Cycle information” (Know-how)  WaterMarking (License)  Special assignment of FSM content  Design a Trap (Protection)  Special control timing/scheduling  Special Coding Style

10. 10 T.Y. Hsu Example: Timing Reassignment always @(posedge clk) begin if (reset) …….. else if (interupt) …… …………. ………….. end OriginalTimingModified Timing always @(posedge clk or negedge interupt or … ) begin if (reset) …….. else if (check) // may be redundant states else if (interup) …… …………. ………….. end

11. 11 T.Y. Hsu Example: FSM & Timing WaterMarking always @(posedge clk) casex: 5’b00x00 : begin interupt = 1’b1; counter=0;... end 5’b01001 : begin interrupt=1’b0; counter=5;... end 5’b100x0 : begin interrupt=1’b0 counter=FF;... end ………….. endcase always @(posedge clk or posedge trig or … ) casex: 5’b00000 : begin interupt = 1’b1; counter=0; marking={define #1}; end 5’b00100 : begin interupt = 1’b1; counter=0; marking={define #2}; end 5’b10000 : begin interrupt=1’b0 counter=FF; version={define #1}; end ………….. endcase Original FSMModified FSM

12. 12 T.Y. Hsu Example: Scheduling Policy Sampling phase acquisition GI2T1T2t1t2t3t4t5t6t7t8t9t1 0 AGC Frame detection Frequency acquisition Symbol boundary acquisition Sampling phase acquisition GI2T1T2t1t2t3t4t5t6t7t8t9t1 0 AGC Frame detection Frequency acquisition Symbol boundary acquisition Original Scheduling (better) Modified Scheduling (poor)

13. 13 T.Y. Hsu Netlist Protection  Behavior Model + “Delay Timing” (Know-how)  WaterMarking (License)  Special assignment of FSM content  Design a Trap/Timing (Protection)  Special signal timing or cell delay  Special logic optimization

14. 14 T.Y. Hsu Layout Protection  Block Box + “Behavior function”  WaterMarking  Add “logo” into special cell (not only focus on cells, but also special on layout assignments)

15. 15 T.Y. Hsu Example: Layout WaterMarking Water Marking

16. System Integration & Silicon Implementation Group Dept. of Computer Science & Information Engineering NCTU, Taiwan Implementation Examples

17. 17 T.Y. Hsu Power-Bound Protections In order to prevent information to be detected during chip operations by power, voltage or current scanning. –Average power distribution: reduce peak power over time –Design a trap: make a illusion power dissipation

18. 18 T.Y. Hsu Power Jamming Encrypt Module DAC/ DVC Random Generator & Control Logic Power Sensor VDD GND Power Jamming Weighting function

19. 19 T.Y. Hsu Random Generator Not good enough

20. 20 T.Y. Hsu Random Generator (cont.) Control Interface Noise source Sequential Logic System clock Synchronization Logic Output

21. 21 T.Y. Hsu Simulation Result of Power Jamming Before add power jamming After add power jamming (weighting error) Bad Random Generator

22. 22 T.Y. Hsu Key Hidden ŒHardware Only Mixed Logic & Memory ŽMemory Only

23. 23 T.Y. Hsu Hidden in Hardware AAdvantage FEasy for Implementation/Maintain/Cost NDisadvantage FFor Small Design Easy to defeat FFor Large Design Need a long time to defeat

24. 24 T.Y. Hsu Circuit of Constant key Space Hidden NFor the ratio of key/total will determine the defeat time. (to search a whole key within chip)

25. 25 T.Y. Hsu Time Hidden Use special control timing, pattern or coding format to share with time and then generate a key. With RNG or Watermarking Initialization Timing Generator For “key” Output Clock cycle : #1 #2 #3 #4 #5 #6 #7 #8 #9 #10 #11 #12 #13 #14...... #N Key Sequence: 1 0 x 0 1 x x x 0 0 1 x 1 x...... 0 Others Data : x x 0 x x 1 1 0 x x x 0 x 1...... x

26. 26 T.Y. Hsu Hidden in Logic & Memory AAdvantage –Easy to prevent defeat NDisadvantage –Hard to Implementation/Maintain/Cost –Data zeroing is a key issue –Design Complexity

27. 27 T.Y. Hsu Logic & Memory Hidden MemoryLogic Coding & Timing Generator Zeroing (Data Protection) 1011001010001101010111 Hidden in MemoryHidden in Logic

28. 28 T.Y. Hsu Logic & Memory Hidden (cont.) NFor both the ratio of soft key/hard key and overall complexity will determine the defeat time. (to search a whole key within chip) / without “zeroing” Circuit of Constant key

29. 29 T.Y. Hsu Hidden in Memory AAdvantage –Easy for Implementation/Cost NDisadvantage –Zeroing is a key issue !! (without zeroing) For Small Design –Easy to defeat For Large Design –Need a long time to defeat

30. 30 T.Y. Hsu Summary  In order to reduce system turnaround and to make function work, it is important to develop protection policy or algorithm, in different designed levels, such as Algorithm, Architecture, RTL, and FPGA/ASIC verifications, … etc., as early as possible.  More detail considerations provide safer results.  Design a special trap to make a illusion to protect our data, know-how and license is an interesting method.  Trade-off (Power dissipation, Complexity, Life cycle, Policy, …) is an art for IP protections !!