Tamper-resistant obfuscation circuit

Abstract

The obfuscation circuit relies on tamper-resistant non-volatile memory that encodes a trusted Boolean function. The Boolean function is used to implement several operations related to circuit obfuscation, including obfuscation of logic circuits, obfuscation of operand data, and release of IP blocks. The tamper-resistant non-volatile memory is part of a trusted integrated circuit structure, i.e., an integrated circuit structure manufactured by a trusted foundry, that is separate from another integrated circuit structure that contains various operational logic circuits of the design and is manufactured by an untrusted foundry. The Boolean function is encoded based on a look-up table implemented as a cascaded multiplexer circuit. Multiple obfuscation functions can be encoded this way. The obfuscation functions can be reprogrammed using a protocol that relies on a symmetric key, one of which is stored in the tamper-resistant non-volatile memory.

Description

TECHNICAL FIELD

[0001] The present invention relates generally to integrated circuits, and more particularly to a method of protecting computer hardware using obfuscation circuitry. BACKGROUND

[0002] Integrated circuits are used in a wide variety of electronic applications, from simple devices such as watches to the most complex computer systems. A microelectronic integrated circuit (IC) chip can generally be thought of as a collection of logic cells with electrical interconnections between the cells formed on a semiconductor substrate (e.g., silicon). An IC can include a very large number of cells, and complex connections between the cells are required. A cell is a group of one or more circuit elements, e.g., transistors, capacitors, resistors, inductors, and other basic circuit elements combined to perform a logic function. Cell types include, for example, core cells, scan cells, input / output (I / O) cells, and memory (storage) cells. Each cell of an IC can have one or more pins, each of which can be connected to one or more other pins of the IC through a wire. The wires connecting the pins of the IC are also formed on the surface of the chip. For more complex designs, there can be many different layers of conductive media available for wiring, such as polysilicon layers and multiple metal layers (metal-1, metal-2, etc.).

[0003] An IC chip is fabricated by first conceiving a logic circuit description, which is then converted to a physical description or geometric layout. The process is often carried out using a "netlist," which is a record of all the nets or interconnections between cell pins, including information about various components such as transistors, resistors, and capacitors. The layout is typically composed of a set of planar geometric shapes in several layers. The layout is then checked to ensure that it meets all of the design requirements, particularly timing requirements. The result is a set of design files called intermediate forms that describe the layout. The design files are then run through a dataprep process, which is used to produce patterns called masks through an optical or e-beam pattern generator. These masks are used during fabrication to etch or deposit features in a silicon wafer in a series of photolithography steps.

[0004] Chip designers are increasingly striving to maintain the confidentiality of proprietary designs for integrated circuits. Proper designs can be contained within circuits, such as blocks of intellectual property (IP). Even if foundries can be trusted to protect circuit design netlists, various reverse engineering techniques remain that can be used to identify the circuitry within these proprietary designs from the physical analysis of the chip. Therefore, many methods have been devised to combat such reverse engineering techniques. One method is circuit obfuscation. Obfuscating circuits modifies the structure of an integrated circuit to intentionally conceal its functionality. One way this modification can occur is by splitting the manufacturing of the IC chip into two parts, one "trusted" and one "untrusted." Figure 1 As shown, the integrated circuit package 10 consists of a trusted chip 12 and an untrusted chip 14. The untrusted chip 14 includes various logic devices 16 that form the core of the chip's functionality. The logic devices 16 are interconnected with each other via wiring 18 and connected to external pads. However, some connections are incomplete and require wiring 20 in the trusted chip 12 to complete the circuitry. The pads of the trusted chip 12 are electrically connected to the pads of the untrusted chip 14 by any conventional means, and this connection has C4 solder balls 22. According to this example, the untrusted chip 14 is manufactured by an untrusted foundry, while the trusted chip 12 is manufactured by a trusted foundry. Therefore, the wiring 18 in the untrusted chip 14 is visible, while the wiring 20 in the trusted chip 12 remains hidden. The hidden wiring 20 is also connected to input / output (I / O) pins 24. In this way, by attaching the trusted chip 12 to the untrusted chip 14, the chip owner can securely assemble the IC package 10 without the untrusted foundry ever knowing the details of the hidden wiring 20. Since the trusted chip 12 contains only wiring and no logic circuitry, it can be an interposer that is much cheaper to manufacture than the untrusted chip 14.

[0005] Figure 2 This illustrates an example of how confusion can occur with a simple adder circuit 30. The basic binary adder circuit generates the sum S of two binary numbers A and B, and can be constructed from standard logic gates according to Boolean formulas.

[0006] S = A⊕B⊕C in ,as well as

[0007] C out = C in (A⊕B)+AB

[0008] Where C in It is the carry signal from the previous adder circuit (for the next less significant bit) and C out This is the output carry signal (for the next more significant bit). Signals A and B are provided as inputs to the first XOR gate 32 and the first AND gate 34. The output of XOR gate 32 and C...in The signal is provided as input to a second XOR gate 36 and a second AND gate 38. The output of the XOR gate 36 is the S signal. The outputs of the AND gates 34 and 38 are input to an OR gate 40, the output of which is the C out signal. Further to this example, Figure 2 All the wiring (from the primary signals of A, B and C in , and the outputs of the gates 32, 36 and 40) shown in dashed lines in the middle has been obfuscated, i.e. this wiring is not part of the chip containing the logic gates. Rather, the wiring will be provided by a trusted (secret) insert. The full adder netlist thus becomes an obfuscated netlist showing only the connections from the gates 34 and 38 to the gate 40, making it impossible for an untrusted foundry to discern the functionality of these gates. SUMMARY

[0009] The invention relates in at least one embodiment generally to a method of constructing a tamper-resistant obfuscated circuit by encoding at least one obfuscation function into a tamper-resistant non-volatile memory of a first integrated circuit structure, the first integrated circuit structure having wiring connecting the tamper-resistant non-volatile memory to an output pad; and attaching the first integrated circuit structure to a second integrated circuit structure, the second integrated circuit structure having an obfuscated circuit and wiring connecting control signals of the obfuscated circuit to an input pad, wherein the input pad of the second integrated circuit structure is operatively connected to the output pad of the first integrated circuit structure. In illustrative embodiments, the obfuscation function is a Boolean function and the encoding is based on a lookup table of the Boolean function. The lookup table can be implemented as a cascaded multiplexer circuit whose main inputs are connected to memory cells of the tamper-resistant non-volatile memory. Multiple obfuscation functions can be encoded in the tamper-resistant non-volatile memory to control corresponding obfuscated circuits in the second integrated circuit structure. The tamper-resistant non-volatile memory can be constructed by surrounding the memory cells with a metal mesh formed from multiple metal layers of the first integrated circuit structure, the metal mesh having a spacing that is less than an infrared wavelength. In some implementations, the Boolean function is used for multiple purposes, such as obfuscating a logic signal, obfuscating an operand data value, and selectively releasing a logic circuit by enabling a power-on signal of the logic circuit in response to a corresponding release key. The invention can accommodate reprogramming of the obfuscation function using a protocol that relies on symmetric keys, one of which is stored in the tamper-resistant non-volatile memory.

[0010] The foregoing and other objects, features and advantages of the various embodiments of the present invention will be apparent from the following detailed written description. BRIEF DESCRIPTION OF DRAWINGS

[0011] The present invention can be better understood with reference to the following drawings and detailed written description. The objects, features and advantages of the various embodiments of the present invention will be apparent from the following detailed written description.

[0012] Figure 1 is a front cross-section of a conventional garbled integrated circuit with a trusted chip (top layer) and an untrusted chip (bottom layer);

[0013] Figure 2 is a schematic diagram of a conventional binary adder circuit with garbled wiring shown in dashed lines;

[0014] Figure 3 is a plan view of a trusted Boolean function integrated in a tamper-resistant non-volatile memory for circuit garbling according to an embodiment of the present application;

[0015] Figure 4 is a schematic diagram of a garbled integrated circuit package with an adder circuit having a trusted Boolean function in the form of a lookup table according to an embodiment of the present application;

[0016] Figure 5 is a schematic diagram of a multiplexer cascade for synthesizing a Boolean function with control bits located in a tamper-resistant non-volatile memory according to an embodiment of the present application;

[0017] Figure 6 is a front cross-sectional view of a garbled integrated circuit showing a tamper-resistant non-volatile memory protected by a metal mesh according to an embodiment of the present application;

[0018] Figure 7 is a diagram showing a logic flow of a trusted manufacturing, chip garbling, and encryption process according to an embodiment of the present application;

[0019] Figure 8 is a graphical representation of how to use symmetric encryption for on-site chip garbling reprogramming according to an embodiment of the present application; and

[0020] Figure 9 is a chart depicting a logic flow of a garbled reprogramming protocol using symmetric encryption according to an embodiment of the present application.

[0021] The use of the same reference symbols in different drawings indicates similar or identical items. DETAILED DESCRIPTION

[0022] As noted above, there is a need to protect proprietary designs in integrated circuit structures. While obfuscated circuits go a long way in this regard, it becomes easier to reverse engineer an entire package if a competitor can still manage to detect the wiring of a trusted chip. There are several techniques that can be used to discern obfuscated circuits, including picosecond imaging circuit analysis, side-channel attacks, and reduced measurement levels. Thus, it would be desirable to have an improved circuit obfuscation method that overcomes these types of reverse engineering techniques. It would be even more advantageous if the method could be used to control access to chip resources. For example, depending on the trust level of a customer, some digital circuit functionality or computational resources could be limited by reconfiguring the hardware. These and other advantages are achieved in various embodiments of the present invention by providing a trusted obfuscated function integrated in a tamper-resistant non-volatile memory that is part of a trusted chip (back-end of line). In illustrative embodiments, the obfuscated function is a Boolean function implemented as a lookup table known only to the trusted foundry, but still able to control a logic function in an untrusted chip (front-end of line) in a way that cannot be reverse engineered. In some embodiments, the tamper-resistant non-volatile memory is an array of solid state memory cells manufactured as part of a trusted chip, with a high-pitch metal grid formed by multiple metal layers of the trusted chip surrounding the memory array. In addition to providing obfuscation of logic signals and data inputs, the Boolean function can be used to release IP circuit functionality, for example, by providing control over power inputs to the IP circuit. For some embodiments, on-site reprogramming of chip obfuscation can be used with symmetric encryption. Multiple Boolean obfuscated functions can be scattered across a single trusted chip.

[0023] Reference is now made to the drawings, and particularly to Figure 3 One embodiment 50 of a trusted Boolean function encoded in a tamper-resistant memory in accordance with the present invention is depicted. The trusted Boolean function 50 can be used to enable several operations related to circuit obfuscation for an integrated circuit design whose circuit is primarily embedded in an untrusted chip (i.e., a chip manufactured at an untrusted foundry). In this embodiment, the trusted Boolean function 50 allows (i) obfuscation of logic circuits, (ii) obfuscation of operand data, and (iii) release of IP blocks in an integrated circuit design by enabling power for the IP blocks. In Figure 3The inputs to the trusted Boolean function 50 are shown on the left side and the outputs on the right side. There are l IP circuits to be controlled, each having a release key of m bits, i.e. the release key of the first IP block (IP1) consists of the bits {rip11, rip21,..., ripm1} and the release key of the last IP block (IPl) consists of the bits {rip1l, rip2l,..., ripml}. When the release keys are processed by the trusted Boolean function 50, they result in power-up signals {pwrup1,..., pwrupl}. Each power-up signal is connected to the power enable line of the corresponding IP block. The power-up signals are only active in case the appropriate release key (based on the logic of the trusted Boolean function 50) is entered, i.e. an inappropriate release key will not result in activating its corresponding power-up signal and the IP block will remain disabled.

[0024] There are also n logic inputs from circuits integrated on the untrusted chip {li1,..., lin} and p data inputs from circuits integrated on the untrusted chip {di1,..., dip}. The trusted Boolean function 50 operates on the logic inputs to generate corresponding logic outputs {lo1,..., lon} that are connected to control signals of downstream logic circuits on the untrusted chip, and on the data inputs to generate corresponding data outputs {do1,..., don} that are connected to data signals of downstream logic circuits.

[0025] The trusted Boolean function 50 can in fact be any Boolean function, i.e. a representation of any collection of logic gates with an unlimited number of inputs and outputs. In some embodiments, other types of logic functions can be used in addition to Boolean functions, e.g. higher order or functions with operators other than AND, OR and NOT. Although Figure 3 A single Boolean obfuscation function is shown for implementing all the foregoing operations, but those skilled in the art will appreciate that multiple Boolean obfuscation functions can be provided via a tamper-resistant memory. In the illustrative implementation, the Boolean function is implemented using a lookup table.

[0026] Figure 4 A more specific example is given in which the trusted Boolean function is a logical XOR operation. This example is provided in the context of obfuscating a binary adder circuit 60. The obfuscated binary adder circuit 60 is structured in two parts, a trusted logic 62 that is manufactured in a trusted foundry and an untrusted logic 64 that is manufactured in an untrusted foundry. The obfuscated binary adder 60 has three inputs A, B and C in and two outputs S and C out A first lookup table 66 that encodes a logical XOR operation receives the inputs A and B and generates an intermediate signal D (compare prior art Figure 1gate 32). A second lookup table 68, which encodes the logical XOR operation, receives the intermediate signal D and the input C in and generates the output S (compare prior art Figure 1 gate 36). These logical functions 66, 68 are controlled by the content of the tamper-resistant memory in the trusted logic 62. The untrusted logic 64 contains downstream circuitry that further processes the signals. A first logical AND gate 70 within the untrusted logic 64 receives the inputs C in and D, while a second logical AND gate 72 within the untrusted logic 64 receives the inputs A and B. The outputs of the AND gates 70, 72 are connected to inputs of a logical OR gate 74 within the untrusted logic 64, the output of which is C out . The logic of the lookup tables is thus kept hidden. Not only is the connection invisible, but also the obfuscated logic is invisible compared to the previous solution ( Figure 1 ). Because the logic is hidden, the obfuscation is more secure. Also, the trusted logic is invisible to untrusted manufacturing. The skilled person will recognize that the circuitry of Figure 4 is rather simple, but the nature of the specific functional circuitry is not limited. And even for a given circuitry, there can be multiple (different) implementations of the various Boolean functions.

[0027] The trusted Boolean obfuscation function according to the invention can be implemented in various physical forms. Figure 5An embodiment 80 of a garbled look-up table using multiplexer circuits is depicted. The multiplexers are cascaded, i.e., the output of a given pair of multiplexers becomes the input of the next downstream multiplexer in the cascade. Any Boolean function can generally be synthesized using such a cascaded circuit. For example, a Boolean function with three inputs and one output can be synthesized using an eight-bit memory and seven 2:1 multiplexers 86. Each memory cell is programmed with a '0' or '1' value to encode the desired Boolean function. The memory cells are connected to the main input of the cascade in successive pairs, i.e., to the inputs of the multiplexers at the bottom of the cascade, and a given input x1, x2, x3 of the Boolean function is connected to the control line of each multiplexer in the corresponding column of multiplexers, i.e., one input (x3) controls the four multiplexers at the bottom of the cascade, another input (x2) controls the two multiplexers in the middle of the cascade, and the remaining input (x1) controls the final multiplexer. The output of the topmost multiplexer in the cascade becomes the output f of the Boolean function. For the garbled look-up table, the eight programming bits 84 are integrated into a tamper-resistant memory in the higher level 88 of the trusted integrated circuit (e.g., the back-end-of-line, or BEOL), while the multiplexer cascade 82 is integrated into the lower level 89 of the untrusted integrated circuit (e.g., the front-end-of-line, or FEOL). Thus, while the trusted integrated circuit structure can include the garbled circuit with the actual logic cells, in some embodiments it can contain only the control bits, while the garbled logic remains in the untrusted integrated circuit structure.

[0028] Figure 6 An embodiment of a tamper-resistant memory according to the present application is shown, which can be used to control untrusted logic in an integrated circuit 90. The integrated circuit 90 includes a trusted portion (BEOL) 92 and an untrusted portion (FEOL) 94. The trusted portion 92 can be manufactured separately from the untrusted portion 94, and the two portions are subsequently attached, or the trusted portion 92 can be manufactured on top of the untrusted portion 94, such that the integrated circuit 90 has a monolithic (monobloc) design. Each circuit portion has wiring at various horizontal metal layers ml to m7, with layers ml to m3 being FEOL and layers m4 to m7 being BEOL. Logic cells are formed on a semiconductor substrate 96 (e.g., silicon) to form the core operational circuitry of the integrated circuit 90, according to the particular design at hand. The integrated circuit 90 can have other layers not mentioned, such as polysilicon layers. Vias provide vertical connections between adjacent horizontal layers and the logic cells in the silicon layer 96.

[0029] The trusted portion 92 includes an array of solid state non-volatile memory cells 98 located between metal layers m4 and m5. In this cross-section, not all connections in the metal layers are shown for all memory cells. Further, although only one row of memory cells is shown, it will be appreciated that many rows of cells can be present and arranged in an array. In some embodiments of the invention, the memory cells 98 contain ReRAM as described above in connection with Figure 5 The programming bits for the multiplexer circuit controlling the cascade are described. The memory cells 98 are preferably ReRAM, but other memory types such as MRAM or PCM can be used. The metal in layer m5 completely overlaps the memory array, and the interconnect portion of the metal in layer m4 completely overlaps each respective memory cell 18. In this way, the two metal layers form a protective mesh around the array, resulting in a tamper-resistant memory.

[0030] In the illustrative embodiment, the mesh spacing provides a separation less than the wavelength of the infrared camera to prevent picosecond imaging circuit analysis (PICA reading) of the memory, approximately 1.3 microns. In alternative embodiments, the spacing is even smaller to effectively build a Faraday cage around the memory. In general, the holes in a Faraday cage must be less than about 1 / 10 of the wavelength of the detector, so for this embodiment the metal spacing will be less than 0.13 microns. This structure also protects the memory array from side-channel attacks as well as from side-channel and measurement reduction.

[0031] The obfuscation methods of the invention can be advantageously used with other security measures to enhance control over access to chip resources. These measures can include various cryptographic functions or physical unclonable functions, among others, whose keys are written into the tamper-resistant memory. Physical unclonable functions (PUFs) are devices that exploit inherent randomness introduced during manufacturing to provide a unique "fingerprint" or trust anchor for a physical entity. These features can be referenced Figure 7 for further understanding, Figure 7 A logic flow illustrating a trusted manufacturing, chip obfuscation and encryption process 100 according to one embodiment of the invention is shown. The process 100 can be divided into two groups of steps 102, 104. The steps 102 are performed by an untrusted foundry, while the steps 104 are performed by a trusted foundry. The process 100 begins with the untrusted foundry setting up chip manufacturing 106 based on a provided specific layout. Non-trusted manufacturing 108 is then performed for the pre-line logic and metal layers. At this point, the process is switched to the trusted foundry, which performs trusted manufacturing 110 for the remaining post-line for the chip including the tamper-resistant memory. Any final steps are performed 112 to complete the chip manufacturing, such as packaging. The encryption keys or PUF-generated keys are written into the tamper-resistant memory 114. The chip includes appropriate pins to allow programming of the memory cells. The following is described in connection withFigure 8 The additional obfuscated keys that are further explained are written to the tamper resistant memory 116. The trusted Boolean function for obfuscation is synthesized and the appropriate control bits are loaded in the lookup table 118. The chip is now deployed.

[0032] As mentioned above, multiple IP blocks (or other circuit blocks) in the chip can be selectively enabled and disabled via the trusted Boolean obfuscation function. The use of encryption or PUF generated keys allows this feature to be reprogrammed in a secure manner. Figure 8 An example 120 is shown of how the reprogramming of the chip obfuscation in the field can be done using symmetric encryption. A server or other computer system 122 is used to manage the obfuscation functions of multiple chips 124 (chips 1 through m). The server 122 is preferably a cloud server operating in a cloud environment. Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a provider of the service. This cloud model can include

[0033] The characteristics can include, but are not limited to, on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. On-demand self-service is the ability for cloud consumers to unilaterally provision computing capability (such as server time and network storage), automatically, without requiring human interaction with the service's provider. Broad network access refers to the ability to access the network on demand, and to use the access through standard mechanisms, promulgated by industry standards bodies, such as mobile phone, laptop computers, and personal digital assistants, among others. Resource pooling occurs when the provider's physical and virtual resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the consumer generally has no control or knowledge over the exact location of the provided resources but can be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Rapid elasticity refers to the ability to provision capabilities fast and elastically, including the ability to automatically provision and release capabilities to match demand. The capabilities available for provisioning typically appear to be unlimited and can be purchased in any quantity, at any time. Measured service is the ability for the cloud system to automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and the consumer of the service.

[0034] Service models can include, without limitation, software as a service, platform as a service, and infrastructure as a service. Software as a service (SaaS) refers to provision of consumer access to the provider's applications running on the cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based e-mail). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. Platform as a service (PaaS) refers to the provision of consumer access to a platform that is comprised of hardware and software resources (e.g., programming languages, libraries, services, and tools) used to develop, deploy, and run consumer-created or acquired applications. Consumers do not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but have control over the deployed applications and possibly application-hosting environment configurations. Infrastructure as a service (IaaS) refers to the provision of consumer access to processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure but have control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls).

[0035] Deployment models can include, without limitation, private cloud, community cloud, public cloud, and hybrid cloud. A private cloud refers to cloud infrastructure solely for an organization. It can be managed by the organization or a third party and can exist on-premises or off-premises. A community cloud is a cloud infrastructure shared by several organizations, with each organization supporting a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It can be managed by the organizations or a third party and can exist on-premises or off-premises. In a public cloud, cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services. Cloud infrastructure of a hybrid cloud is a combination of two or more types of clouds (private, community, or public), which remain unique entities but are bound together by standard or proprietary technologies that enable data and application portability.

[0036] Return Figure 8The chips 124 are assembled into one or more devices with communication hardware that allows the chips to communicate with an external network. The cloud server 122 can thereby communicate with the chips 124 via a network 126, such as the Internet. Each chip has a set of load obfuscation keys 1 through n and an encryption key loaded in the chip's tamper-resistant memory (obfuscation logic can also be programmed into the tamper-resistant memory). The load obfuscation keys are used to unlock programming of the corresponding obfuscation function. The cloud server 122 has access to a chip obfuscation and reprogramming database 128 that contains all load obfuscation keys and encryption (PUF) key sets symmetric to the encryption keys in the chips. When reprogramming of a particular chip is desired, the cloud server 122 transmits the relevant load obfuscation key to the chip along with new obfuscation data. The chip then loads the new data into its tamper-resistant memory. These operations are performed by logic circuits provided in the chip for this purpose. The new obfuscation data implements a different obfuscation function embedded in the tamper-resistant memory to selectively change access to particular circuit blocks of the chip.

[0037] Many different protocols can be used to perform the loading of the new obfuscation key. The protocol is preferably adapted to prevent man-in-the-middle attacks as well as any chip or cloud misreporting. The protocol can also advantageously be designed to be secure even if the communication link is insecure or if the chip or local device is untrusted. Figure 9 One suitable protocol 130 using symmetric encryption is shown in FIG. 1 1 according to an illustrative implementation. The protocol 130 begins when the cloud server receives a request 132 for chip obfuscation. The cloud server sends a transmission 134 to the chip with an initialization vector, a load obfuscation key that has been encrypted based on the initialization vector, and an obfuscated bit frame containing new obfuscation data. Here, the initialization vector is randomly generated and used to generate a different encrypted transmission even when the same data is sent. Each chip has a different encryption key, so if the transmitted frame is recorded (man-in-the-middle attack), it cannot be applied to another chip. When the chip receives the transmission, it decrypts the load obfuscation key and compares it 136 to the corresponding load obfuscation key currently stored in the tamper-resistant memory. If the two keys do not match, the previous state is reloaded 138 so that the operation is similar to loading a new state. A malicious chip cannot be used to discern the load obfuscation key because it is encrypted.

[0038] If the two load obfuscation keys match, the obfuscated bit frame is loaded into a memory register or lookup table 140. The chip then sends a response transmission 142 to the cloud server with the second initialization vector and the chip state that has been encrypted based on the initialization vector. The cloud server decrypts the chip state 144 to determine the result of whether the chip is good 146 or whether it (or the communication link) is bad 148. The result can be provided to the system manager. The protocol 130 allows for an unlimited number of obfuscated reprogramming. The reprogramming is not only used to protect the digital IP, but can additionally control the computational resources. The protocol is effective even if the communication channel is untrusted and the end device containing the chip that needs to be programmed is untrusted.

[0039] The present invention thus provides, in its various embodiments, an excellent solution for chip IP protection via circuit obfuscation. Since the obfuscation logic is implemented with tamper-resistant memory, it cannot be reverse-engineered. Certain chip functionality can be enabled depending on the user's trust level. In terms of grey market protection, the chip functionality is only enabled after board assembly and the end product is in the hands of a trusted user. A stolen chip or device will not function. For some implementations, the chip can be disabled at the end of the life cycle or after a preprogrammed number of clock cycles. These are just some of the many applications that the present invention can provide or enhance. It is therefore contemplated that other modifications can be made without departing from the scope of the invention defined in the appended claims.

Claims

1. A method for constructing a tamper-proof and obfuscated circuit, comprising: At least one obfuscation function is encoded into a tamper-proof non-volatile memory of a first integrated circuit structure having wiring connecting the tamper-proof non-volatile memory to output pads, wherein the first integrated circuit structure is manufactured by a trusted foundry as part of a trusted portion of an integrated circuit device, and wherein the logic of the at least one obfuscation function is obfuscated by the first integrated circuit structure to prevent external detection. as well as The first integrated circuit structure is attached to a second integrated circuit structure, the second integrated circuit structure having an obfuscation circuit and wiring connecting control signals of the obfuscation circuit to input pads of the second integrated circuit structure, wherein the attachment operatively connects the input pads of the second integrated circuit structure to the output pads of the first integrated circuit structure, the second integrated circuit structure being manufactured by an untrusted foundry as part of an untrusted portion of an integrated circuit device, and the obfuscation circuit comprising a plurality of circuit blocks in the untrusted portion of the integrated circuit device, the plurality of circuit blocks being selectively enabled or disabled based on a release key of at least one obfuscation function input to the trusted portion of the integrated circuit device.

2. The method of claim 1, wherein the obfuscation function is a Boolean function, and the encoding is performed based on a lookup table of the Boolean function.

3. The method of claim 2, wherein the control signal of the obfuscating circuit is input to a cascaded multiplexer circuit that implements the lookup table.

4. The method of claim 1, wherein the obfuscation function allows selective release of the circuit block by enabling a power-on signal for at least one circuit block of the second integrated circuit structure.

5. The method of claim 1, wherein a plurality of obfuscation functions are encoded in the tamper-proof non-volatile memory, which control various obfuscation circuits in the second integrated circuit structure.

6. The method of claim 1, wherein the obfuscation function represents a single logic gate.

7. The method of claim 1, wherein the tamper-proof non-volatile memory includes at least one loading obfuscation key and an encryption key, and the method further includes: Receive a newly encrypted obfuscation key and an obfuscated bit frame with at least one new obfuscation function; Use the encryption key to decrypt the new obfuscation key; Determine that the newly decrypted obfuscation key matches the loaded obfuscation key; and The obfuscation function is reprogrammed in response by loading the obfuscated bitframe into the tamper-proof non-volatile memory.

8. The method of claim 1, wherein the memory cell of the tamper-proof non-volatile memory is surrounded by a metal mesh formed by a plurality of metal layers of the first integrated circuit structure, the metal mesh having a spacing smaller than the infrared wavelength.

9. A confusion circuit, comprising: A first integrated circuit structure has a tamper-proof non-volatile memory encoding at least one obfuscation function and wiring connecting the tamper-proof non-volatile memory to an output pad, wherein the first integrated circuit structure is manufactured by a trusted foundry as part of a trusted portion of the obfuscation circuit, and wherein the logic of the at least one obfuscation function is obfuscated by the first integrated circuit structure to prevent external detection. as well as A second integrated circuit structure has a semiconductor substrate in which a plurality of logic units are formed, at least some of which are part of a logic circuit. The second integrated circuit structure includes wiring that interconnects one or more logic units of the logic circuit with a plurality of input pads. A first integrated circuit structure is attached to the second integrated circuit structure such that the input pads of the second integrated circuit structure are operatively connected to the output pads of the first integrated circuit structure. The second integrated circuit structure is manufactured by an untrusted foundry as part of an untrusted portion of the obfuscated circuit, and the plurality of logic units include a plurality of circuit blocks in the untrusted portion of the obfuscated circuit, the plurality of circuit blocks being selectively enabled or disabled based on a release key of at least one obfuscation function input to the trusted portion of the obfuscated circuit.

10. The obfuscation circuit of claim 9, wherein the obfuscation function is a Boolean function, and the encoding is performed based on a lookup table of the Boolean function.

11. The obfuscation circuit of claim 10, wherein the lookup table is implemented as a cascaded multiplexer circuit having a main input connected to the input pad.

12. The obfuscation circuit of claim 9, wherein the obfuscation function allows selective release of the at least one circuit block by enabling a power-on signal for at least one circuit block of the second integrated circuit structure.

13. The obfuscation circuit of claim 9, wherein a plurality of obfuscation functions are encoded in the tamper-proof non-volatile memory, which control corresponding logic circuits in the second integrated circuit structure.

14. The obfuscated circuit of claim 9, wherein the obfuscated function represents a single logic gate.

15. The obfuscated circuit of claim 9, wherein the first integrated circuit structure is configured as part of a back-end semiconductor manufacturing process and the second integrated circuit structure is configured as part of a front-end semiconductor manufacturing process.

16. The obfuscation circuit of claim 9, wherein the memory cells of the tamper-proof non-volatile memory are surrounded by a metal mesh formed by a plurality of metal layers of the first integrated circuit structure, the metal mesh having a spacing smaller than the infrared wavelength.

17. An integrated circuit, comprising: A first integrated circuit structure having a plurality of logic circuits controlled by logic signals to operate on operand data values, wherein the first integrated circuit structure is manufactured by an untrusted foundry as part of the untrusted portion of the integrated circuit. as well as A second integrated circuit structure has at least one Boolean function encoded in a tamper-proof non-volatile memory of the second integrated circuit structure, wherein the at least one Boolean function obfuscates one or more of the logic signals, obfuscates one or more of the operand data values, and selectively releases the at least one logic circuit by enabling a power-on signal for at least one of the logic circuits in response to a corresponding release key. The second integrated circuit structure is manufactured by a trusted foundry as part of the trusted portion of the integrated circuit. The logic of the at least one Boolean function is obfuscated by the second integrated circuit structure to prevent external detection, and The plurality of logic circuits in the first integrated circuit structure include a plurality of circuit blocks in the untrusted portion of the integrated circuit, the plurality of circuit blocks being selectively enabled or disabled based on a release key of at least one Boolean function input to the trusted portion of the integrated circuit.

18. The integrated circuit of claim 17, wherein the Boolean function is encoded based on a lookup table.

19. The integrated circuit of claim 18, wherein the lookup table is implemented as a cascaded multiplexer circuit, the main input of which is controlled by a memory cell of the tamper-proof non-volatile memory.

20. The integrated circuit of claim 17, wherein the tamper-proof non-volatile memory is configured as part of a back-end semiconductor manufacturing process, and the integrated circuit is configured as part of a front-end semiconductor manufacturing process.

Images