Anti-tamper obfuscation circuit

Abstract

The obfuscation circuit relies on tamper-resistant nonvolatile memory that encodes trusted Boolean functions. The Boolean functions are used to enable several circuit obfuscation operations, including logic circuit obfuscation, operand data obfuscation, and IP block release. The tamper-resistant nonvolatile memory is part of a trusted integrated circuit structure, i.e., fabricated by a trusted foundry, that contains the various operational logic circuits of the design and is separate from other integrated circuit structures fabricated by untrusted foundries. The Boolean functions are encoded based on lookup tables implemented as cascaded multiplexer circuits. Multiple obfuscation functions may be so encoded. The obfuscation functions may be reprogrammed using a protocol that relies on symmetric keys, one of which is stored in the tamper-resistant nonvolatile memory.

Description

[Technical field]

[0001] The present invention relates generally to integrated circuits, and more particularly to a method for protecting computer hardware using obfuscated circuits. [Background technology]

[0002] Integrated circuits are used in a wide variety of electronic applications ranging from simple devices such as wristwatches to the most complex computer systems. A microelectronic integrated circuit (IC) chip can be broadly thought of as a collection of logic cells with electrical interconnections between the cells, formed on a semiconductor substrate (e.g., silicon). An IC can contain a very large number of cells and require complex connections between the cells. A cell is a group of one or more circuit elements, such as transistors, capacitors, resistors, inductors, and other basic circuit elements coupled to perform a logic function. Cell types include, for example, core cells, scan cells, input / output (I / O) cells, and memory (storage) cells. Each of the cells of an IC may have one or more pins, and each of the one or more pins may then be connected by wires to one or more other pins of the IC. Wires connecting the pins of the IC are also formed on the surface of the chip. In more complex designs, there may be many separate layers of conductive media available for routing, such as polysilicon layers and multiple metal layers (metal-1, metal-2, etc.).

[0003] IC chips are manufactured by first conceiving a logical circuit description and then translating that logical description into a physical description or geometric layout. This process is usually performed with a "netlist". A "netlist" is a record of all of the nets or interconnects between cell pins, including information about various components such as transistors, resistors, and capacitors. The layout typically consists of a set of planar geometric shapes for several layers. The layout is then checked to ensure that it meets all design requirements, especially timing requirements. The result is a set of design files, known as intermediate forms, that describe the layout. The design files are then processed through a data preparation process that is used to produce patterns, called masks, by optical or electron beam pattern generators. During manufacturing, these masks are used to etch or deposit features into silicon wafers in a series of photolithographic steps.

[0004] Chip designers are increasingly striving to maintain secrecy of proprietary designs for integrated circuits. The proprietary designs may be contained within circuits referred to as IP (intellectual property) blocks, for example. Even if foundries can be trusted to protect circuit design netlists, there are still various reverse engineering techniques that can be used to identify these proprietary circuits from physical analysis of the chip. As a result, several approaches have been devised to counter such reverse engineering techniques. One approach is circuit obfuscation. An obfuscated circuit modifies the structure of an integrated circuit to intentionally hide the functionality of the integrated circuit. One way this modification can occur is by splitting the manufacture of an IC chip into two parts, one "trusted" and one "untrusted." As shown in FIG. 1, an integrated circuit package 10 is comprised of a trusted chip 12 and an untrusted chip 14. The untrusted chip 14 contains various logic devices 16 that form the core of the chip functionality. The logic devices 16 are connected to each other and to external pads by wiring 18. However, some of the connections are incomplete and require wiring 20 in the trusted chip 12 to complete the circuit. The pads of the trusted chip 12 are electrically connected to the pads of the untrusted chip 14 by any conventional means, such as joints with C4 solder balls 22. According to this example, the untrusted chip 14 is manufactured by an untrusted foundry and the trusted chip 12 is manufactured by a trusted foundry. Thus, the wiring 18 of the untrusted chip 14 may be discoverable, but the wiring 20 of the trusted chip 12 remains hidden. The hidden wiring 20 is also connected to input / output (I / O) pins 24. In this way, the chip rights owner can assemble the IC package 10 in a secure manner by attaching the trusted chip 12 to the untrusted chip 14 without the untrusted foundry ever becoming aware of the details of the hidden wiring 20. Because the trusted chip 12 contains only wiring and no logic, it can be a much cheaper interposer to manufacture than the untrusted chip 14.

[0005] Figure 2 shows an example of how obfuscation can work for a simple adder circuit 30. A basic binary adder circuit produces the sum S of two binary numbers A and B, and expresses the Boolean expression

number

[0006] The invention in at least one embodiment is generally directed to a method of constructing a tamper-resistant obfuscation circuit by encoding at least one obfuscation function in a tamper-resistant non-volatile memory of a first integrated circuit structure having wiring connecting the tamper-resistant non-volatile memory to an output pad, and attaching the first integrated circuit structure to a second integrated circuit structure having the obfuscation circuit and wiring connecting a control signal of the obfuscation circuit to an input pad, the input pad of the second integrated circuit structure being operatively connected to the output pad of the first integrated circuit structure. In an exemplary embodiment, the obfuscation function is a Boolean function and the encoding is based on a lookup table for the Boolean function. The lookup table may be implemented as a cascaded multiplexer circuit with a primary input connected to a memory cell of the tamper-resistant non-volatile memory. Multiple obfuscation functions may be encoded in the tamper-resistant non-volatile memory to control respective obfuscation circuits in the second integrated circuit structure. The tamper-resistant non-volatile memory may be constructed by surrounding memory cells formed from multiple metal layers of a first integrated circuit structure with a metal mesh having a spacing less than an infrared wavelength. In some embodiments, the Boolean functions are used for multiple purposes, such as obfuscating logic signals, obfuscating operand data values, and selectively releasing logic circuits by enabling a power-up signal for the logic circuits according to a corresponding release key. The present invention may be adapted for reprogramming the obfuscation function using a protocol that relies on symmetric keys, one of which is stored in the tamper-resistant non-volatile memory.

[0007] The above, as well as additional objects, features and advantages of various embodiments of the present invention will become apparent in the following detailed written description.

[0008] The present invention may be better understood, and its numerous objects, features, and advantages of various embodiments made apparent to those skilled in the art by reference to the accompanying drawings. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a cross-sectional elevation view of a conventional obfuscated integrated circuit having a trusted chip (top) and an untrusted chip (bottom). [Diagram 2] FIG. 1 is a schematic diagram of a conventional binary adder circuit showing obfuscated wiring in dashed lines. [Diagram 3] FIG. 2 is a floor plan view of a trusted Boolean function integrated into a tamper-resistant non-volatile memory for circuit obfuscation according to one embodiment of the present invention. [Figure 4] FIG. 1 is a schematic diagram of an obfuscated integrated circuit package having an adder circuit that uses a trusted Boolean function in the form of a lookup table, according to one embodiment of the present invention. [Diagram 5] FIG. 1 is a schematic diagram of a multiplexer cascade used to synthesize Boolean functions, with control bits located in a tamper-resistant non-volatile memory, according to one embodiment of the present invention. [Figure 6] FIG. 2 is a cross-sectional elevation view of an obfuscated integrated circuit showing a tamper-resistant non-volatile memory protected by a metal mesh according to one embodiment of the present invention. [Figure 7] 1 is a chart illustrating a logic flow for a trusted manufacturing, chip obfuscation, and encryption process according to one embodiment of the present invention. [Figure 8] 1 is a graphical representation of in-field chip obfuscation reprogramming using symmetric encryption according to one embodiment of the present invention. [Figure 9] 1 is a chart illustrating the logic flow for an obfuscated reprogramming protocol using symmetric encryption, according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] The use of the same reference symbols in different drawings refers to similar or identical items.

[0011] As mentioned above, there is a need to protect proprietary designs in integrated circuit structures. Obfuscated circuits are very effective in this regard, but still, if a competitor can somehow detect the wiring of a trusted chip, it becomes quite easy to reverse engineer the entire package. There are several techniques that can be used to identify obfuscated circuits, including picosecond imaging circuit analysis, side channel attacks, and delaying with measurements. Therefore, it is desirable to devise an improved method of circuit obfuscation that can overcome these kinds of reverse engineering techniques. It would be even more advantageous if the method could be used to control access to chip resources. For example, depending on the level of customer trust, some digital circuit functionality or computing resources can be restricted by reconfiguring the hardware. These and other advantages are achieved in various embodiments of the present invention by providing a trusted obfuscation function that is integrated into a tamper-resistant non-volatile memory that is part of the trusted chip (back end of line). In an exemplary embodiment, the obfuscation function is a Boolean function implemented as a look-up table known only to the trusted foundry, and is still capable of controlling logic functions in the untrusted chip (substrate process; front end of line) in a manner that cannot be reverse engineered. In some implementations, the tamper-resistant non-volatile memory is an array of solid-state memory cells fabricated as part of the trusted chip, with a high pitch metal mesh formed from multiple metal layers of the trusted chip surrounding the memory array. In addition to providing obfuscation of logic signals and data inputs, the Boolean function can be used to free up IP circuit functionality, for example, by providing control over power inputs to the IP circuit. For some implementations, the chip obfuscation can be reprogrammed in the field using symmetric encryption. Multiple Boolean obfuscation functions can be distributed on a single trusted chip.

[0012] Referring now to the drawings, and in particular to FIG. 3, there is shown one embodiment of a trusted Boolean function 50 encoded in a tamper-resistant memory according to the present invention. The trusted Boolean function 50 may be used to enable several operations related to circuit obfuscation for integrated circuit designs whose circuits are primarily incorporated in untrusted chips, i.e., chips made at untrusted foundries. In this embodiment, the trusted Boolean function 50 enables (i) obfuscation of logic circuits, (ii) obfuscation of operand data, and (iii) release of IP blocks in an integrated circuit design by enabling power to the IP blocks when the appropriate release key is input. In FIG. 3, the inputs to the trusted Boolean function 50 are shown on the left and the outputs are shown on the right. There are l IP circuits to be controlled, each with a release key having m bits. That is, the release key for the first IP block (IP1) is composed of the bits {rip11, rip21, ..., ripm1} and the release key for the last IP block (IPl) is composed of the bits {rip1l, rip2l, ..., ripml}. When the release keys are processed by the trusted Boolean function 50, they result in activation signals {pwrup1,...,pwrupl}. Each activation signal is connected to the power enable line of a respective IP block. An activation signal is active only if the appropriate release key (based on the logic of the trusted Boolean function 50) is input. That is, an inappropriate release key will not result in activation of its corresponding activation signal and the IP block will remain disabled.

[0013] There are also n logic inputs {li1,...,lin} coming from circuits integrated on the untrusted chip, and p data inputs {di1,...,dip} coming from circuits integrated on the untrusted chip. The trusted Boolean function 50 operates on the logic inputs to generate corresponding logic outputs {lo1,...,lon} that are connected to control signals of downstream logic circuits on the untrusted chip, and on the data inputs to generate corresponding data outputs {do1,...,dop} that are connected to data signals of the downstream logic circuits.

[0014] The trusted Boolean function 50 may be virtually any Boolean function, i.e., a representation of any set of logic gates with an unlimited number of inputs and outputs. In some embodiments, other types of logic functions besides Boolean may be used, such as functions with higher order or operators other than "AND", "OR", and "NOT". While FIG. 3 shows a single Boolean obfuscation function to enable all of the operations described above, one skilled in the art will appreciate that multiple Boolean obfuscation functions may be provided via the tamper-resistant memory. In an exemplary embodiment, the Boolean function is implemented using a lookup table.

[0015] 4 provides a more specific example in which the trusted Boolean function is a logical XOR operation. This example is provided in the context of an obfuscated binary adder circuit 60. The obfuscated binary adder circuit 60 is constructed in two parts, trusted logic 62 fabricated in a trusted foundry and untrusted logic 64 fabricated in an untrusted foundry. The obfuscated binary adder 60 has three inputs A, B, and C. in , and two outputs S and C out A first lookup table 66, which encodes a logical XOR operation, receives inputs A and B and produces intermediate signal D (compare gate 32 of prior art FIG. 1). A second lookup table 68, which also encodes a logical XOR operation, receives intermediate signal D and input C and produces intermediate signal D (compare gate 32 of prior art FIG. 1). inand produces an output S (compare gate 36 in prior art FIG. 1). These logic functions 66, 68 are controlled by the contents of a tamper-resistant memory in the trusted logic 62. The untrusted logic 64 contains downstream circuitry for further signal processing. A first logic AND gate 70 in the untrusted logic 64 receives input C in and D, and a second logical AND gate 72 in the untrusted logic 64 receives inputs A and B. The outputs of the AND gates 70, 72 are out The logic of the look-up table thus remains hidden. Compared to the previous solution (FIG. 1), not only are the connections invisible, but the obfuscated logic is also invisible. The obfuscation is more secure because the logic is hidden. Also, the trusted logic is invisible from the untrusted fabrication. While the circuit of FIG. 4 is very simple for purposes of illustration, those skilled in the art will appreciate that there is no limit to the nature of the specific functional circuitry and that even for a given circuit, there may be multiple (different) implementations of the various Boolean functions.

[0016] A reliable Boolean obfuscation function according to the present invention can be implemented in various physical forms. Figure 5 shows one embodiment 80 of a look-up table obfuscated using multiplexer circuits 82. The multiplexers are cascaded, i.e. the output of a given pair of multiplexers becomes the input to the next downstream multiplexer in the cascade. Any Boolean function can generally be synthesized using such a cascade circuit. For example, a Boolean function with three inputs and one output can be synthesized using an 8-bit memory 84 and seven 2:1 multiplexers 86. Each memory cell is programmed with a value of either "0" or "1" to encode the desired Boolean function. The memory cells are connected in successive pairs to the primary input of the cascade, i.e. the input of the bottom multiplexer of the cascade. A given input x1, x2, x3 to the Boolean function is connected to the control lines of each multiplexer in the corresponding multiplexer row, i.e., one input (x3) controls the bottom four multiplexers in the cascade, another input (x2) controls the middle two multiplexers in the cascade, and the remaining input (x1) controls the last multiplexer. The output of the top multiplexer in the cascade becomes the output f of the Boolean function. To obfuscate the lookup table, eight program bits 84 are integrated into a tamper-resistant memory in a higher level 88 (e.g., wiring process, i.e., BEOL) of the trusted integrated circuit, and the multiplexer cascade 82 is integrated into a lower level 89 (e.g., substrate process, i.e., FEOL) of the untrusted integrated circuit. Thus, the trusted integrated circuit structure may include an obfuscated circuit with actual logic cells, which in some implementations may only include control bits, with the obfuscated logic remaining in the untrusted integrated circuit structure.

[0017] FIG. 6 illustrates one embodiment of a tamper-resistant memory according to the present invention that may be used to control untrusted logic in an integrated circuit 90. The integrated circuit 90 includes a trusted portion (BEOL) 92 and an untrusted portion (FEOL) 94. The trusted portion 92 may be fabricated separately from the untrusted portion 94 and the two portions then attached, or the trusted portion 92 may be fabricated on top of the untrusted portion 94 such that the integrated circuit 90 is a monolithic (unitary) design. Each circuit portion has wiring in various horizontal metal layers m1-m7, with layers m1-m3 being FEOL and layers m4-m7 being BEOL. Logic cells are formed on a semiconductor substrate 96 (e.g., silicon) to form the core operating circuitry of the integrated circuit 90 according to the particular design at hand. The integrated circuit 90 may have other layers, e.g., polysilicon layers, not shown. Vias provide vertical connections between the logic cells in adjacent horizontal layers and the silicon layer 96.

[0018] The trusted portion 92 includes an array of solid state non-volatile memory cells 98 located between metal layers m4 and m5. In this cross section, not all of the metal layer connections are shown for all of the memory cells. Also, while only one row of memory cells is shown, it should be understood that there may be many rows of cells arranged side by side in the array. In some embodiments of the invention, the memory cells 98 include program bits for controlling the cascaded multiplexer circuitry described above in conjunction with FIG. 5. The memory cells 98 are preferably resistive random access memory (ReRAM), although other memory types may be used, such as magnetoresistive random access memory (MRAM) or phase change memory (PCM). The metal of layer m5 completely overlies the memory array, and the metal interconnects in layer m4 completely overlie each memory cell 98. In this manner, the two metal layers form a protective mesh to surround the array, thereby creating a tamper-resistant memory.

[0019] In an exemplary embodiment, the mesh pitch provides spacing of approximately 1.3 micrometers, less than an infrared camera wavelength, to prevent picosecond imaging circuit analysis (PICA reads) of the memory. In an alternative embodiment, the spacing is even smaller to effectively build a Faraday cage around the memory. Generally, the holes in the Faraday cage must be less than about 1 / 10 of the detector wavelength, thus resulting in a metal spacing of less than 0.13 micrometers for this embodiment. This structure further protects the memory array against side channel attacks and delay ring and measurement.

[0020] The obfuscation method of the present invention may be advantageously used in conjunction with other security measures to enforce control over access to chip resources. These measures may include, among others, various cryptographic functions, or physical unclonable functions, where keys are written into tamper-resistant memory. A physical unclonable function (PUF) is a device that leverages inherent randomness introduced during manufacturing to give a physical entity a unique "fingerprint" or trust anchor. These features may be further understood with reference to the chart in FIG. 7. FIG. 7 illustrates a logic flow for a trusted manufacturing, chip obfuscation and encryption process 100 according to one embodiment of the present invention. The process 100 may be broken down into two sets of steps 102, 104. Step 102 is performed by an untrusted foundry, and step 104 is performed by a trusted foundry. The process 100 begins with the untrusted foundry setting up chip manufacturing 106 based on a particular layout provided. Untrusted manufacturing 108 is then performed on the substrate process logic and metal layers. At this point, the process is handed over to a trusted foundry, which performs trusted manufacturing 110 for the remaining wiring steps, including the tamper-resistant memory. Any final steps, such as packaging, are performed to complete chip manufacturing 112. A cryptographic key or PUF-generated key is written into the tamper-resistant memory 114. The chip includes appropriate pins to make the memory cells programmable. An additional obfuscation key, described further below in conjunction with FIG. 8, is written into the tamper-resistant memory 116. A trusted Boolean function for obfuscation is synthesized and appropriate control bits are loaded into a lookup table 118. The chip is now ready for deployment.

[0021] As described above, multiple IP blocks (or other circuit blocks) within a chip can be selectively enabled and disabled via a trusted Boolean obfuscation function. Through the use of a cryptographic key or a PUF-generated key, this feature can be reprogrammed in a secure manner. FIG. 8 shows an example 120 of how chip obfuscation can be reprogrammed in the field using symmetric encryption. A server or other computer system 122 is used to manage the obfuscation functions for multiple chips 124 (chips 1-m). The server 122 is preferably a cloud server and operates within a cloud environment. Cloud computing is a model of service delivery for enabling convenient on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. This cloud model can include a variety of characteristics, service models, and deployment models.

[0022] Characteristics may include, but are not limited to, on-demand service, broad network access, resource sharing, rapid scalability, and service being scalable. On-demand self-service refers to the ability of cloud consumers to unilaterally provision computing capabilities, such as server time and network storage, as needed, automatically, without the need for human interaction with the service provider. Broad network access refers to capabilities that are available on the network and accessed through standard mechanisms that facilitate use by heterogeneous thin-client or thick-client platforms (e.g., mobile phones, laptops, and personal digital assistants). Resource sharing occurs when provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated according to demand. Location independence is implied in that consumers generally do not have control or knowledge over the exact location of the resources provided, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center). Rapid scalability means that capabilities can be quickly and elastically provisioned to instantly scale out, and quickly released to instantly scale in, sometimes automatically. To the consumer, the capabilities available for provisioning often appear unlimited and can be purchased in any quantity at any time. Service meterability is the ability of a cloud system to automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being used.

[0023] Service models may include, but are not limited to, Software as a Service, Platform as a Service, and Infrastructure as a Service. Software as a Service (SaaS) refers to the capability provided to the consumer to use the provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through a thin client interface such as a web browser. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. Platform as a Service (PaaS) refers to the capability provided to the consumer to deploy consumer-created or consumer-acquired applications on a cloud infrastructure, created using programming languages ​​and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, to the extent possible, the application hosting environment configuration. Infrastructure as a Service (IaaS) refers to the capability provided to a consumer to supply processing, storage, networking, and other basic computing resources on which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and possibly limited control over select networking components (e.g., host firewalls).

[0024] Deployment models may include, but are not limited to, private cloud, community cloud, public cloud, and hybrid cloud. A private cloud refers to cloud infrastructure operated solely for an organization. The cloud infrastructure may be managed by that organization or a third party and may reside on-premise or off-premise. A community cloud has cloud infrastructure shared by multiple organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). The cloud infrastructure may be managed by the organization or a third party and may reside on-premise or off-premise. In a public cloud, the cloud infrastructure is made available to the general public or large industry groups and is owned by the organization that sells the cloud services. The cloud infrastructure for a hybrid cloud remains a unique entity but is a composite of two or more clouds (private, community, or public) bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0025] Returning to FIG. 8, the chips 124 are assembled into one or more devices having communication hardware that allows the chips to communicate with external networks. The cloud server 122 may thereby communicate with the chips 124 over a network 126, such as the Internet. Each chip has a set of load obfuscation keys 1-n and encryption keys that are loaded into the chip's tamper-resistant memory (obfuscation logic may also be programmed into the tamper-resistant memory). The load obfuscation keys are used to unlock the programming of the respective obfuscation functions. The cloud server 122 may access a chip obfuscation and reprogramming database 128, which contains the set of load obfuscation keys and all of the encryption keys and symmetric encryption (PUF) keys in the chip. When reprogramming of a particular chip is desired, the cloud server 122 sends the associated load obfuscation key to the chip along with new obfuscated data. The chip then loads the new data into its tamper-resistant memory. These operations are performed by logic circuitry provided for this purpose in the chip. The new obfuscation data implements different obfuscation functions that are embedded in the tamper-resistant memory to selectively modify access to specific circuit blocks of the chip.

[0026] Several different protocols can be used to perform the loading of the new obfuscated key. The protocol is preferably adapted to prevent man-in-the-middle attacks and any chip or cloud misinformation. The protocol can also be advantageously designed to be secure even if the communication link is not secure or the chip or local device is not trustworthy. One suitable protocol 130 using symmetric encryption according to an exemplary embodiment is seen in FIG. 9. The protocol 130 starts when the cloud server receives a request 132 for chip obfuscation. The cloud server sends a transmission 134 to the chip with an initialization vector, the loaded obfuscated key that is encrypted based on the initialization vector, and an obfuscated bit frame that contains the new obfuscated data. Here, the initialization vector is randomly generated and used to generate different encrypted transmissions even when identical data is transmitted. Each chip has a different encryption key, so if a transmitted frame is recorded (man-in-the-middle attack), it cannot be applied to another chip. When the chip receives this transmission, it decrypts the load obfuscation key and compares it to the corresponding load obfuscation key currently stored in the tamper-resistant memory 136. If the two keys do not match, the previous state is reloaded 138 so that the operation is similar to loading a new state. Because the load obfuscation key is encrypted, a malicious chip cannot be used to identify the load obfuscation key.

[0027] If the two loaded obfuscated keys match, the obfuscated bit frame is loaded 140 into a memory register or lookup table. The chip then sends 142 a response transmission to the cloud server with the second initialization vector and the chip state encrypted based on the initialization vector. The cloud server decrypts the chip state 144 to determine the result whether the chip is good 146 or whether the chip (or communication link) is bad 148. The result may be provided to a system administrator. The protocol 130 allows for an unlimited number of obfuscated reprogrammings. Reprogramming may provide additional control over computing resources as well as serve to protect digital IP. The protocol is effective even when the communication channel is untrusted and the end device containing the chip that needs to be programmed is untrusted.

[0028] The present invention in its many embodiments thereby provides a superior solution to chip IP protection through circuit obfuscation. The obfuscated logic is realized using tamper-resistant memory so that it cannot be reverse engineered. Certain chip functionality can be enabled depending on the trust level of the user. In terms of gray market protection, chip functionality can be enabled only after the finished printed circuit board and end product are in the hands of a trusted user. Stolen chips or devices will be rendered non-functional. In some embodiments, the chip may be disabled at the end of its life cycle or after a preprogrammed number of clock cycles. These are only some of the many applications that may be provided or enhanced by the present invention. It is therefore contemplated that other modifications may be made without departing from the scope of the present invention as defined in the appended claims.

Claims

1. 1. A method for constructing a tamper-resistant obfuscated circuit, comprising: encoding at least one obfuscation function within a tamper-resistant non-volatile memory of a first integrated circuit structure having wiring connecting the tamper-resistant non-volatile memory to an output pad; attaching the first integrated circuit structure to a second integrated circuit structure having an obfuscation circuit and wiring connecting control signals of the obfuscation circuit to input pads, said attaching operatively connecting the input pads of the second integrated circuit structure to the output pads of the first integrated circuit structure; A method comprising:

2. 2. The method of claim 1, wherein the obfuscation function is a Boolean function and the encoding is based on a lookup table for the Boolean function.

3. 3. The method of claim 2, wherein the control signal of the obfuscation circuit is an input to a cascaded multiplexer circuit that implements the lookup table.

4. 2. The method of claim 1, wherein the obfuscation function enables selective release of at least one circuit block of the second integrated circuit structure by enabling an activation signal for the circuit block.

5. 2. The method of claim 1, wherein a plurality of obfuscation functions are encoded in the tamper-resistant non-volatile memory that control respective obfuscation circuits in the second integrated circuit structure.

6. The method of claim 1 , wherein the obfuscation function represents a single logic gate.

7. the tamper-resistant non-volatile memory includes at least one load obfuscation key and an encryption key; receiving an obfuscated bit frame having a new obfuscation key and at least one new obfuscation function to be encrypted; decrypting the new obfuscated key using the encryption key; determining that the decrypted new obfuscated key matches the load obfuscated key; in response, reprogramming the obfuscation function by loading the obfuscated bit frame into the tamper-resistant non-volatile memory; The method of claim 1 further comprising:

8. 2. The method of claim 1, wherein memory cells of the tamper-resistant non-volatile memory are surrounded by a metal mesh formed from multiple metal layers of the first integrated circuit structure, the metal mesh having a spacing less than an infrared wavelength.

9. An obfuscation circuit, comprising: a first integrated circuit structure having a tamper-resistant non-volatile memory encoding at least one obfuscation function, the first integrated circuit structure having wiring connecting the tamper-resistant non-volatile memory to an output pad; a second integrated circuit structure having a semiconductor substrate having a plurality of logic cells formed thereon, at least some of the plurality of logic cells being part of a logic circuit, the second integrated circuit structure including wiring interconnecting one or more logic cells of the logic circuit with a plurality of input pads, the first integrated circuit structure being attached to the second integrated circuit structure such that the input pads of the second integrated circuit structure are operatively connected to the output pads of the first integrated circuit structure; An obfuscation circuit comprising:

10. 10. The obfuscation circuit of claim 9, wherein the obfuscation function is a Boolean function and the encoding is based on a lookup table for the Boolean function.

11. 11. The obfuscation circuit of claim 10, wherein the lookup table is implemented as a cascaded multiplexer circuit having a primary input connected to the input pad.

12. 10. The obfuscation circuit of claim 9, wherein the obfuscation function enables selective release of at least one circuit block of the second integrated circuit structure by enabling an activation signal for the at least one circuit block.

13. 10. The obfuscation circuit of claim 9, wherein a plurality of obfuscation functions are encoded in the tamper-resistant non-volatile memory that control respective logic circuits within the second integrated circuit structure.

14. 10. The obfuscation circuit of claim 9, wherein the obfuscation function represents a single logic gate.

15. 10. The obfuscation circuit of claim 9, wherein the first integrated circuit structure is constructed as part of a wiring step of a semiconductor manufacturing process and the second integrated circuit structure is constructed as part of a substrate step of a semiconductor manufacturing process.

16. 10. The obfuscation circuit of claim 9, wherein memory cells of the tamper-resistant non-volatile memory are surrounded by a metal mesh formed from multiple metal layers of the first integrated circuit structure, the metal mesh having a spacing less than an infrared wavelength.

17. 1. An integrated circuit package comprising: an integrated circuit having a plurality of logic circuits controlled by logic signals to operate on operand data values; at least one Boolean function encoded in the tamper-resistant non-volatile memory, the Boolean function obfuscating one or more of the logic signals, obfuscating one or more of the operand data values, and selectively releasing at least one of the logic circuits by enabling an activation signal for the at least one logic circuit in response to a corresponding release key; An integrated circuit package comprising:

18. 20. The integrated circuit package of claim 17, wherein the Boolean function is encoded based on a lookup table.

19. 20. The integrated circuit package of claim 18, wherein said lookup table is implemented as a cascaded multiplexer circuit whose primary inputs are controlled by memory cells of said tamper-resistant non-volatile memory.

20. 20. The integrated circuit package of claim 17, wherein said tamper-resistant non-volatile memory is constructed as part of a wiring step of a semiconductor manufacturing process and said integrated circuit is constructed as part of a substrate step of a semiconductor manufacturing process.

Images