Secure and Unclonable Integrated Circuits

Semiconductor manufacturing is increasingly reliant in offshore foundries, which has raised concerns with counterfeiting, piracy, and unauthorized overproduction by the contract foundry. The recent shortage of semiconductors has aggravated such problems, with the electronic components market being flooded by recycled, remarked, or even out-of-spec, and defective parts. Moreover, modern internet connected applications require mechanisms that enable secure communication, which must be protected by security countermeasures to mitigate various types of attacks. In this thesis, we describe techniques to aid counterfeit prevention, and mitigate secret extraction attacks that exploit power consumption information. Counterfeit prevention requires simple and trustworthy identification. Physical unclonable functions (PUFs) harvest process variation to create a unique and unclonable digital fingerprint of an IC. However, learning attacks can model the PUF behavior, invalidating its unclonability claims. In this thesis, we research circuits and architectures to make PUFs more resilient to learning attacks. First, we propose the concept of non-monotonic response quantization, where responses not always encode the best performing circuit structure. Then, we explore the design space of PUF compositions, assessing the trade-off between stability and resilience to learning attacks. Finally, we introduce a lightweight key based challenge obfuscation technique that uses a chip unique secret to construct PUFs which are more resilient to learning attacks. Modern internet protocols demand message integrity, confidentiality, and (often) non-repudiation. Adding support for such mechanisms requires on-chip storage of a secret key. Even if the key is produced by a PUF, it will be subject to key extraction attacks that use power consumption information. Secure integrated circuits must address power analysis attacks with appropriate countermeasures. Traditional mitigation techniques have limited scope of protection, and impose several restrictions on how sensitive data must be manipulated. We demonstrate a bit-serial RISC-V microprocessor implementation with no plain-text data in the clear, where all values are protected using Boolean masking and differential domino logic. Software can run with little to no countermeasures, reducing code size and performance overheads. Our methodology is fully automated and can be applied to designs of arbitrary size or complexity. We also provide details on other key components such as clock randomizer, memory protection, and random number generator

A full-custom digital-signal-processing unit for real-time cortical blood flow monitoring

Master'sMASTER OF ENGINEERIN

A wave pipeline-based WCDMA multipath searcher for a high speed operation

The multiplexing technique of the Wideband-Code Division Multiple Access (WCDMA) is widely applied in the third generation (3G) of cellular systems. The WCDMA uses scrambling codes to differentiate the mobile terminals. In a channel, multipaths may occur when the transmitted signal is reflected from objects in the receiver's environment, so that multiple copies of the signal arrive at the antenna at different moments. Thus, a wideband signal may suffer frequency selective fading due to the multipath propagations. A Rake receiver is often used to combine the energies received on different paths, and a multipath searcher is needed to identify the multipath components and their associated delays. Correlating some shifted versions of the scrambling code with an incoming signal results in energy peaks at the multipath locations, when the locally generated scrambling sequence is aligned with the scrambling sequence of the incoming signal. A path acquisition in such a process requires a speed of millions of Multiply-Accumulate (MAC) cycles per second. The performances of the multipath searcher are mainly determined by the resolution and the acquisition time, which are often limited by the operation speed of the hardware resources. This thesis presents the design of a multipath searcher with a high resolution and a short acquisition time. The design consists of two aspects. The first aspect is of the searching algorithm. It is based on a double-dwell algorithm and a verification stage is introduced to lower the rate of false alarms. The second aspect in the design is the circuit of the searcher. This circuit is expected to operate at the chip rate of 3.84 MHz and the search period is chosen to be equal to the time interval of 5 slots, which requires a high operation speed of the computation units employed in the circuit. Moreover, in order to reduce the circuit complexity, only one Complex Multiplier-Accumulator (CMAC), instead of several ones in many existing searcher circuits, is employed to perform all the computation tasks without extending the search period, which make the computation time in the circuit more critical. Aiming at this challenge of the high speed requirement, a structure of the CMAC cell is designed with the technique of the wave pipeline, which permits the signal propagation through the circuit stages without constraints of clocks. For a good use of this technique, the circuit blocks are made to have equalized delay, by means of pass transistor logic cells, and by keeping such a delay short, the total computation time of the CMAC can be made within the required time limit of the searching. A complete circuit of the CMAC has been developed. It has two versions, with the Normal Process Complementary Pass Logic (NPCPL) and the Complementary Pass-Logic Transmission-Gates (CPL-TG), respectively. The structures of the arithmetic units have been chosen carefully so that the fan-in/fan-out constraints of the NPCPL and the CPL-TG logics are taken into consideration. The results of the simulation with a 0.18 om models have shown that this wave pipelined CMAC can process four inputs of 8 bits at a rate of 830 Mb/s. In order to evaluate the effectiveness of the searching algorithm, a Matlab simulation of the searcher circuit has been conducted. It has been observed that the proposed multipath searcher can lead to low probabilities of misdetection and false alarm for the test cases recommended by the 3 rd Generation Partnership Project (3GPP) standard. A test chip of the CMAC circuit has been fabricated in a CMOS 0.18 om technology process. The circuit is currently under test

On the Use of Directed Moves for Placement in VLSI CAD

Search-based placement methods have long been used for placing integrated circuits targeting the field programmable gate array (FPGA) and standard cell design styles. Such methods offer the potential for high-quality solutions but often come at the cost of long run-times compared to alternative methods. This dissertation examines strategies for enhancing local search heuristics---and in particular, simulated annealing---through the application of directed moves. These moves help to guide a search-based optimizer by focusing efforts on states which are most likely to yield productive improvement, effectively pruning the size of the search space. The engineering theory and implementation details of directed moves are discussed in the context of both field programmable gate array and standard cell designs. This work explores the ways in which such moves can be used to improve the quality of FPGA placements, improve the robustness of floorplan repair and legalization methods for mixed-size standard cell designs, and enhance the quality of detailed placement for standard cell circuits. The analysis presented herein confirms the validity and efficacy of directed moves, and supports the use of such heuristics within various optimization frameworks

Transistor-Level Layout of Integrated Circuits

In this dissertation, we present the toolchain BonnCell and its underlying algorithms. It has been developed in close cooperation with the IBM Corporation and automatically generates the geometry for functional groups of 2 to approximately 50 transistors. Its input consists of a set of transistors, including properties like their sizes and their types, a specification of their connectivity, and parameters to flexibly control the technological framework as well as the algorithms' behavior. Using this data, the tool computes a detailed geometric realization of the circuit as polygonal shapes on 16 layers. To this end, a placement routine configures the transistors and arranges them in the plane, which is the main subject of this thesis. Subsequently, a routing engine determines wires connecting the transistors to ensure the circuit's desired functionality. We propose and analyze a family of algorithms that arranges sets of transistors in the plane such that a multi-criteria target function is optimized. The primary goal is to obtain solutions that are as compact as possible because chip area is a valuable resource in modern techologies. In addition to the core algorithms we formulate variants that handle particularly structured instances in a suitable way. We will show that for 90% of the instances in a representative test bed provided by IBM, BonnCell succeeds to generate fully functional layouts including the placement of the transistors and a routing of their interconnections. Moreover, BonnCell is in wide use within IBM's groups that are concerned with transistor-level layout - a task that has been performed manually before our automation was available. Beyond the processing of isolated test cases, two large-scale examples for applications of the tool in the industry will be presented: On the one hand the initial design phase of a large SRAM unit required only half of the expected 3 month period, on the other hand BonnCell could provide valuable input aiding central decisions in the early concept phase of the new 14 nm technology generation

Design of complex integrated systems based on networks-on-chip: Trading off performance, power and reliability

The steady advancement of microelectronics is associated with an escalating number of challenges for design engineers due to both the tiny dimensions and the enormous complexity of integrated systems. Against this background, this work deals with Network-On-Chip (NOC) as the emerging design paradigm to cope with diverse issues of nanotechnology. The detailed investigations within the chapters focus on the communication-centric aspects of multi-core-systems, whereas performance, power consumption as well as reliability are considered likewise as the essential design criteria

Efficient schemes to size transistors for optimal delay by solving fanout branches with balancing algorithm

High performance digital system requires minimal logic and properly sized transistor to operate in all PVT corners. Specifically, high-speed data-path design is mostly about optimizing the system for better timing. In this work, the author proposed a better timing model to analyze parallel data-paths better for performance comparison. Moreover, a novel transistor sizing technique is also proposed as part of the work to minimize delay in parallel data-path circuits in the presence of practical wire capacitance. With this technique it is easier to calculate the optimal capacitance distribution in a fanout branch path that equalizes the delays in all branches as well as minimizes the overall delay starting from the primary inputs to the primary outputs of a circuit. The problem is widely termed as the "Load distribution problem at branch". A collection of fast algorithms were designed to accurately solve the load distribution problem for branch in digital circuits for optimal delay. The author used prior work on Unified Logical Effort[1] as a tool for delay estimation and transistor sizing. This research work also shows the impact of branching on critical path. Experiments are run on industry standard circuits using different types of tools developed to model the circuit. The new developed theories are tested on the circuit models , that are also included in this work

Layout optimization in ultra deep submicron VLSI design

As fabrication technology keeps advancing, many deep submicron (DSM) effects have become increasingly evident and can no longer be ignored in Very Large Scale Integration (VLSI) design. In this dissertation, we study several deep submicron problems (eg. coupling capacitance, antenna effect and delay variation) and propose optimization techniques to mitigate these DSM effects in the place-and-route stage of VLSI physical design. The place-and-route stage of physical design can be further divided into several steps: (1) Placement, (2) Global routing, (3) Layer assignment, (4) Track assignment, and (5) Detailed routing. Among them, layer/track assignment assigns major trunks of wire segments to specific layers/tracks in order to guide the underlying detailed router. In this dissertation, we have proposed techniques to handle coupling capacitance at the layer/track assignment stage, antenna effect at the layer assignment, and delay variation at the ECO (Engineering Change Order) placement stage, respectively. More specifically, at layer assignment, we have proposed an improved probabilistic model to quickly estimate the amount of coupling capacitance for timing optimization. Antenna effects are also handled at layer assignment through a linear-time tree partitioning algorithm. At the track assignment stage, timing is further optimized using a graph based technique. In addition, we have proposed a novel gate splitting methodology to reduce delay variation in the ECO placement considering spatial correlations. Experimental results on benchmark circuits showed the effectiveness of our approaches

Exploitation of Unintentional Information Leakage from Integrated Circuits

Unintentional electromagnetic emissions are used to recognize or verify the identity of a unique integrated circuit (IC) based on fabrication process-induced variations in a manner analogous to biometric human identification. The effectiveness of the technique is demonstrated through an extensive empirical study, with results presented indicating correct device identification success rates of greater than 99:5%, and average verification equal error rates (EERs) of less than 0:05% for 40 near-identical devices. The proposed approach is suitable for security applications involving commodity commercial ICs, with substantial cost and scalability advantages over existing approaches. A systematic leakage mapping methodology is also proposed to comprehensively assess the information leakage of arbitrary block cipher implementations, and to quantitatively bound an arbitrary implementation\u27s resistance to the general class of differential side channel analysis techniques. The framework is demonstrated using the well-known Hamming Weight and Hamming Distance leakage models, and approach\u27s effectiveness is demonstrated through the empirical assessment of two typical unprotected implementations of the Advanced Encryption Standard. The assessment results are empirically validated against correlation-based differential power and electromagnetic analysis attacks