Aijiao Cui

IP Watermarking Using Incremental Technology Mapping at Logic Synthesis Level

This paper proposes an adaptive watermarking technique by modulating some closed cones in an originally optimized logic network (master design) for technology mapping. The headroom of each disjoint closed cone is evaluated based on its slack and slack sustainability. The notion of slack sustainability in conjunction with an embedding threshold enables closed cones in the critical path to be qualified as watermark hosts if their slacks can be better preserved upon remapping. The watermark is embedded by remapping only qualified disjoint closed cones randomly selected and templates constrained by the signature. This parametric formulation provides a means to capitalize on the headroom of a design to increase the signature length or strengthen the watermark resilience. With the master design, the watermarked design can be authenticated as in nonoblivious media watermarking. Experimental results show that the design can be efficiently marked by our method with low overhead.

Synthesis-for-Testability Watermarking for Field Authentication of VLSI Intellectual Property

Most VLSI watermarking techniques do not allow different authorships of multiple Intellectual Property (IP) cores to be detected directly in the field after the IPs have been integrated, fabricated and packaged into chip. Watermark inserted at the design-for-testability (DfT) stage makes its direct detection after chip packaging possible, but it protects only the downstream placement-and-routing design, and is vulnerable to removal attack as the test logic is independent of the functional logic. In this paper, we propose a publicly detectable watermarking scheme to bridge the gap between IP protection and IP management. The design is watermarked by means of synthesis-for-testability (SfT), where the test and functional logics of the IP are merged and synthesized together without using scannable flip-flops. Watermarked constraints are imposed on the scan chain ordering problem in the SfT process so that ownership of the embedded IP can be publicly identified by lawful IP providers, buyers and consumers by injecting a specific test vector in the field. The overhead due to the watermark insertion is minimized by a nearest neighbor search algorithm for flip-flop reordering. As the scan function is an integral part of the design in the synthesis process of the IP creation, the watermark is harder to be removed relative to other scan chain watermarking schemes whose test circuits are logically independent of the IP functionality. To deter and track IP fraudulence by the licensees, a provable mechanism is proposed to enable multiple authorships of different IP cores in a single chip to be publicly authenticated in the field. Experiments performed with ISCAS89 and LGSyn93 benchmark circuits show that the proposed watermarked designs have low design overheads, and the probabilities of coincidence and removal reduce rapidly with increased watermark and scan chain length.

Stego-signature at logic synthesis level for digital design IP protection

This paper presents a logic re-synthesis method for embedding the IP designer information into a distributed copy of a master design that has been synthesized to meet the application constraints. Slack information of the master copy is used to identify seed cells and extract their kernels for watermark insertion at the logic synthesis level. The embedded watermark can be recovered by comparing the topological mismatches between the marked circuit and the master copy. We demonstrate the difficulty of embedding or removing the watermark. The method has been tested on several MCNC multi-level logic synthesis benchmarks. Experimental results show that the method possesses high embedding capacity with trivial quality overhead for the synthesized solution

Intellectual property authentication by watermarking scan chain in design-for-testability flow

This paper proposes an intellectual property (IP) protection scheme at the design-for-testability (DfT) stage of VLSI design flow. Additional constraints generated by the owners digital signature have been imposed on the NP-hard problem of ordering the scan cells to achieve a watermarked solution which minimizes the penalty on power and cost of testing. As only the order of the scan cells is varied, the number of test vectors for the desired fault coverage is not affected. The advantage of this scheme is the ownership legitimacy can be publicly authenticated on-site by IP buyers after the chip has been packaged by loading a specific verification code into the scan chain. We propose to integrate the scan chain watermarking with dynamic watermarking of the IP core to make the design hard-to-attack while the ownership is easy-to- trace. The proposed scheme is applied to an optimization instance of scan cell ordering targeting at test power reduction. The results on several MCNC benchmarks show that the watermarking scheme has a very low probability of solution coincidence and hence provides strong proof of authorship.

An improved publicly detectable watermarking scheme based on scan chain ordering

This paper proposes an improved version of watermarking scheme at the Design-for-Testability (DfT) stage for VLSI Intellectual Property (IP) Protection. The improved scheme overcomes the weaknesses of previous scan chain watermarking scheme by imposing the extra ordering constraints generated by the IP owners signature on all scan flip-flops impartially. IP authorship can be publicly authenticated in the field by injecting a given test vector and matching a permuted output response vector against a transformed reference pattern. Both the output response and the reference sequence are related to a pseudorandom sequence generated by a public-key cryptographic algorithm. Experimental results show that the improved method has a low probability of coincidence and low test power overhead.

Ultra-Low Overhead Dynamic Watermarking on Scan Design for Hard IP Protection

Unlike conventional legal means, digital watermark enables an effective self-protection mechanism for Very Large Scale Integration (VLSI) designers to protect their intellectual property (IP). However, existing watermarking techniques come with unpredictable and often high design and performance overhead, which makes them impractical. In this paper, we propose an ultra-low overhead watermarking scheme to protect hard IPs, the dominating form of commercial IPs. Our approach is based on the observation that an optimized scan design uses two complementary connections between two adjacent scan cells. Such scan design flexibility in the selection of local connection styles provides a vehicle to embed watermarking constraints. It can conveniently be implemented by local rewiring and/or introducing dummy scan cells. The test vectors will be changed accordingly to reflect the watermarked connection styles in order to guarantee the test coverage. This approach offers two unique features: 1) ultra-low overhead and 2) easy detectability. First, because the scan chain order is maintained and these changes are local, the proposed watermarking technique will introduce ultra-low overhead in terms of area, power, and speed. Next, watermark can be extracted from the test vectors and/or the corresponding scan output. Experimental results validate that the performance overhead is negligible (almost zero on the most cases) and the watermark is resilient to various possible attacks.

Watermarking for IP Protection through Template Substitution at Logic Synthesis Level

Functionality preservation and area-time overhead are two major concerns of VLSI designers when the watermarking technique is used to protect their intellectual property. For a given technology library and a logically synthesized circuit, replacing cells with the templates of the same function will not alter the topology and original function of the circuit but the performances of some datapaths may be affected. If the resultant circuit can still satisfy the synthesis constraints with an acceptably low overhead, watermarking through template substitution at logic synthesis level is feasible. In this paper, we propose an algorithm to select appropriate cells for the replacement to realize the watermarking scheme. The method is tested on a set of combinational MCNC benchmarks. The results show that this watermarking process can provide a sufficiently strong proof of authorship with trivial area overhead.

A new countermeasure against scan-based side-channel attacks

Scan design has been widely used to facilitate the testing of integrated circuits (ICs). However, it also provides attackers a side-channel to access the internal states of crypto chips and thus becomes a great threat to the security of the cipher keys. We propose a secure scan design scheme to protect crypto chips against such scan-based side-channel attacks. In this scheme, we introduce a shift register to control the working mode of certain scan cells. Only when the user configures the shift register correctly, can the scan design work normally under testing mode. We show that the proposed secure scan design can effectively resist the existing scan-based attacks. We also demonstrate that this approach has low area overhead while maintaining the testability of original design.

An improved scan cell ordering method using the scan cells with complementary outputs

Scan-based testing always consumes considerable power due to the transitions during the shifting of test data in scan chain. Scan cell ordering technique is effective in reducing such transitions. In this paper, we propose an improved scan cell ordering method. We introduce the scan cells with complementary outputs to enable two alternative connection styles between scan cells during the process of scan cell ordering. This can further reduce the transitions during test application and save more test power. We applied this method on several benchmark circuits. The results show that the number of transitions due to the scan chain by our proposed method is 39.0% fewer than that of the original scan design on average. Compared with the method based on all scan cells connected in a uniform connection style, our method can achieve the scan designs with 4.5% fewer of transitions averagely. Also, with regard to saving test power, the proposed method is superior to that only considers two connection styles after scan cell ordering.

Static and Dynamic Obfuscations of Scan Data Against Scan-Based Side-Channel Attacks

Due to the fallibility of advanced integrated circuit (IC) fabrication processes, scan test has been widely used by cryptographic ICs to provide high fault coverage. Full controllability and observability offered by the scan design also open out the trapdoor to side-channel attacks. To better resist signature attacks on scan testable cryptochip, we propose to fortify the key and lock method by the static obfuscation of scan data. Instead of spatially reshuffling the scan cells, the working mode of some scan cells is altered to jumble up the scan data when the scan test is performed with an incorrect test key. However, when the plaintext is fed directly through the primary inputs for test efficiency, the static obfuscation of scan data is inadequate as demonstrated by a new test-mode-only signature attack (TMOSA) proposed in this paper. To thwart TMOSA, a new countermeasure based on the dynamic obfuscation of scan data is proposed. By cyclically shifting the incorrect test key throughout the test phase, the blocking cells due to the mismatched bits of the test key are made to move temporally to dynamically obfuscate the scan data. This latter scheme is unconditionally resilient against TMOSA and all other known scan-based attacks while preserving the merits of high testability and low area overhead compared with other countermeasures.