Camogates IP
Reverse engineering is a powerful tool for attackers, who use it to learn about the architecture of a chip, the data that can be embedded in its code or its memories, but also the IPs it contains and how it operates. Reverse engineering can be used to breach the security of an integrated circuit and gain access to confidential data or communications, but also to copy and steal valuable IP, or even allow a counterfeiter to make a complete copy of a mass produced IC.
One way to protect an integrated circuit from such visual analysis and reconstruction of a netlist or RTL code, which may lead to cloning of a complete integrated circuit, is to protect the logic functions by using so called CamoGates, which are basically the implementation of several different logic functions with lookalike cells, making the functions impossible to distinguish by visual analysis.
Taking a picture of a chip after opening its package provides a precise image of circuit, where transistors and resistors can be recognized. Even when a protection layer such as a metal layer or a metal mesh have been added to the IC, it is always possible to remove the layers one by one using physico-chemical means. With such delayering techniques, it is possible to explore all layers of a complex System-on-Chip.
Using dedicated software to analyze the images of the chip layout, industrial counterfeiters may reconstruct netlists and RTL code, with the help of artificial intelligence systems and expert knowledge. This can allow to create perfect clone of an integrated circuit. The target of such cloning activities could be, for example, consumable products used in the computer industry.
A state-of-the-Art Solution for Circuit Camouflage
One way to protect IP from these threats is to obfuscate a design. But as previously mentioned, protections layers can be removed. A much more robust method against optical analysis is to obfuscate sensitive areas of an integrated circuit design, such as cryptographic functions, by using Camouflage Gates.
The basic principle of such devices is to create lookalike cells to instantiate different logic functions. For example, if a NAND gate, a NOR gate, a AND gate, a OR gate and an inverter all have the same layout, it will be more difficult to recognize the actual role of each of these functions from a simple picture.
Of course, depending on the quality of innovation of the Camogate, using expensive delayering techniques to identify real and fake vias and connections, for example, may help an attacker deduce how a specific Camogate actually works. Therefore, it is important to look for different ways to instantiate the basic principle, for example based on process variations, at the risk of creating standard processes derivatives.
In order to offer a universal, cost optimized solution that is independent from specific processes and foundries, Secure-IC has developed an innovative Camogate solution that can be used for the protection of confidential security solutions and is optimized for security ICs used in consumables.
Camogates IP offers the following features:
- Fully digital and designed with a standard cells library
- Transferable to any design kit
- Lightweight
- Easy to integrate into the system