Integrity protection and authentication of integrated circuit intellectual property cores

With the advancement of semiconductor processing technology, the capacity and versatility of an integrated circuit (IC) have been growing perpetually. Highly sophisticated systems can now be resided in a single IC chip. Accompanied with the increased integration density is a widening of design productivity gap, which can never be closed by using existing design automation tools with conventional design methodology. Today, reuse-based or intellectual property (IP) based design methodology has prevailed as the most effective means to increase the design productivity. The downside of it is the IP cores are now targets of abuse and have become more vulnerable than ever to various infringement attacks. Protection of IP cores by legal means is passive and feeble, and must be fortified by technology and forensic approaches. This thesis presents several new techniques for the integrity protection and authentication of the IP cores. The three facets to this research towards trusted hardware IPs are the identification of IP owner and IP buyer, the usage control of an IP core, and the integrity verification of the IP content. One major hardware security problem in each of these three facets is independently investigated. The techniques developed can be combined to form an augmented solution to deal with multiple security issues arising from the design of an IP to its integration into chips or any other vulnerable channels in the transition of the chips containing the IP cores. A dynamic fingerprinting scheme for the protection of sequential circuit IPs is first proposed. The inserted fingerprint is an oblivious ownership watermark independently endorsed by each user through a blind signature protocol. The fingerprint can be conveniently detected from the output response off-chip by injecting a specific input sequence. From the fingerprint, the IP provider can easily prove his ownership of the IP core and identify the buyer. The proof is indisputable as the buyer has endorsed the concealed watermark of the IP owner in the process of fingerprint generation. The security analyses and experimental results show that the fingerprinting scheme is able to generate a large number of high quality fingerprinted instances that are robust against all perceivable attacks. A pragmatic per-device licensing scheme is also proposed for the IP cores used in field-programmable gate array (FPGA) chips. The scheme enables the licensing of IP cores on a per-device basis by exploiting only existing hardware primitives on commercial FPGA chips and without the need for an external trusted third party. Besides guaranteeing the secrecy and integrity of the licensed IP cores, the scheme also prohibits the implementation of the protected IP cores on unscreened excess devices and counterfeit chips sold in the gray market. The scheme blends well with the IP fingerprinting scheme, where the latter will deter the IP licensees from abusing their IP instances. Using the self-reconfiguration feature of FPGAs today, the resources consumed by the control module used for the implementation of the protected IP cores on the authorized chip are temporary and marginal. Finally, a technique for verifying the integrity of fabricated chips is presented. It is capable of detecting small hardware Trojan (HT) in the circuit even if it remains dormant through a fast gate-level characterization (GLC) process of the leakage current. The GLC process is efficiently performed by the normal equation of linear regression model. Based on the discrepancies in the bias parameter of the linear regression and the accurately estimated scaling factors of a subset of gates, the HT-infected chip can be distinguished without the need to compare with the parameters from a Trojan-free golden chip, which can only be obtained through expensive destructive reverse engineering.DOCTOR OF PHILOSOPHY (EEE