In recent years, various obfuscation techniques have been proposed to protect analog circuits against IP piracy attacks. To evaluate the strength of the analog obfuscation techniques, attack algorithms including the equation-based SMT attack, genetic algorithm, key spacing attack, and monotonic response algorithm have been proposed. However, unlike the digital domain, where the SAT attack is the de-facto standard for measuring the resiliency of the key-based locking techniques, no standard metric exists to evaluate analog obfuscation techniques. In this article, a novel DC nodal analysis (DNA) attack algorithm is proposed that requires only the circuit netlist and the large signal DC input-output response of an oracle IC. The DNA attack utilizes Kirchhoff’s voltage law (KVL) and Kirchhoff’s current law (KCL) to efficiently explore the obfuscated parameter space of an analog circuit and determine the correct control parameters that result in a circuit response similar to that of the oracle IC. The proposed attack is evaluated against four distinct analog circuits secured using key-based parameter obfuscation and multi-threshold obfuscation. The results from execution of the attack on a three stage front-end circuit secured with the key-based obfuscation technique indicate the successful elimination of 99.1% of keys from the search space in less than five days. The results from evaluating the attack on the same three stage front-end circuit secured with the multi-threshold obfuscation technique indicate the successful elimination of 99.98% of keys from the search space in 50.4 hours. With the limited information necessary to perform the attack, the efficiency in pruning the key-space when considering real world attack scenarios, and the ability to execute the attack across all current analog locking techniques, the DC nodal analysis attack provides a de-facto standard to measure the security provided by an analog obfuscation technique.

Algorithms have been proposed to evaluate the resiliency of analog obfuscation techniques. Each analog deobfuscation algorithm considers different threat models, applies to only a small set of obfuscation techniques, and suffers adversely under real world scenarios, where one or more pieces of information on the circuit and obfuscation technique or techniques is unavailable to the attacker. In this paper, a novel DC nodal analysis (DNA) attack algorithm is proposed that requires only the circuit netlist and the DC input-output response of the oracle IC to perform the attack. The DNA attack utilizes Kirchhoff’s voltage law (KVL) and Kirchhoff’s current law (KCL) to efficiently characterize an obfuscated analog circuit with the objective of determining the correct locked parameters. A preliminary evaluation of the proposed attack is performed on three distinct analog circuits secured using both key-based parameter obfuscation and non-key-based multi-threshold obfuscation. The results from executing the attack on a secured single-stage analog circuit with key-based obfuscation indicate the successful elimination of, on average, 96% of keys from the search space. The results from executing the attack on two-stage circuits secured with multi-threshold obfuscation indicate that 99.58% of the keys are eliminated in less than 7 hours. With the limited information necessary to perform the attack, the efficiency in pruning the key-space when considering real attack scenarios, and the application of the attack to all current analog obfuscation techniques, the DNA attack provides the de-facto standard in the characterization of the resiliency of an analog obfuscated circuit.

Analog obfuscation techniques to prevent intellectual property attacks have mainly evolved from digital obfuscation. Similar to digital hardware security, the considered threat models commonly assume that the attacker possesses the circuit netlist, specifications, and bias information to deobfuscate a locked analog circuit. However, when one or more pieces of information remain unavailable, there is an adverse effect on the performance of current analog attack algorithms. In this article, an analysis of the challenges and limitations of obtaining the information needed to successfully attack an analog circuit is provided. In addition, the performance of current state-of-the-art analog attack techniques is evaluated when one or more pieces of information is unavailable. The analysis of the attack on five distinct analog circuits obfuscated with key-based parameter locking is performed, premised upon the level of information possessed by the adversary. The monotonic attack (MA) returned the correct key in less than 10 h when executing a black-box attack on single stage circuits obfuscated with a 10-bit key. The key-spacing (KS) attack is$10\times $faster than the monotonic attack and returns$8.3\times $fewer candidate keys for multistage analog circuits. The satisfiability modulo theory (SMT) based attack is$224\times $slower than the monotonic attack and$2240\times $slower than the key spacing attack for an 18-bit obfuscated circuit. A genetic algorithm (GA) based attack is 121$091\times $slower than an monotonic attack even for a single stage analog circuit. Through analysis of the results, metrics are developed to characterize the setup and evaluation time of executing the deobfuscation attacks.

In this article, key-based obfuscation of the transistor dimensions is proposed to mask the biasing conditions of an analog circuit and, therefore, protect the circuit against intellectual property (IP) piracy. Vector- and mesh-based obfuscations are developed that provide different degrees of circuit security with tradeoffs in design complexity and area. An algorithm for the selection of an obfuscation transistor and a satisfiability modulo theory (SMT)-based algorithm that searches the design space to determine the dimensions of the obfuscation transistors are developed to reduce the computational complexity of designing and implementing the proposed parameter obfuscation techniques. The parameter obfuscation techniques, along with the developed algorithms, are implemented on an active inductor-based second-order bandpass filter (BPF) and an operational amplifier (op-amp). The results from the analysis of the obfuscated BPF and op-amp indicate that the critical circuit performances are properly locked with at least 15% variation from the target circuit parameters when setting incorrect transistor sizes. A simulation-based optimization algorithm is proposed to tune the biasing conditions and transistor body voltages, which mitigates the effects of both the parasitic impedance of the circuit and any variation due to the implementation of the obfuscation circuitry. The proposed simulation-based optimization algorithm determines the biasing conditions and body voltages of the BPF in 500 iterations and the op-amp circuit in 70 iterations, which provides a significant reduction in the design time and the number of circuit recycles. Implementing the parameter obfuscation technique with the proposed algorithms provides an efficient means to secure analog circuits while reducing the design time to implement security features.

Vulnerabilities of key based analog obfuscation methodologies that modify the transistor dimensions of a circuit are evaluated. Two attack vectors on a common source amplifier, differential amplifier, operational amplifier, and voltage controlled oscillator are developed. The first attack exploits the lack of possible key combinations permitted around the correct key, which is a result of requiring a unique key to lock the circuit. An average of 5 possible key combinations were returned in an average of 5.47 seconds when executing the key spacing attack. The second attack vector utilizes the monotonic relationship between the sizing of the transistors and the functional response of the circuit to determine the correct key. The average time to execute the attack, while assuming process, voltage, and temperature (PVT) variation of 10%, was 1.18 seconds. Both equal key spacing and non-monotonic key dependencies are discussed as ways to mitigate the threats to future analog obfuscation techniques.

The transition to a horizontal integrated circuit (IC) design flow has raised concerns regarding the security and protection of IC intellectual property (IP). Obfuscation of an IC has been explored as a potential methodology to protect IP in both the digital and analog domains in isolation. However, novel methods are required for analog mixed-signal circuits that both enhance the current disjoint implementations of analog and digital security measures and prevent an independent adversarial attack of each domain. This paper demonstrates the vulnerabilities of implementing disjointed obfuscation techniques to protect analog mixed-signal ICs. In addition, a novel methodology is developed to generate functional and behavioral dependencies between the analog and digital domains that results in an increase in the adversarial key search space. The dependencies between the analog and digital keys result in a 3x increase in the number of iterations required to complete the SAT attack. An analysis of best practices is also provided to aid in the implementation of security measures for analog mixed-signal circuits.

In this paper, a technique to design analog circuits with enhanced security is described. The proposed key based obfuscation technique uses a mesh topology to obfuscate the physical dimensions and the threshold voltage of the transistor. To mitigate the additional overhead of implementing the obfuscated circuitry, a satisfiability modulo theory (SMT) based algorithm is proposed to auto-determine the sizes of the transistors selected for obfuscation such that only a limited set of key values produce the correct circuit functionality. The proposed algorithm and the obfuscation methodology is implemented on an LC tank voltage-controlled oscillator (VCO). The operating frequency of the VCO is masked with a 24-bit encryption key applied to a 2×6 mesh structure that obfuscates the dimensions of each varactor transistor. The probability of determining the correct key is 5.96×10-8through brute force attack. The dimensions of the obfuscated transistors determined by the analog satisfiability (aSAT) algorithm result in at least a 15%, 3%, and 13% deviation in, respectively, the effective transistor dimensions, target frequency, and voltage amplitude when an incorrect key is applied to the VCO. In addition, only one key produces the desired frequency and properly sets the overall performance specifications of the VCO. The simulated results indicate that the proposed design methodology, which quickly and accurately determines the transistor sizes for obfuscation, produces the target specifications and provides protection for analog circuits against IP piracy and reverse engineering.