International audience

We propose a novel anti-piracy security technique for analog and mixed-signal (AMS) circuits. The circuit is re-designed by obfuscating transistors and capacitors with key-controlled versions. We obfuscate both the device geometries and their ratings, which define the maximum allowable current, voltage, and power dissipation. The circuit is designed to function correctly only with a specific key. Loading any other incorrect key degrades performance and for the vast majority of these keys the chip is damaged because of electrical over-stress. This prevents counter-attacks that employ a chip to search for the correct key. The methodology is demonstrated on a low-dropout regulator (LDO) designed in the 22nm FDSOI technology by GlobalFoundries. By locking the LDO, the entire chip functionality breaks unless the LDO is unlocked first. The secured LDO shows no performance penalty and area overhead is justifiable and less than 25%, while it is protected against all known counter-attacks in the AMS domain.

Integrated Circuit (IC) supply chain attacks—such as piracy and intellectual property (IP) theft—pose a critical challenge for IC and System-on-Chip (SoC) designers. This paper introduces a novel anti-piracy design technique for Bluetooth Low Energy (BLE) transceivers by adapting SyncLock, an RF transceiver-specific logic locking method originally developed for Wi-Fi, to the BLE hardware architecture. The core idea of SyncLock is to key-control the transmitted frame’s preamble, ensuring that an incorrect key prevents synchronization between transmitter and receiver. We demonstrate this approach using a Continuous Phase Modulation (CPM) transmitter configured for BLE. Experimental results confirm that the proposed technique successfully achieves key-based functionality: with the correct key, normal operation is preserved and the locking mechanism remains transparent, whereas an incorrect key prevents communication link establishment. Additionally, the results show that embedding SyncLock incurs minimal and justifiable overhead, highlighting its practicality and making it a strong candidate for protecting Bluetooth transceiver hardware IPs.

Integrated circuit (IC) piracy and counterfeiting are a major preoccupation threat for IC designers. A powerful defense is IC locking which consists in making the IC functionality dependent on a digital key. In this work, we propose to simultaneously lock indirectly all analog and mixed-signal blocks of an IC via locking the bandgap reference (BGR) circuits that provide their biasing or reference currents or voltages. We demonstrate an obfuscated BGR in the 22nm FDSOI technology by GlobalFoundries featuring a 24-bit single secret key. Obfuscation shows no performance penalty for the valid key and less than 10% area overhead compared to the unsecured design, while guaranteeing high functionality corruption for invalid keys. The proposed obfuscation shows strong resilience against all known counter-attacks in the analog domain.

The globalization of the Integrated Circuit (IC) supply chain has given rise to several hardware security and trust threats. Especially, IC piracy and counterfeiting are significant preoccupations for designers. This demonstration shows how to secure a wireless IC against such threats. The case study is an open-source IEEE 802.11 WiFi modem implemented on hardware using a Software Defined Radio (SDR) bladeRF board. The modem is secured with synchronization-based locking (SyncLock), a state-of-the-art locking scheme for RF transceivers. SyncLock disables the wireless communication between the modem and a WiFi-compliant receiver unless the correct secret key is loaded onto the modem.

In this paper, we propose a power-efficient attention-infused convolutional neural network (CNN) hardware accelerator for RF spectrum monitoring. The AI model achieves 73.3% average accuracy across all Signal-to-Noise Ratios (SNRs) ranging from -20dB to +30dB, and a 99% accuracy for SNRs higher than 4dB using the RadioML2018 dataset . The number of parameters of the proposed attention-infused CNN is reduced by 93% compared to the baseline CNN model. An efficient hardware implementation on FPGA achieves 61 GOPS and consumes only 1191 mW. Compared to the state of the art, it achieves the highest efficiency of 51 GOPS/W.

This paper presents the integration of a band-limited memory polynomial (BL-MP) digital pre-distortion (DPD) model with low-resolution Σ∆-based feedback receivers, specifically targeting 6G FR3 carrier aggregation using a 400 MHz OFDM 64QAM signal. The performance is evaluated using two power amplifiers (PAs)—Doherty and Class AB—with distinct nonlinearity profiles. The study compares the Generalized Memory Polynomial (GMP) model with the BL-MP model. Significant improvements in error vector magnitude (EVM), approximately 0.7 dBm at the 3% threshold, are observed for both PAs relative to the GMP-LS model. Additionally, adjacent channel leakage ratio (ACLR) enhancements of around 7 dB are achieved, further surpassing GMP-LS performance. These findings demonstrate the adaptability and effectiveness of the BL-MP model, delivering substantial performance gains over conventional pre-distortion techniques across varied PA architectures.The results highlight the potential of employing a BL-MP DPD with a low-resolution feedback receiver, offering an optimal solution for DPD applications in 6G FR3.

The Internet of Things is promising as it drives the datafication of our everyday life and thus, leverages synergies between originally considered “dead” things and enables them to proactively serve humans. IoT5.0, an Artificial Intelligence assisted Internet of Things, could even more benefit society, as the devices could even learn how to provide more value. But the ubiquitous connectivity comes at a cost. Security levels have to rise tremendously to ensure a network stays secure and safe for humans. This additional effort often is a burden for small and medium sized enterprises as the complexity and security demands of such systems rise faster than available resources. Consequently., RESILIENT TRUST focuses on end-to-end security of IoT processing chains with a focus on strong exploitation for SMEs. Moreover, RESILIENT TRUST will address and significantly mitigate the major risks to enable IoT 5.0. That way., this project will be a driver for sustainable development and the generation of convenience and wealth. A solution is proposed to ensure end-to-end security by boosting RESILIENCE and TRUST along different key supply chains of IoT device.

We present a locking-based design-for-security methodology to prevent piracy of RF transceiver integrated circuits. The solution is called SyncLock as it locks the synchronization of the transmitter with the receiver. If a key other than the secret key is applied, synchronization and, thereby, communication fail. SyncLock is implemented using a novel locking concept consisting of two spatially separated mechanisms. A hard-coded error is hidden into the design to break synchronization while error correction, i.e., unlocking, takes place in another part of the design by applying the secret key. SyncLock offers several advantages: the secret key is unique, i.e., any incorrect key causes a denial-of-service, there is no performance penalty, it can be seemingly integrated into the digital design flow, area and power overheads are negligible, and it achieves maximum provable security thwarting all known counter-attacks. SyncLock is demonstrated with hardware measurements.

We propose a Hardware Trojan (HT) attack in wireless Integrated Circuits (ICs) that aims at leaking sensitive information within a legitimate transmission. The HT is hidden inside the transmitter modulating the sensitive information into the preamble of each transmitted frame which is used for the synchronization of the transmitter with the receiver. The data leakage does not affect synchronization and is imperceptible by the inconspicuous nominal receiver as it does not incur any performance penalty in the communication. A knowledgeable rogue receiver, however, can recover the data using signal processing that is too expensive and impractical to be used during run-time in nominal receivers. The HT mechanism is designed at circuit-level and is embedded entirely into the digital section of the RF transceiver having a tiny footprint. The proposed HT attack is demonstrated with measurements on a hardware platform. We demonstrate the stealthiness of the attack, i.e., its ability to evade defenses based on testing and run-time monitoring, and the robustness of the attack, i.e., the ability of the rogue receiver to recover the leaked information even under unfavorable channel conditions.

We propose an anti-piracy security technique based on locking for analog and mixed-signal circuits designed in FD-SOI. We show that obfuscating the body-bias voltages of tunable transistors is an effective way for inducing high functionality corruption. The obfuscation is achieved by constituting a secret key from the concatenation of the input digital codes of the body-bias generators that produce the correct body-bias voltages. We also propose a slight modification of the body-bias generator that increases prohibitively the time complexity of counter-attacks aiming at finding an approximate key. The proposed locking scheme is demonstrated on a Σ$$ modulator used in highly-digitized RF receiver architectures.

We present an anti-piracy locking-based design methodology for RF transceivers, called SyncLock. SyncLock acts on the synchronization of the transmitter with the receiver. If a key other than the secret one is applied the synchronization and, thereby, the communication fails. SyncLock is implemented using a novel locking concept. A hard-coded error is hidden into the design while the unlocking, i.e., the error correction, takes place at another part of the design upon application of the secret key. SyncLock presents several advantages. It is generally applicable, incorrect keys result in denial-of-service, it incurs no performance penalty and minimum overheads, and it offers maximum security thwarting all known counter-attacks. We demonstrate SyncLock with hardware measurements.

Current mode logic (CML) circuits are widely used in digital, analog, and analog/mixed circuits due to their high-speed operation which makes them suitable for RF applications [1] and wireline transceivers [2]. CML amplifier shown in Fig. 1(a) has an output common-mode $(\mathrm{V}_{oCM})$ of where VDD is the supply voltage, I is the bias current and R is the load resistance. Supply voltage and load resistance in (1) are sensitive to PVT variations causing the common-mode voltage to change which may cause the preceding blocks to fail if they do not have a wide input common-mode range. One of the techniques to control the common mode is to apply current trimming by using multiple current mirrors, but this technique suffers from discrete control of each chip during testing. Another approach is to use a poly current reference generator [3] but this approach will require an extra block – reference generator – to be added as in [4] which uses not only a bandgap reference but also an adjust network to select the suitable bias for the CML blocks. Also in [5] instead of using any of the mentioned techniques, a CML to CMOS circuit is used to avoid the change in the output common mode voltage of the CML, but this circuit adds extra delay and power which can cause problems in some systems as in [1]

This paper presents a systematic design methodology for multi-stage feed-forward op-amps used in the active filters of continuous time $\Sigma\triangle$ ADC. This methodology can provide the specifications of each stage in the op-amp (from 2 stages to 4 stages) based on the required ADC specifications and can provide an estimate of the Signal to Noise Ratio (SNR) taking into consideration the effect of the transfer function of the opamp. This method is then validated on a Lowpass and Bandpass $\Sigma\triangle$ ADCs.

The design and manufacturing steps of a chip typically involve several parties. For example, a chip may comprise several third-party intellectual property (IP) cores and the integrated circuit (IC) fabrication may be outsourced to a third-party foundry. IP cores and ICs are shared with potentially untrusted third parties and, as a result, are subject to piracy attacks. Even more, any legally purchased chip may be reverse engineered to retrieve the design down to transistor level and, thereby, it is also subject to piracy attacks. In this article, we proposeMixLock, an anti-piracy countermeasure for mixed-signal IP cores and ICs.MixLockprotection is based on inserting a lock mechanism into the design such that correct functionality is established only after applying a key which is the designer’s secret. The lock mechanism acts on the mixed-signal performances by leveraging logic locking of the digital part.MixLockpresents several key attributes. It is generally applicable, it is nonintrusive to the sensitive analog section, it incurs no performance penalty and has very low area and power overheads, it is fully automated, and it is capable of co-optimizing security in both the analog and digital domains. We demonstrateMixLockon a$\Sigma \Delta $analog-to-digital converter (ADC) using hardware measurements and an audio demonstrator.

We propose a Hardware Trojan (HT) attack for analog circuits with its key characteristic being that it cannot be prevented or detected in the analog domain. The HT attack works in the context of Systems-on-Chip (SoCs) comprising both digital and analog Intellectual Property (IP) blocks. The attacker could be either the SoC integrator or the foundry. More specifically, the HT trigger is placed inside a dense digital IP block where it can be effectively hidden, whereas the HT payload is in the form of a digital pattern transported via the test bus or generated within the test bus, reaching the Design-for-Test (DfT) or programmability interface of the victim analog IP with the test bus. The HT payload unexpectedly activates the DfT and sets the victim analog IP into some possibly partial and undocumented test mode or changes the nominal programmability. The HT payload can be designed to result in performance degradation or complete malfunction, i.e., denial of service. We demonstrate this HT attack scenario on two analog IPs, namely a low-dropout (LDO) regulator using simulation and an RF receiver using hardware measurements.

This paper gives an overview of Cognitive-Radio (CR) circuits and systems, that will enable the implementation of new technology paradigms such as software-defined electronics and Artificial Intelligence (AI) managed Internet-of-Things (IoT). A survey of the state of the art, trends and design challenges is presented from a top-down perspective - from system-level to circuit and chip implementation. As an application, special emphasis is put on analog/digital interfaces as one of the key building blocks in CR-based devices. Cutting-edge architectures - mostly based on ΣΔ Modulators (ΣΔMs) - are discussed, as well as the best candidate circuit strategies to implement CR- based digitizers in deep nanometer CMOS.

This paper presents a classification Convolutional Neural Network model for modulation recognition. The model is capable of classifying 11 different modulation techniques based on their In-phase and Quadrature components at baseband. The classification accuracy is higher than 80% for signals with a Signal-to-Noise Ratio higher than 2 dB. The model performance is evaluated using the same In-phase and Quadrature component data-sets used in the state of the art. Compared to previous work, the number of parameters and multiplications/additions is reduced by several orders of magnitude. The proposed Convolutional Neural Network is implemented on FPGA and achieves the same performance as the GPU model. Compared to other FPGA implementations of RF signal classifiers, the proposed implementation classifies twice as much modulation schemes while consuming only half the dynamic power.

We treat the problem of analog integrated circuit (IC) obfuscation toward intellectual property (IP) protection against reverse engineering. Obfuscation is achieved by camouflaging the effective geometry of layout components via the use of fake contacts, which originally were proposed for gate camouflaging in digital ICs. We present a library of obfuscated layout components, we give recommendations for effective camouflaging, we discuss foreseen attacks and the achieved resiliency, and we propose security metrics for assessing the hardness of reverse engineering. The proposed methodology is demonstrated on an operational amplifier and an RF ΣΔ analog-to-digital converter (ADC).

We propose an antipiracy security approach for programmable analog and mixed-signal (AMS) integrated circuits (ICs). The security approach relies on functionality locking by leveraging the inherent programmability and utilizing the configuration settings as secret keys or, equivalently, the programming bits as key bits. When invalid keys are applied, the circuit is untuned and, as a result, its functionality breaks, i.e., at least one of the performances violates its specification. As long as the calibration algorithm that produces the configuration settings can be kept secret, the proposed approach can serve as a countermeasure against all types of counterfeiting, i.e., cloning, overbuilding, remarking, and recycling. An important advantage of the proposed approach is that it is lock-less. It leaves the design intact, there is no change to the design flow, and there are no performance penalty and no area or power overheads due to the lock operation. We demonstrate it on a$\Sigma \Delta $analog-to-digital converter (ADC) with 194-bit programmability and complex calibration algorithm used in the context of highly digitized, multistandard RF receivers.

In this paper, we demonstrate a security approach for the class of highly-programmable analog Integrated Circuits (ICs) that can be used as a countermeasure for unauthorized chip use and piracy. The approach relies on functionality locking, i.e. a lock mechanism is introduced into the design such that unless the correct key is provided the functionality breaks. We show that for highly-programmable analog ICs the programmable fabric can naturally be used as the lock mechanism. We demonstrate the approach on a multi-standard RF receiver with configuration settings of 64-bit words.

This article presents a methodology for sizing transistors of a multistage, multipath capacitor-less feed-forward compensated operational amplifiers employed in advanced CMOS process implementation of continuous-time bandpass ΣA-modulators. This article describes the methodology: on system level, dealing with the placement of poles and zeros; and on the circuit level, discussing issues related to biasing, frequency response and other important performance metrics of the basic diff-pair. Algorithms are provided to simplify mathematical aspects of the work. The validity and the limitations of the proposed methodology are further discussed from the single-pole system used to model the individual amplification stages of the multistage amplifier. The worthiness of the proposed methodology in sizing the transistors of complex amplifier structures, such as the capacitor-less multistage, multipath feed-forward-compensated amplifiers is demonstrated using two design examples. A third-order amplifier with a dc gain of 52.6 dB and that reaches a unity-gain frequency of above 14 GHz while consuming only 5.6 mA from a 1-V supply; and a fourth-order amplifier with dc gain of 73.5 dB that achieves a 25.7-dB gain at 1 GHz while consuming 4.8 mW are designed in 28-nm CMOS FDSOI.

In this paper, we propose a hardware security methodology for mixed-signal Integrated Circuits (ICs). The proposed methodology can be used as a countermeasure for IC piracy, including counterfeiting and reverse engineering. It relies on logic locking of the digital section of the mixed-signal IC, such that unless the correct key is provided, the mixed-signal performance will be pushed outside of the acceptable specification range. We employ a state-of-the-art logic locking technique, called Stripped Functionality Logic Locking (SFLL). We show that strong security levels are achieved in both mixed-signal and digital domains. In addition, the proposed methodology presents several appealing properties. It is non-intrusive for the analog section, it incurs reasonable area and power overhead, it can be fully automated, and it is virtually applicable to a wide range of mixed-signal ICs. We demonstrate it on a ΣΔ Analog-to-Digital Converter (ADC).

This work presents a 4th-order multi-stage, multipath, feed-forward-compensated operational amplifier in 65 nm CMOS technology. It is designed to meet the requirements of a continuous-time bandpass ΣΔ modulator with multi-GHz sampling frequency. The designed amplifier is modular with each stage implemented based on a unit differential amplifier block and it meets its targets with smart placement of poles and zeros. The amplifier is simulated under the loading condition of a single-amplifier resonator which is in turn part of a 6th-order ΣΔ modulator. The unloaded amplifier reaches a unity-gain-frequency of 38.29 GHz and a DC gain of 58 dB. With a parallel load of 440 fF and 300 Ω, representing the maximum load, the op-amp, including common-mode and biasing circuits, consumes a total of 18.98 mA from a supply voltage of 1.2 V. It is unconditionally stable with a phase margin of 54° and has gains of 35 dB and 23 dB at 1 GHz and 2 GHz respectively.

An efficient multi-rate multi-stage architecture for the Comb decimation filter of Sigma-Delta ADCs is presented. Polyphase decomposition in all stages is used to reduce the operating frequency of the Comb filter. A systematic design procedure is developed in order to generate all possible combinations for the decimation factor of each stage. A third order Comb decimation filter with a total decimation factor of 16 is taken as a design example. The eight possible architectures are generated in two different CMOS processes. The performance of the generated architectures are compared in terms of power consumption, area and maximum operating frequency.

The paper presents the principles, techniques and tools for the efficient modeling and simulation, at the component level, of an heterogeneous system composed of Wireless Sensor Network nodes that exhibits complex multi-discipline feedback loops that are likely to be found in many state-of-the-art applications such as cyber-physical systems. A Precollision Mitigation Braking System (PMBS) is used as a pragmatic case study to validate the whole approach. The component models presented (60 GHz communication channel, QPSK RF transceiver, CMOS video sensor, digital microcontroller, simplified car kinetic engine) are written in SystemC and its analog Mixed-Signal extensions, SystemC-AMS, and belong to five distinct yet highly interwoven disciplines: newtonian mechanics, op to-electronics, analog RF, digital and embedded software. The paper clearly exhibits the complex multi-discipline feed- back loop of this automotive application and the related model composability issues. Using the opto-electrical stimulus and the received RF inter-vehicle data, a car is able to exploit its environmental data to autonomously adjust its own velocity. This adjustment impacts the physical environment that in turns modifies the RF communication conditions. Results show that this holistic first-order virtual prototype can be advantageously used to jointly develop the final embedded software and to refine any of its hardware component part.

Sine-shaping of feedback DAC current in continuous-time ΣΔ ADCs is an effective solution to enhance their immunity to clock jitter. In this paper, a simple mixer circuit for producing a sine-shaped output in continuous-time ΣΔ ADCs is introduced. The proposed solution does not need extra clock source or synchronization circuit, as the mixer utilizes the same clock applied to the comparator. It is also shown the that the proposed circuit is immune to temperature and process variations. Simulation results of the proposed circuit implemented in 130 nm CMOS process show good agreement with the expected results. I.

In this paper, a generic and simple approach to design Continuous-Time Sigma-Delta Modulators (CT ΣΔMs) based on Finite Impulse Response Digital-to-Analog Converter (FIR DAC) is introduced. The numerical conversion from Continuous-Time to Discrete-Time allows the designer to explore complex modulator architectures and different feedback DAC shapes, without dealing with difficult equations needed in other published design approaches.

In this paper, a simple and intuitive technique for analyzing clock jitter effect on bandpass Continuous-Time Sigma-Delta (ΣΔ) modulators is introduced. The power spectral density of the jitter noise for different feedback DAC shapes are derived and compared. It is shown that DAC output signal shapes used to reduce clock jitter sensitivity in lowpass Continuous-Time ΣΔ modulators may not be suitable for bandpass modulators.

A methodology for the design of Continuous-Time (CT) Sigma-Delta (ΣΔ) modulators with VCO-based quantizer is proposed. The coefficients of the CT ΣΔ modulator are accurately calculated such that the noise transfer function of the modulator is exactly the same as a Discrete-Time (DT) ΣΔ modulator of the same order. The proposed design method takes into account loop-delay compensation as well as the shape of the feedback Digital-to-Analog Converter (DAC) signal. VCO non-idealities such as non-linear Kvcoand phase noise are studied. Several design examples for different modulator orders and feedback DAC signal shapes are given to validate the proposed methodology.

This paper proposes a method to introduce BAW resonators in the loop of a continuous-time sigma-delta modulator. The method is based on the equivalence between the noise-transfer-function of a conventional bandpass discrete-time sigma-delta and the noise-transfer-function of a continuous-time BAW-based sigma-delta modulator with FIRDACs. The method is general and can be applied to BAW resonators with and without cancellation of the anti-resonance frequency. The noise-transfer-function and the signal-transfer-function of the BAW-based sigma-delta modulator are analyzed and compared with their discrete-time counterpart.

A SigmaDelta GmC integrator refinement flow is presented. The classically simplified GmC integrator small-signal model was upgraded to be extremely accurate by considering the complete transistor small-signal model. A circuit-level knowledge-based tool was used to execute the designer defined sizing procedure and to extract small signal parameters. By associating the symbolic transfer function to small-signal parameters, the flow, entirely implemented with C++, is able to compute poles and zeros to permit precise behavioral simulations. A 2ndorder SigmaDelta modulator was chosen to visualize performance degradations while the specifications were not achievable.

The paper presents a system-level approach for the modeling and simulation of a paradigmatic wireless sensor network composed of two nodes using SystemC-AMS, an open-source C++ extension to the OSCI SystemC standard dedicated to the description of heterogeneous systems containing digital, analog, RF hardware IPs as well as embedded software. The paper is composed of three parts. The first part details the modeled WSN (physical sensor, sigma-delta ADC, ATMEGA128 8- bit microcontroller running the embedded application, QPSK-based 2.4 GHz RF transceiver), presents the corresponding implementation in SystemC-AMS, and gives an insight on how multi-frequency simulation is handled in SystemC-AMS. The second part shows how to introduce several RF designer specifications (noise figure, IIP3, ...) into models and how to express them in SystemC-AMS. The third part proves that the combination of C++ and RF baseband equivalent dramatically reduces simulation time while keeping excellent accuracy and code readability. The paper concludes on the possibilities offered by this approach in terms of validation and optimization of heteregeneous systems through open-source simulation.

In this paper, a generalized technique for the design automation of fs/4 bandpass SigmaDelta modulators using feedback FIRDACs is proposed. The FIRDACs are used to increase the degrees of freedom in order to perform an exact equivalence with high order discrete-time SigmaDelta modulators and also to allow a more efficient circuit implementation of the LC filter. The design technique is based on discrete time-continuous time equivalence simplified by using the method of partial fractions expansion. The excess loop delay is taken into account without making more difficult the calculations since we define how to get the orders of the FIRDACs. Several examples of design are simulated with different values of excess loop delay

A general technique for the design of undersampled LC bandpass modulators using feedback FIRDACs is proposed. The coefficients of the FIRDACs are used to increase the degrees of freedom in order to perform an exact equivalence between undersampled LC bandpass Sigma-Delta and high order discrete-time sigma-delta modulators. Using FIRDACs coefficients, it is also possible to simplify the circuit implementation by removing internal summing nodes and by decreasing coefficients spread. An undersampled 4th order LC sigma-delta is given as a design example. The effect of the undersampling ratio on the performance of finite quality factor LC sigma-delta modulators is also studied

This paper presents a mixed equation-based and simulation-based design methodology for continuous-time sigma-delta modulators from high level specifications down to layout. The calculation and scaling of the sigma-delta coefficients as well as circuit sizing and layout generation are implemented in the same analog design environment CAIRO+. The design of a complete third order current-mode continuous-time sigma-delta modulator is taken as an example to show the effectiveness of the proposed design methodology.