Securing the intellectual property (IP) from counterfeiting is an important goal toward trustworthy computing. Camouflaging of logic gates is a well-known technique to prevent an adversary from de-layering the chip and stealing IP. In this paper, we propose threshold voltage modulation to realize 2-input static camouflaged logic that can hide six functionalities. We extend the concept of threshold-voltage defined logic to propose multi-input camouflaged gates capable of hiding six 3-input Boolean functions (NAND, NOR, AOI, OAI, XOR, and XNOR). We also propose interconnect camouflaging technique which hides the original connectivity of nets using a novel threshold-voltage defined pass transistor mux. Since threshold voltages are asserted during fabrication and are difficult to identify during optical reverse engineering (RE)-based techniques, the adversary will be forced to launch a brute-force search. We present a thorough analysis of RE effort and overheads associated with the proposed camouflaging techniques. The proposed methodology is demonstrated using fabricated test-chip in 65 nm technology.

Due to the ever-increasing threat of Reverse Engineering (RE) of Intellectual Property (IP) for malicious gains, camouflaging of logic gates is becoming very important. In this paper, we present experimental demonstration of transistor threshold voltage-defined switch [2] based camouflaged logic gates that can hide six logic functionalities i.e. NAND, AND, NOR, OR, XOR and XNOR. The proposed gates can be used to design the IP, forcing an adversary to perform brute-force guess-and-verify of the underlying functionality---increasing the RE effort. We propose two flavors of camouflaging, one employing only a pass transistor (NMOS-switch) and the other utilizing a full pass transistor (CMOS-switch). The camouflaged gates are used to design Ring-Oscillators (RO) in ST 65nm technology, one for each functionality, on which we have performed temperature, voltage, and process-variation analysis. We observe that CMOS-switch based camouflaged gate offers a higher performance (~1.5-8X better) than NMOS-switch based gate at an added area cost of only 5%. The proposed gates show functionality till 0.65V. We are also able to reclaim lost performance by dynamically changing the switch gate voltage and show that robust operation can be achieved at lower voltage and under temperature fluctuation.

Semiconductor supply chain is increasingly getting exposed to variety of security attacks such as Trojan insertion, cloning, counterfeiting, reverse engineering (RE), piracy of Intellectual Property (IP) or Integrated Circuit (IC) and side-channel analysis due to involvement of untrusted parties. In this paper, we propose threshold voltage-defined switches that will camouflage the logic gate both logically and physically to resist RE and IP piracy. The proposed gate can function as NAND, AND, NOR, OR, XOR, and XNOR robustly using threshold defined switches. We also propose a flavor of camouflaged gate that represents reduced functionality (NAND, NOR and NOT) at much lower overhead. The camouflaged design operates at nominal voltage and obeys conventional reliability limits. A small fraction of gates can be camouflaged to increase the RE effort extremely high. Simulation results indicate 46-53% area, 59-68% delay and 52-76% power overhead when 5-15% gates are identified and camouflaged using the proposed gate. A significant higher RE effort is achieved when the proposed gate is employed in the netlist using controllability, observability and hamming distance sensitivity based gate selection metrics.