Secure logic locking and configuration with camouflaged programmable micro netlists
The camouflage technique described herein introduces programmed configuration inputs to Micro Netlists, creating Programmable Micro Netlists (PMNLs). PMNLs are a group of camouflaged and non-camouflaged cells that may be configured to perform one of several possible logic functions. They retain all the protective properties of non-programmable MNLs, but also allow for secure post-manufacture configuration of their aggregate logic function.
1. A camouflaged application specific integrated circuit (ASIC), comprising:
core logic having a first plurality of interconnected functional logic cells;
a programmable micro netlist (PMNL) comprising:
a second plurality of interconnected functional logic cells that together comprise a logical input, a don't care input and a programming input, the logical input and the don't care input coupled to a respective output of one or more of the first plurality of interconnected functional logic cells of the core logic, the PMNL performing a PMNL function, the programming input communicatively coupleable to a non-volatile memory to receive configuration programming data from the non-volatile memory to configure the PMNL to perform the PMNL function;
wherein the second plurality of interconnected functional logic cells comprise:
an uncamouflaged functional logic cell performing a first functional logic cell function and having a first physical layout; and
a camouflaged functional logic cell performing a second functional logic cell function and having a second physical layout substantially indistinguishable from the first physical layout;
wherein the combined first plurality of interconnected functional logic cells, the PMNL, and the configuration programming data perform one or more ASIC logical functions, and the PMNL function is a logic function.
2. The ASIC of claim 1 , wherein the PMNL further comprises a storage element, communicatively coupled to the program input to accept and store the configuration programming data received by the non-volatile memory.
3. The ASIC of claim 2 , wherein the storage element is initialized at boot time from the non-volatile memory.
4. The ASIC of claim 1 , wherein the configuration programming data is secret and cannot be read or written without authorization.
5. The ASIC of claim 2 , further comprising an address decoder, communicatively coupled between the non-volatile memory and the storage element, wherein the address decoder further comprises another camouflaged functional logic cell.
6. The ASIC of claim 1 , wherein at least a portion of the configuration programming data comprises programming data for programming the second functional logic cell function.
7. The ASIC of claim 1 , wherein the second physical layout is modified from the first physical layout to eliminate a cell structure.
8. The ASIC of claim 1 , wherein the second physical layout is modified from the first physical layout to add a cell structure.
9. The ASIC of claim 1 , wherein an output of the camouflaged functional logic cell is shorted to a voltage of the ASIC.
10. The ASIC of claim 1 , wherein a routing of the camouflaged functional logic cell comprises:
an input of the camouflaged functional logic cell is connected to at least one of other of the at least one of the first plurality of interconnected functional logic cells and the second plurality of interconnected functional logic cells wherein a signal trace of the other of the at least one of the first plurality of interconnected logic cells and the second plurality of interconnected functional logic cells is disposed over the input of the camouflaged functional logic cell; and
an output of the camouflaged functional logic cell is connected to an unconnected input of a nearby second camouflaged logic cell.
11. A method of fabricating an application specific integrated circuit (ASIC), comprising:
defining core logic having a first plurality of interconnected functional logic cells that perform one or more ASIC logical functions including a subset of the first plurality of interconnected functional logic cells for performing a programmable micro-netlist (PMNL) function;
defining a PMNL for performing the PMNL function, the PMNL comprising:
a second plurality of interconnected functional logic cells that together comprise a logical input, a don't care input and a programming input, the logical input and the don't care input coupled to a respective output of one or more of the first plurality of interconnected functional logic cells of the core logic, the PMNL configured to perform the PMNL function, the programming input communicatively coupleable to a non-volatile memory to receive configuration programming data from the non-volatile memory to configure the PMNL to perform the PMNL function;
substituting the PMNL for the subset of the first plurality of interconnected functional logic cells for performing the PMNL function;
wherein the second plurality of interconnected functional logic cells comprise:
an uncamouflaged functional logic cell performing a first functional logic cell function and having a first physical layout; and
a camouflaged functional logic cell performing a second functional logic cell function and having a second physical layout substantially indistinguishable from the first physical layout; and
wherein the combined first plurality of interconnected functional logic cells, the PMNL, and the configuration programming data perform one or more ASIC logical functions, and the PMNL function is a logic function.
12. The method of claim 11 , further comprising:
defining a storage element, communicatively coupled to the program input to accept and store the configuration programming data received by the non-volatile memory.
13. The method of claim 12 , wherein the storage element is initialized at boot time from the non-volatile memory.
14. The method of claim 11 , wherein the configuration programming data is secret and cannot be read or written without authorization.
15. The method of claim 12 , further comprising an address decoder, communicatively coupled between the non-volatile memory and the storage element.
16. The method of claim 11 , wherein at least a portion of the configuration programming data comprises programming data for programming the second functional logic cell function.
17. The method of claim 11 , wherein the second physical layout is modified from the first physical layout to eliminate a cell structure.
18. The method of claim 11 , wherein the second physical layout is modified from the first physical layout to add a cell structure.
19. The method of claim 11 , wherein an output of the camouflaged functional logic cell is shorted to a voltage of the ASIC.
20. An application specific integrated circuit (ASIC), produced by performing a process comprising the steps of:
defining core logic having a first plurality of interconnected functional logic cells that perform one or more ASIC logical functions including a subset of the first plurality of interconnected functional logic cells for performing a PMNL function;
defining a programmable micro netlist (PMNL) for performing the PMNL function, the PMNL comprising:
a second plurality of interconnected functional logic cells that together comprise a logical input, a don't care input and a programming input, the logical input and the don't care input coupled to a respective output of one or more of the first plurality of interconnected functional logic cells of the core logic, the PMNL configured to perform the PMNL function, the programming input communicatively coupleable to a non-volatile memory to receive configuration programming data from the non-volatile memory to configure the PMNL to perform the PMNL function; and
substituting the PMNL for the subset of the first plurality of interconnected functional logic cells for performing the PMNL function;
wherein the second plurality of interconnected functional logic cells comprise:
an uncamouflaged functional logic cell performing a first functional logic cell function and having a first physical layout; and
a camouflaged functional logic cell performing a second functional logic cell function and having a second physical layout substantially indistinguishable from the first physical layout; and
wherein the combined first plurality of interconnected functional logic cells, the PMNL, and the configuration programming data perform one or more ASIC logical functions, and the PMNL function is a logic function.
21. The ASIC of claim 1 , wherein:
the second plurality of interconnected functional logic cells further comprise a logic output, coupled to another one or more of the first plurality of interconnected functional logic cells.
22. The ASIC of claim 1 , further comprising:
an active layer; and
a poly layer; and
a gap wherein at least one of the first plurality of logic cells and the second plurality of logic cells; and
at least one filler cell, disposed in the gap, the filler cell or combination of filler cell providing no logical function.