Prelude

Unethical counterfeiting is an important concern in all businesses and the electronics world is no exception. The IP core developers are getting more and more serious regarding the need of protecting their efforts and monetary investments from the unlicensed use of the IP core blocks. To successfully tackle this issue one would need to specifically tag and identify the IP core block from any SoC.

Though this might sound insignificant, identification is a sophisticated task, involving different approaches as per the IP core nature. Special techniques developed/ adopted by InSemi can be of great help to all in this regard.

Let’s delve into the details as this article throws light on various methodologies adopted in identifying the IP core.

 1. Identifying IP Cores

With the SoC design integration level getting exponentially advanced with each passing day, a new challenge has also cropped up – ‘How to protect the investment in IP core design’. Simple measures include a security tagging system using a side-channel attack technique. But even with them, it is next to impossible to prevent any unlawful use of IPs.

Here the identification technique comes to the rescue. Developed through rigorous research, the IP core identification technique proves of great value in this regard.

2. Analyzing the functional Layout

Major macroblocks of an SoC are memory blocks, data converters, PLLs, transceivers, amplifiers etc. Most of the time, a SoC’s functional block may reveal most of its key IP blocks as well. With the functional layout analysis, one can easily know about the kinds of functional blocks deployed in the design.

In this analysis, the device is first dissembled and the silicon die is deposed to its diffusion layer. These days SoCs have a high number of metal layers, so a majority of the design details can’t be checked from the top. It gets necessary to remove the top layer of interconnect first and the dielectric material between the layers. Then the major blocks of design are identified.

3. Circuit Extraction

After getting the functional layout, to get complete detail of the design IP, the first requirement is the extraction of a circuit. For this purpose, the target IC must be controllably decomposed first. After that de-processing, one needs to get sequential imaging. This will be followed by removing all layers of the interconnections down to their active layers.

In Current modern geometry, ranging in nanometer ranges of 45, 32 and even smaller, the biggest challenge lies in accurate de-processing. The lack of commercially available tools for the purpose is also a significant factor.

The image is captured through SEM technology but it is highly advisable to get it done with automated means. This is to ensure that the limited field of view within a larger target area can be accurately mapped.

The image is in the raster format which first needs to be extracted in a vector form. Then only any meaningful analysis can be made on it. This imparts several benefits like reduction in data storage requirements, simplification of automatic signal propagation, increased efficiency of physical pattern matching, etc.

For a block with a large number of digital logic, it is never advisable to manually extract the base cells. Implementing their special methodologies, team InSemi create a cell library, which is later used to match against the extracted data.

Based on the library, cells are identified and wired into the design, and for this, a Netlist of the target block can be developed and examined.

With circuit extraction in such a way, one gets the hierarchal schematics of the design. During the hierarchy construction, the structure and functioning of each block are identified.  Team InSemi’s layout and schematic capability of the cross-references help get the view of any other circuit element- either in the layout view or the schematic view.

4. Searching & Matching the Schematic Library   

Another way of identifying the IP blocks is by comparing the circuit blocks mined from the design against the available IP circuit libraries. The extracted netlists can be auto-compared with the reference library and automatically rank the potential matches. The InSemi has its own resource library of circuit implementation, which has been mined and generated from various products over the course of business across varied technologies. So, the netlist generated from the source IP block is compared with that resource library here. This is a highly efficient way of identifying IP blocks from varied products.

5. Comparing Layout

The technique of comparing the layout is another method of IP block identification, which is highly cost-effective as well. This works best when there is a need to identify minor changes. In this, the layout is sectored across different layers and aligned locally. Then comes the computation of the polygon’s Boolean difference and clearance of the noise. And then on the basis of polygon connectivity, the vias are confirmed.

6. Functional Testing

When other techniques are not viable or costly, then the functional testing method comes to the rescue in identifying the associated IPs, along with their functionality. It is the best way to test the IPs with sophisticated algorithms or behaviors.

Testing flash memories, USB memory sticks or microprocessors or HDTVs can be easily tested this way to reveal any evidence of IPs in the device.

Challenges

With the developing technology, IP identification also gets complex; major challenges include:

Soft Macros

A soft macro can be implemented into any logic block of the target IC and can also be a subset of the given block. So determining the potential site of soft macro needs a good overhead examination of surrounding circuits. Also, the soft macros may contain thousands of base-level cells. For the correct examination, a very large number of cells need to be extracted, which is not possible with manual analysis. Another significant challenge is that the synthesized Netlist is the representation of the original design after the synthesis. As the real implementation might vary across the vendors, then any comparison can only be done on a functional level.

Hard Macros

For identifying a hard macro’ there is a need for a noise-tolerant comparison between the IC and the reference design. Smaller hard macros on a heavily metalized IC are more difficult to be identified. For this, the automated analyzing system needs to be amply robust and resilient to accommodate routing changes, deletions or geometric transformations.

Functional Testing Challenges

Functional testing needs real-time probing of signals on the die, and due to higher integrations and interconnections access to the lower-level metal layer becomes a challenge. With advanced technologies like backside imaging, such challenges can be overcome.

Postlude

IP identification is a must to protect the interests and related investments of the genuine developer. The identification techniques are highly advanced and need specialized skills to overcome the associated challenges.

Comprehensive inventory circuits, IP Blocks, and deploying search & match tactics pave the path to efficient and effective IP identification. Advanced techniques like structural data mining are proving to be the most effective way but require specialized skills. Design methodology and process technology also evolve with advancing technologies, and identifying the IPs help safeguard the interest of the core developers.