Digital IP protection using threshold voltage control

This paper proposes a method to completely hide the functionality of a digital standard cell. This is accomplished by a differential threshold logic gate (TLG). A TLG with n inputs implements a subset of Boolean functions of n variables that are linear threshold functions. The output of such a gate is one if and only if an integer weighted linear arithmetic sum of the inputs equals or exceeds a given integer threshold. We present a novel architecture of a TLG that not only allows a single TLG to implement a large number of complex logic functions, which would require multiple levels of logic when implemented using conventional logic primitives, but also allows the selection of that subset of functions by assignment of the transistor threshold voltages to the input transistors. To obfuscate the functionality of the TLG, weights of some inputs are set to zero by setting their device threshold to be a high V_t. The threshold voltage of the remaining transistors is set to low V_t to increase their transconductance. The number of low V_t transistors whose gates are driven by a given input x_i determines the weight of that input. The function of a TLG is not determined by the cell itself but rather the signals that are connected to its inputs. This makes it possible to hide the support set of the function by essentially removing some variable from the support set of the function. This is done by selective assignment of high and low V_t to the input transistors. We describe how a standard cell library of TLGs can be mixed with conventional standard cells to realize complex logic circuits, whose function can never be discovered by reverse engineering. A 32-bit Wallace tree multiplier and a 28-bit 4-tap filter were synthesized on an ST 65nm process, placed and routed, then simulated including extracted parastics with and without obfuscation. By obfuscating the cells the delay was shown to increase by approximately 5% at the cell level. Both obfuscated designs had much lower area (25%) lower area and much lower dynamic power (30%) than their nonobfuscated CMOS counterparts, operating at the same frequency.