Abstract:
An article of manufacture, for example, a product or portion of a product produced by an IP design house which, when manufactured, causes random failures in a counterfeit integrated circuit. The article of manufacture ( 520 ) is a “genetic code” that comprises all of the necessary functional information needed to build an electronic circuit. This article of manufacture, when processed in a computer-aided design system and/or a fabrication facility, generates a functional apparatus such as an anti-counterfeiting circuit.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a continuation in part of U.S. patent application Ser. No. 11/622,040, filed Jan. 11, 2007, and related to attorney docket number BUR920060075US3 filed concurrently herewith. All U.S. patent applications are assigned to the same assignee. 
     
    
     BACKGROUND OF THE INVENTION 
     Field of the Invention 
       [0002]    This invention relates to the design process and article of manufacture for providing anti-counterfeiting measures for integrated circuits (IC&#39;s) and more specifically to the article of manufacture of an anti-counterfeiting circuit, which changes the function of an authentic circuit when copied into a counterfeit IC. The anti-counterfeiting circuit is disabled by using camouflage circuits when it is incorporated in the authentic IC design. 
         [0003]    Counterfeit integrated circuit chips have become a significant problem for nearly every industry that relies on electronics for data communication, data management, and data processing. For example, the banking industry uses IC&#39;s for security purposes that need to be safe from counterfeiting; government programs, such as defense, have a high security requirement on circuitry to prevent technology from falling into adverse possession; and high volume consumer electronics with large profit margins are subject to counterfeiting such as gaming boxes, routers, and cellular telephones. 
         [0004]    Some counterfeit IC&#39;s have additional logic which secretly routes data from the IC to adverse persons such as hackers and snoopers who can obtain secure information such as credit card numbers, account numbers, and passwords from the IC&#39;s. 
         [0005]    Counterfeiters typically reverse engineer an existing IC by processes such as delamination or delayering. The authentic IC is delayered one layer at a time and the circuit configuration of that particular layer is copied as a new schematic layout which can be used for manufacturing the counterfeit IC. Other reverse engineering techniques include the use of scanning electron microscopes (SEM&#39;s) and backside imaging which requires that the chip be polished very thinly so that the photon emission from electrons can be seen through the substrate and recorded. 
         [0006]    Based on the foregoing problems, an anti-counterfeiting circuit, integrated into an IC such that the IC functions as designed when it is the authentic IC, and randomly fails when it is a counterfeit IC is desired. 
       BRIEF SUMMARY OF THE INVENTION 
       [0007]    It is an object of the invention to provide an article of manufacture for an integrated circuit (produced by a fabless design company for example) which operates as designed when fabricated by an original manufacturer using an authentic IC layout; and fails unpredictably when it is manufactured by an unauthorized manufacturer using a reverse-engineered IC layout. 
         [0008]    It is a further object of the invention to produce random fails and/or disruptions within the counterfeit circuit to make the failures more difficult to diagnose. 
         [0009]    An embodiment of the present invention comprises an article of manufacture from a design process. The article of manufacture is adapted to produce an anti-counterfeiting circuit adapted to cause failures or otherwise disrupt the functionality of a counterfeited IC. The anti-counterfeiting circuit comprises one element which has inputs from at least two signals, which may be generated by signal generators, the signals having different frequencies or different independent phases, the element activates a disrupt signal when each of the signals satisfy a predetermined condition. A second element coupled to the first element and coupled to the IC through a second output signal changes the functionality of the IC. At least one of the elements comprising the anti-counterfeiting circuit is a camouflage element and thus the anti-counterfeiting circuit is not operatively coupled to an authentic IC. 
         [0010]    In another embodiment of the present invention, the article of manufacture of the anti-counterfeiting circuit comprises an additional logic element which provides more control of the anti-counterfeiting circuit and signal gating measures. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]      FIG. 1  illustrates an example article of manufacture for anti-counterfeiting circuit according to an embodiment of the present invention. 
           [0012]      FIG. 2  is a timing diagram showing the operation of the anti-counterfeiting circuit according to one embodiment the present invention. 
           [0013]      FIG. 3  illustrates an example article of manufacture for an anti-counterfeiting circuit according to a second embodiment of the present invention. 
           [0014]      FIG. 4  is a timing diagram showing the operation of the anti-counterfeiting circuit according to the second embodiment the present invention. 
           [0015]      FIG. 5  is a design flow diagram of the IC design process used, for example, by a fabless design company, to create an article of manufacture for designing, manufacturing, or testing an IC having the functionality and/or structure of at least one embodiment of the invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0016]      FIG. 1  shows an example of an article of manufacture for an anti-counterfeiting circuit  100  according to an embodiment of the present invention. Anti-counterfeiting circuit  100  includes a first signal  110 , a second signal  120 , both of which are inputs to a first element  130 . Element  130  provides a third signal  140  to a second element  150 , which provides a fourth signal  160  to functional logic  170  within the integrated circuit. As may be appreciated by one skilled in the art, element  130  is not limited to only two inputs but may receive as many inputs as desired. 
         [0017]    When first and second signals  110  and  120  satisfy a predetermined condition, detected by element  130 , element  130  generates signal  140 , thus enabling element  150  to generate signal  160 , hence causing functional logic  170  to fail (i.e. perform in a manner not intended by the original design). Note that signals  110  and/or  120  may be generated by oscillator circuits, explicitly for the purpose of causing a random failure in time of a counterfeit design, or may be derived signals which comprise a part of the functional integrated circuit. In particular, two or more isolated ring oscillator circuits are one means of generating signals  110  and  120  with uncorrelated phases. 
         [0018]    In an authentic integrated circuit it is desirable to disable anti-counterfeiting circuit  100  so that no failure occurs in the authentic integrated circuit during normal operation. This is accomplished, for example, by disguising either one or both of elements  130  and  150  to appear coupled to functional logic  170  when viewed as a delaminated structure. In fact, however, there exists no electric coupling to functional logic  170 , i.e. the (otherwise) fail-causing signal is not transmitted to functional logic. An alternative means of disabling the anti-counterfeiting circuit in the authentic integrated circuit includes application of a camouflage technique to a portion of functional logic  170  to be insensitive to signal  160 . One way to create the disguise is to change the doping levels of either one or both of elements  130  and  150  during manufacturing thereby creating an open circuit, or modifying dopant levels to make functional logic  170  be insensitive to the signal  160 . There are many other techniques known in the art for camouflaging a circuit so that it provides a function which differs from what would be expected based on the physical appearance of the circuit. 
         [0019]      FIG. 2  illustrates an example timing diagram for an active anti-counterfeit circuit  100 , i.e. anti-counterfeiting circuit  100  has been manufactured so that elements  130  and  150  are electrically coupled to functional logic  170 . 
         [0020]    When signals  110  and  120  satisfy a predetermined condition, shown in  FIG. 2  as having pulses which occur at the same time, element  130  generates signal  140 . When signal  140  is generated, element  150  generates and sustains signal  160 . Signal  160  causes a failure in functional logic  170  as illustrated in  FIG. 2  signal  180 , the output signal of functional logic  170 . For illustrative purposes, the signal produced by signal gate  150  in  FIG. 2  is shown as an unknown data value. However, any signal behavior may be implemented depending on the designer&#39;s intentions for failure, such as, for example, High, Low, High-Z (high impedance), or metastable. A failure is considered to be any behavior in which functional logic  170  does not respond as it was designed, and/or fails unpredictably. 
         [0021]    The failure rate in exemplary waveform set  200  is determined by the following equation 1: 
         [0000]        FR=F 1 *F 2 *W   Equation 1 
         [0022]    Where F 1  is the frequency of signal  110  and F 2  is the frequency of signal  120 , and signals  110  and  120  are uncorrelated (i.e. of random phase). W is a predetermined time window in which signals  110  and  120  must satisfy a predetermined condition in order for element  130  to generate signal  140 . For example, it may be required that signal  110  present a logical ‘1’ within a time span ‘W’ of signal  120  presenting a logical ‘1’ for element  130  to generate signal  140 . It is clear that the concept described above can be generalized to greater than two input signals, all of which must present a similar predetermined condition to element  130  for element  130  to generate signal  140 . Equation 1, with ‘N’ such signal inputs that are required to satisfy predetermined criteria within a time span ‘W’, may be generalized to the following equation: 
         [0000]        FR=F 1 *F 2 * . . . FI . . . *FN*W   (N-1)   Equation 2 
         [0023]    The occurrence of failing events generated by this circuit will behave chaotically as long as the phases and/or frequencies of the signals F 1  . . . FN are random with respect to one another. N identically designed ring oscillators that are electrically isolated from one another will each have slightly different frequencies of oscillation due to random and systematic process variations within a die, such as random dopant fluctuation, across-chip line-width variation, and gate-dielectric charge fluctuations. Furthermore, from Eq. 2, it is evident that the mean time to an induced failure can be designed over a wide range of time scales by examining the case where F 1 =F 2  . . . =FN since the ratio F 1 /W can easily be designed to be a very small number ( 1/10 to 1/100), and hence the failure rate, F 1 *(F 1 /W) (N-1)  spans a large range with small increments of N. 
         [0024]      FIG. 3  illustrates a second embodiment of the present invention including an article of manufacture for an anti-counterfeit circuit  300  which further includes signals  110  and  120 , element  130 , which generates signal  140  when signals  110  and  120  satisfy a predetermined condition; and a latch  330 , which latches signal  140  and can be reset by signal  350 . Latch  330  generates signal  360 , which is input to element  150 . Element  150  further includes a second input from a signal  370 , and provides output signal  160  to functional logic  170 . 
         [0025]      FIG. 3  further illustrates a sub-circuit  310  and a sub-circuit  320  which respectively generate signals  110  and  120 , and a second functional logic  340 , which generates signal  370 . 
         [0026]    In an authentic IC, anti-counterfeiting circuit  300  is not operatively coupled to the IC. At least one of sub-circuits  310  and  320 , latch  330 , and/or elements  130  and  150  are disguised to appear from a view of the physical IC as being operatively (e.g. electrically) coupled, but in fact are not actually coupled. For example, element  130  may be manufactured to appear as an AND gate when viewed in a delaminated state, however, element  130  is actually an open circuit and does not function as an AND gate. The fabrication of element  130  as a true AND gate operatively couples anti-counterfeiting circuit  300  to the IC, thus activating anti-counterfeiting circuit  300 . 
         [0027]    When anti-counterfeiting circuit  300  is electrically coupled to the IC, element  130  detects when signals  110  and  120  satisfy a predetermined condition. The predetermined condition may be, for example: effectively equivalent to, equal (e.g. same rising edge, same falling edge, etc.), proportional, analogous, dissimilar, undetectable, non-determinant, or unequal (e.g. directly opposing values, etc.). Element  130  generates signal  140 , which is latched in latch  330  which further generates signal  360  thus enabling element  150  to cause a failure in functional logic  170 . A failure includes causing the functionality of the integrated circuit to fail or otherwise disrupt, with respect to its intended function. 
         [0028]    For illustrative purposes, signal  160  produced by element  150  in  FIG. 4  is shown as having an unknown value when element  150  is enabled. However, any function for signal  160  may be implemented depending on the designer&#39;s intentions for failure, such as, for example, a High value, a Low value, a High-Z value (high impedance), or a metastable value. 
         [0029]    In one mode of operation, element  150  acts as a signal gate by, for example, stopping or altering the input signal from functional logic element  340  and sending the altered data to functional logic  170  via signal  160 .  FIG. 4  is an example timing diagram that illustrates this mode of operation. 
         [0030]    Anti-counterfeiting circuit  300  may be incorporated into any IC design. Sub-circuits  310  and  320  may be, for example, circuits already existing in the IC design that produce a signal at a specific frequency (e.g. ring oscillators or signal generators) where the frequency (F 1 ) of the signal generated by sub-circuit  310  differs from the frequency (F 2 ) of the signal generated by sub-circuit  320 . As can be appreciated by one of ordinary skill in the art, anti-counterfeiting circuit  300  is not limited to two frequency signals and can accommodate as many frequency signals as desired. Additionally, sub-circuit  310  and/or sub-circuit  320  may be coupled to a corresponding circuit or element such as a one-shot (monostable multivibrator) circuit (not shown). 
         [0031]    Signal  350  resets latch  330  when activated, thereby deactivating signal  360 , and the operation of the integrated circuit resumes intended functionality until the two signals  110  and  120  satisfy a predetermined condition within some time window W and element  130  generates signal  140  once again. Signal  350  is activated by various means, for example, at system power-up, when the system is in a specific state, at a clock interval, from another circuit located within the IC, etc. 
         [0032]    The invention described herein is useful as a service which can be provided by IC designers/manufacturers for their IC customers who suffer from the effects of counterfeiting. The service includes integrating an anti-counterfeiting circuit  100  and/or anti-counterfeiting circuit  300  into an IC design of a customer and manufacturing the resulting IC; at least one element  130  and  150  in anti-counterfeiting circuit  100  and/or at least one of sub-circuits  310  and  320 , latch  330 , and elements  130  and  150  of anti-counterfeiting circuit  300  are disguised to appear operatively coupled to the IC when viewed on a physical delaminated IC chip, but are not actually electrically coupled. The result is an authentic IC which functions as the customer intended, yet fails, does not function according to design and/or otherwise causes disruption in the functionality of the IC when the circuit is operatively coupled in a counterfeited IC. 
         [0033]      FIG. 5  shows a block diagram of an article of manufacture made by exemplary design flow  500  and used, for example, in semiconductor IC logic design, simulation, test, layout, and manufacture. Design flow  500  includes processes and mechanisms for processing articles of manufacture or devices to generate logically or otherwise functionally equivalent representations of the article of manufacture and/or devices described above and shown in  FIG. 1  or  3 . The articles of manufacture processed and/or generated by design flow  500  may be encoded on machine-readable transmission or storage media to include data and/or instructions that when executed or otherwise processed on a data processing system generate a logically, structurally, mechanically, or otherwise functionally equivalent representation of hardware components, circuits, devices, or systems. Design flow  500  may vary depending on the type of representation being designed. For example, a design flow  500  for building an application specific IC (ASIC) may differ from a design flow  500  for designing a standard component or from a design flow  500  for instantiating the design into a programmable array, for example a programmable gate array (PGA) or a field programmable gate array (FPGA) offered by Altera® Inc. or Xilinx® Inc. 
         [0034]      FIG. 5  illustrates multiple such articles of manufacture including an input article of manufacture  520  that is preferably processed by a design process  510 . Article of manufacture  520  may be a logical simulation article of manufacture generated and processed by design process  510  to produce a logically equivalent functional representation of a hardware device. Article of manufacture  520  may also or alternatively comprise data and/or program instructions that when processed by design process  510 , generate a functional representation of the physical structure of a hardware device. Whether representing functional and/or structural design features, article of manufacture  520  may be generated using electronic computer-aided design (ECAD) such as implemented by a core developer/designer. When encoded on a machine-readable data transmission, gate array, or storage medium, article of manufacture  520  may be accessed and processed by one or more hardware and/or software modules within design process  510  to simulate or otherwise functionally represent an electronic component, circuit, electronic or logic module, apparatus, device, or system such as those shown in  FIG. 1  or  3 . As such, article of manufacture  520  may comprise files or other data structures including human and/or machine-readable source code, compiled structures, and computer-executable code structures that when processed by a design or simulation data processing system, functionally simulate or otherwise represent circuits or other levels of hardware logic design. Such data structures may include hardware-description language (HDL) design entities or other data structures conforming to and/or compatible with lower-level HDL design languages such as Verilog and VHDL, and/or higher level design languages such as C or C++. 
         [0035]    Design process  510  preferably employs and incorporates hardware and/or software modules for synthesizing, translating, or otherwise processing a design/simulation functional equivalent of the components, circuits, devices, or logic structures shown in  FIG. 1  or  3  to generate a netlist  580  which may contain multiple articles of manufacture such as article of manufacture  520 . Netlist  580  may comprise, for example, compiled or otherwise processed data structures representing a list of wires, discrete components, logic gates, control circuits, I/O devices, models, etc. that describes the connections to other elements and circuits in an integrated circuit design. Netlist  580  may be synthesized using an iterative process in which netlist  580  is resynthesized one or more times depending on design specifications and parameters for the device. As with other article of manufacture types described herein, netlist  580  may be recorded on a machine-readable data storage medium or programmed into a programmable gate array. The medium may be a non-volatile storage medium such as a magnetic or optical disk drive, a programmable gate array, a compact flash, or other flash memory. Additionally, or in the alternative, the medium may be a system or cache memory, buffer space, or electrically or optically conductive devices and materials on which data packets may be transmitted and intermediately stored via the Internet, or other networking suitable means. 
         [0036]    Design process  510  may include hardware and software modules for processing a variety of input data structure types including netlist  580 . Such data structure types may reside, for example, within library elements  530  and include a set of commonly used elements, circuits, and devices, including models, layouts, and symbolic representations, for a given manufacturing technology (e.g., different technology nodes, 32 nm, 45 nm, 90 nm, etc.). The data structure types may further include design specifications  540 , characterization data  550 , verification data  560 , design rules  570 , and test data files  585  which may include input test patterns, output test results, and other testing information. Design process  510  may further include, for example, standard mechanical design processes such as stress analysis, thermal analysis, mechanical event simulation, process simulation for operations such as casting, molding, and die press forming, etc. One of ordinary skill in the art of mechanical design can appreciate the extent of possible mechanical design tools and applications used in design process  510  without deviating from the scope and spirit of the invention. Design process  510  may also include modules for performing standard circuit design processes such as timing analysis, verification, design rule checking, place and route operations, etc. 
         [0037]    Design process  510  employs and incorporates logic and physical design tools such as HDL compilers and simulation model build tools to process article of manufacture  520  together with some or all of the depicted supporting data structures along with any additional mechanical design or data (if applicable), to generate a second article of manufacture  590 . Article of manufacture  590  resides on a storage medium or programmable gate array in a data format used for the exchange of data of mechanical devices and structures (e.g. information stored in a IGES, DXF, Parasolid XT, JT, DRG, or any other suitable format for storing or rendering such mechanical article of manufactures). Similar to article of manufacture  520 , article of manufacture  590  preferably comprises one or more files, data structures, or other computer-encoded data or instructions that reside on transmission or data storage media and that when processed by an ECAD system generate a logically or otherwise functionally equivalent form of one or more of the embodiments of the invention shown in  FIG. 1  or  3 . In one embodiment, article of manufacture  590  may comprise a compiled, executable HDL simulation model that functionally simulates the devices shown in  FIG. 1  or  3 . 
         [0038]    Article of manufacture  590  may also employ a data format used for the exchange of layout data of integrated circuits and/or symbolic data format (e.g. information stored in a GDSII (GDS2), GL1, OASIS, map files, or any other suitable format for storing such design data structures). Article of manufacture  590  may comprise information such as, for example, symbolic data, map files, test data files, design content files, manufacturing data, layout parameters, wires, levels of metal, vias, shapes, data for routing through the manufacturing line, and any other data required by a manufacturer or other designer/developer to produce a device or structure as described above and shown in  FIG. 1  or  3 . Article of manufacture  590  may then proceed to a stage  595  where, for example, article of manufacture  590 : proceeds to tape-out, is released to manufacturing, is released to a mask house, is sent to another design house, is sent back to the customer, etc. 
         [0039]    The above description and drawings are only to be considered illustrative of exemplary embodiments, which achieve the features and advantages of the invention. It should be appreciated by one of ordinary skill in the art that modification and substitutions to layout and circuit designs, disguised circuit elements, signal generating elements, frequency generators, criteria for activating the disrupt signal, and function of the circuitry coupled to the disrupt signal can be made without departing from the spirit and scope of the invention. Accordingly, the invention is not to be considered as being limited by the foregoing description and drawings.