Identifying IP cores -- to protect your investment

By Jason Abt, Val Gont, Vyacheslav Zavadsky, Young Choi, Semiconductor Insights Inc.
Ottawa, Ontario, Canada

Abstract :

IP core providers are increasingly aware of the need to protect their investment from either unintended or unlicensed usage of their IP core blocks. This would require identification of IP core blocks from any SoC. IP core identification is not a trivial task and it involves different approaches depending on the nature of IP cores. In this paper, Semiconductor Insights shows some noble ways of identifying IP cores from any SoC products to protect the interest of IP core providers. Techniques developed by Semiconductor Insights to identify IP core blocks include methods such as circuit extraction using advanced delayering techniques, layout comparisons, automatic recognition and extraction of standard cells and blocks of designs, netlist generation from the extracted circuits, use of circuit library to identify IP blocks, use of structural data mining algorithm for netlist comparison, and device and system level testing to identify IPs involving algorithms and system level protocols.

Identifying IP cores – to protect your investment

Increased level of integration for SoC design requires sophisticated design methodologies including IP management plaforms, IP standards, verification of IPs, and quality measures of IP blocks. This has created a new challenge for the IP core industry – how to protect their investment. Measures to protect IP core includes various ways including security tagging system using side channel attack techniques (e.g., Algotronix’s solution). However, it is very difficult to prevent any illegitimate uses of IP cores whether it’s intentional or unintended. Identification of IP cores, therefore, becomes the last means for any IP core providers to prove any illegitimate usages of their IP cores which are the results of years of hard work and large amount of investment. IP core identification techniques that Semiconductor Insights has developed through extensive R&D effort for the last several years have been proven to be very valuable in this regard.

Functional Layout Analysis

Often times, a complex SoC’s functional blocks reveal some of the key IP core blocks in the design. Functional Layout Analysis which focuses on identifying major macro blocks (embedded memory blocks, PLLs, data converters, data transceivers, power amplifiers, and etc) of any SoCs, will tell us the types of functional macro blocks which are employed in the design. For functional layout analysis, a device will be decapsulated and the silicon die will be deprocessed down to diffusion layer. As the high number of metal layers of today’s SoC process technology blocks most of the design details from the top, it is necessary to remove the upper layer interconnect layers and dielectric materials in between. The resulting die image is used to identify key blocks in the design.

Figure 1 An example of Functional Layout Analysis

Circuit Extraction

For detailed analysis of any design IP’s, extraction of circuits is required. To get the complete picture of a given design, the target IC must be controllably deprocessed – sequentially imaging and removing all layers of interconnect, down to the active layers. Accurate deprocessing is a significant challenge, given modern geometries (45nm, 32nm and smaller) and materials, and lack of commercially available tools for large area or even full-chip deprocessing. Image capture is typically SEM-based, and needs to be heavily automated to be practical given the limited field of view and large target areas on the IC.

Figure 2. An example of a constructed IC layout database

To perform meaningful analysis on the acquired images, interconnect data must be extracted from a raster-based image to a vector representation. This reduces the data storage requirements, simplifies automatic signal propagation through electrically connected wires and vias, and increases the efficiency of physical pattern matching.

For large digital logic blocks, it is not practical to extract base-level components (cells) manually. SI’s implementation allows for the creation of a cell library, which is then matched against the extracted layout data. Cells are automatically identified based on the library, and ‘wired’ into the design. From this, a netlist of the target block can be created and analyzed.

The result of this circuit extraction is a set of hierarchical schematics. During the process of constructing the hierarchy, the functionality and the structure of each circuit block is recognized to form a meaningful functional blocks and hierarchies. Semiconductor Insights’s layout and schematic cross reference capability also help identify any circuit elements from either layout view or schematic view.

Figure 3. A cell definition of cell extractor

Figure 4. Cell Extractor in action – three cells identified in the design

Schematic library search and match

Identification of IP blocks is also performed by comparing circuit blocks extracted from a design against vast amount of IP/circuit libraries available. Extracted netlists (either manually or automatically generated, as in cell extractor above) can be automatically compared against a reference library, showing ranked potential matches. A netlist generated from a source IP block will be compared against a library of netlists using structural data mining algorithm developed by SI. SI has a large library of circuit implementations extracted from various products during the course of business over many years and across many technologies. This is a very efficient means of identifying an IP block from multiple products.

Layout Comparison Techniques

Another very cost effective way of IP block identification is layout comparison. This is especially useful for identification of minor changes. Layouts, layer by layer, are sectored and locally aligned. The boolean difference of polygons is computed and the noise will be cleared. Vias will be checked on the basis of polygon connectivity.

This is a very cost effective way of hard macro identification method provided that one of the designs has already been analyzed including circuit analysis.

Functional Testing

When the above mentioned techniques are either costly or not practical, functional testing could be very effective to identify any IPs associated with functionality. This is especially effective for any IPs which involve complex algorithms or behavior. As these complex behaviors are very difficult to understand and prove by circuit analysis alone, functional testing is a very effective way to identify algorithm and behavior based IPs.

Programming and erase waveform testing of Flash memory devices is a very powerful measure to identify the intellectual properties associated with noble programming algorithms of non-volatile memory devices.

Testing of USB memory stick with focus on the controller’s functionality in Flash control algorithms such as wear leveling can help companies identify IPs used in the product without going through time consuming circuit extraction and analysis.

Other devices such as microprocessors or HDTV could also be tested to reveal any evidence of IPs being used in the products. For the complicated algorithms and IPs associated protocols, it is very effective ways of identifying IPs.

Figure 5 An example of NAND Flash functional testing

Challenges

As the design methodology and process technology evolve, indentifying IP blocks becomes more difficult. Here are some of the challenges for IP block identification.

Soft macro challenges

There are three major challenges in identifying soft macros. First, a soft macro could be implemented in any digital logic block on a target IC, and it could be only a subset of a given block. Determining the potential location of a soft macro would require substantial ‘overhead’ analysis of surrounding circuits. Second, a soft macro implementation could contain many thousands of base-level cells. For accurate identification, large numbers of cells would need to be extracted an analyzed – not practical with a manual approach. Third, and perhaps most important, the extracted netlist is the post-synthesis representation of the original design. As actual implementation varies from vendor to vendor and by many different design constraints, any comparison would have to be done on a functional level.

Design verification methodologies such as formal verification or equivalence checking could be used to identify any IP blocks by comparing extracted netlist from the device and behavioral or RTL representation of the design.

Characteristics of a soft IP block using some portions of netlist extracted from it could be used to identify it’s equivalence to a source using structural data mining algorithm.

Hard macro challenges

The identification of hard macros requires a ‘noise-tolerant’ comparison between a reference design and a target IC. Especially for smaller hard macros, visually identifying similar blocks on a large, heavily metallized IC can be extremely difficult. For automated analysis, the system needs to be sufficiently robust and flexible to accommodate minor routing changes, insertions or deletions, or geometric transforms (scaling, rotations, inversion) in the potential target areas.

Software IP challenges

As SoC has hardware and software, identification of software part of any IP is a real challenge. Growing trend of implementing programmable and configurable SoC design adds this complexity. This is one of the areas which require more extensive R&D activities to be effective.

Functional Testing challenges

Functional testing often requires active probing of signals on a silicon die. Due the increased level of integration and large number of interconnect metal layers, access to lower level metal layers become extremely difficult. New noble techniques such as backside imaging and probing would be required to overcome these challenges.

Conclusion

Identification of IP blocks is important to protect the investment of IP core developers. Techniques to identify IP cores in any designs evolve as design methodology and process technology are advanced. Soft macro based IP macro usage has its own challenges in identifying IP blocks. Use of techniques such as formal verification or equivalence checking would be required to further soft macro identification. Extensive inventory circuits and IP blocks and use of search and match technique would provide very efficient and comprehensive way of identifying IP blocks. Novel techniques such as structural data mining are used to identify IP blocks. Design analysis techniques, just like design methodology and process technology, evolve with the industry, to protect the investment of IP core and SoC industry.