IP Watermarking of Embedded Processor Cores

The technology scaling allows complex systems to be placed on a single die.  To tackle this complexity it is increasingly desirable to source sub-systems, such as CPUs, from external Intellectual Property (IP) suppliers. The risk of unauthorized use has become critically important to IP vendors. Although methods for securing an IP exist, they often do not provide physical protection and EDA tools are far from universal and pain-free. As a result, auditing the presence of IP in finished products is an important challenge for IP providers. De-encapsulation and die-level reverse engineering can be used to prove the presence of IP but the process is slow and costly. It is therefore desirable to identify and prioritize IP candidates to be short-listed for more thorough investigation. One commonly used detection method is digital watermarking which provides proof of the ownership to the IP vendor.

This research aims to improve watermarking technique by investigating sequences used to generate a watermark as well as implementing a watermark in a soft IP processor core as a part of the design flow. Finally, new and more effective detection techniques are investigated.

Tokachi 3 ECS & 3 ARM Test Chip

Both test chips used TSMC 65nm low power technology library.

Tokachi 3 ECS (Tokachi-3M)

The chip contains a hardened macro block of the Watermark Circuit and the Noise Generator. The architecture of the Watermark Circuit allows it to be configured as two circular shift registers or two linear feedback shift registers (LFSR) or either. This is to implement various watermark signatures for a comparison of watermark signatures detection peformance. The strength of a watermark power dissipation can be modulated with a 1kbit flip-flops (32 x 32-bit words). The Noise Generator can also be configured as a single shift register or a linear feedback shift register (LFSR) in order to create various controllable and deterministic noise schemes. Similarly to Watermark Circuit the strength of the Noise Generator power dissipation can be modulated with a 1kbit flip-flops (32 x 32-bit words). The sign-off frequency for the hardened macro is 200MHz.

The Watermark Cortex-M0 (TM) "Tracking CPU" is on a separate power domain and allows triggering of the Watermark Circuit when a multiplication operation occurs. This scheme will be used in further research of novel watermark detection techniques.

Tokachi 3 ARM (Tokachi-3A)

The chip contains a soft version of the Watermark Circuit only and is integrated into a Cortex-A5 (TM) CPU. The main aim of this project's tests on Tokachi-3A chip involve comparison of watermark signatures detection performance while increasing the system size.


Papers and Posters

DAC 2012, "Watermark-Based Identification and Implementation Efficiency of IP Embedded Processor Cores" - Poster presentation


The test chip used TSMC 65nm low power technology library.