Julian Leonhard

Graduate Student Member, IEEE Nimisha Limaye

Shadi Turk

Alhassan Sayed

Alán Rodrigo

Díaz Rizo

Member, IEEE Haralampos-G Stratigopoulos

Digitally-Assisted Mixed-Signal Circuit Security

Keywords: Hardware security and trust, mixed-signal integrated circuits, IP/IC piracy, locking. Untrusted regime Trusted regime

The design and manufacturing steps of a chip typically involve several parties. For example, a chip may comprise several third-party Intellectual Property (IP) cores and the Integrated Circuit (IC) fabrication may be outsourced to a third-party foundry. IP cores and ICs are shared with potentially untrusted third parties and, as a result, are subject to piracy attacks. Even more, any legally purchased chip may be reverse-engineered to retrieve the design down to transistorlevel and, thereby, it is also subject to piracy attacks. In this paper, we propose MixLock, an anti-piracy countermeasure for mixed-signal IP cores and ICs. MixLock protection is based on inserting a lock mechanism into the design such that correct functionality is established only after applying a key which is the designer's secret. The lock mechanism acts on the mixedsignal performances by leveraging logic locking of the digital part. MixLock presents several key attributes. It is generally applicable, it is non-intrusive to the sensitive analog section, it incurs no performance penalty and has very low area and power overheads, it is fully automated, and it is capable of co-optimizing security in both the analog and digital domains. We demonstrate MixLock on a Σ∆ Analog-to-Digital Converter (ADC) using hardware measurements and an audio demonstrator.

I. INTRODUCTION

The globalization of the semiconductor industry where many design, manufacturing, and test tasks are outsourced to third-parties, as well as the increasing capabilities for reverseengineering a chip [START_REF] Lippmann | Integrated flow for reverse engineering of nanoscale technologies[END_REF], have given rise to several IP/IC piracy threat scenarios [START_REF] Guin | Counterfeit integrated circuits: A rising threat in the global semiconductor supply chain[END_REF]. For example, a System-on-Chip (SoC) integrator that receives the blueprint of an IP may clone the and illegitimately reuse it in another SoC without remunerating the IP provider. A foundry that also receives the blueprint of a SoC and all its sub-IPs can also perform the cloning operation. In addition, it can overproduce chips beyond the number agreed on in the contract and thereafter sell them illegally. A test facility may remark out-of-spec chips as functional, possibly with a forged datasheet, and sneak them illegally into the market. An end-user may reverse-engineer a legally purchased chip to extract the required proprietary information, i.e., architecture, netlist, and layout, needed to perform the cloning operation. Finally, a scrapped chip, which is likely to have aged and show degraded performance, can be recycled and can re-enter the market as a seemingly fresh and unused chip. IP/IC piracy includes all these types of counterfeiting, i.e., cloning, overproducing, remarking, and recycling. IP/IC piracy is a major preoccupation nowadays for the industry (e.g., lost sales, know-how, and brand value), governments (e.g., national security threat if counterfeits are used in critical infrastructure), and the society as a whole (e.g., safety concerns due to low-quality counterfeits).

In the last decade, extensive research has been carried out to understand trust and security threat scenarios in digital ICs. Analog and mixed-signal (A/M-S) ICs on the other hand have so far received far less attention and as a consequence the number of proposed solutions is low [START_REF] Sanabria-Borbón | Analog/RF IP protection: Attack models, defense techniques, and challenges[END_REF]. This work proposes MixLock, a method of hardware security for M-S ICs based on locking with the goal to prevent IP/IC piracy.

Locking is an end-to-end protection against potential attackers located anywhere in the IC supply chain [START_REF] Chakraborty | Keynote: A disquisition on logic locking[END_REF]. A standard locking flow is depicted in Fig. 1. The IP/IC owner transforms the circuit by embedding into it a lock mechanism that receives as input a key in the form of a bit-string. The circuit's functionality becomes a function of the key. The correct key that restores the nominal functionality is the designer's secret. A potentially untrusted SoC integrator or foundry receives the locked circuit and without knowing the secret key possesses a non-functional circuit, thus thwarting any cloning or overproduction possibilities. Thereafter, the IP/IC owner activates the fabricated chip by storing the secret key in a Tamper-Proof Memory (TPM). An end-user who reverse-engineers the chip cannot read the secret key from the TPM, thus possesses a non-functional circuit.

MixLock leverages proven logic locking methods from the digital domain. In particular, we propose locking a M-S IC via logic locking of its digital part, while leaving the analog section intact. While MixLock is agnostic to the particular logic locking technique used, we use a state-of-the-art technique, namely Dishonest Oracle (DisORC) in combination with Truly Random Logic Locking (TRLL) [START_REF] Limaye | Thwarting all logic locking attacks: Dishonest oracle with truly random logic locking[END_REF]. We provide metrics for assessing the security in the analog domain, such as the impact of locking on the M-S functionality or the percentage of failing incorrect keys. The digital security level is expressed in terms of the resilience against known logic locking attacks. We showcase the technique in a hardware experiment using a Σ∆ ADC as a case study, and in an audio demonstrator where one can listen to the effect of locking the ADC in the audio signal processing chain. Overall, MixLock presents a number of attractive features, such as wide applicability, nonintrusiveness to the analog section, unaltered analog design flow, full automation, no performance penalty, and justifiable power and area overheads.

MixLock was originally proposed in [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF], where the Stripped-Functionality Logic Locking (SFLL) technique [START_REF] Yasin | Provably-secure logic locking: From theory to practice[END_REF] was employed for locking the digital section. We refer to this first implementation of MixLock as MixLock 1.0, while we refer to the implementation in this paper that employs DisORC in combination with TRLL as MixLock 2.0. Throughout this paper we refer to MixLock's generic and locking mechanismagnostic methodology simply as MixLock.

With respect to [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF], this paper provides the following advances:

• The choice of logic locking plays a significant role in the context of MixLock. In the MixLock 1.0 implementation, SFLL was carefully tuned to achieve high security in both digital and analog domains. Although invalid keys resulted in M-S functionality corruption, that is, specifications were violated, the M-S performance degradation was very moderate. For example, this is made evident when listening to the effect of locking in the audio demonstrator. The "locked" sound sample is still recognisable containing only some infrequent glitches. As remedy, a second SFLL mechanism, tailored towards increasing functionality corruption, was instantiated, although this second mechanism can be broken with reasonable effort. The difference between applying logic locking to a purely digital IC and applying logic locking in the context of MixLock is that in the former case a single bit-flip due to the use of an incorrect key is enough to cause an application crash, while in the latter case many computational errors need to be introduced into the digital section by the locking mechanism to be perceivable in an analog waveform. We will explain in detail why SFLL applied to MixLock falls short in this regard. To this end, using DisORC with TRLL in the MixLock 2.0 implementation helps us to effortlessly meet this objective. DisORC with TRLL results in maximum digital security, while the M-S performance plummets for invalid keys. • The ADC case study is extended from simulation in [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF] to a full hardware experiment in this paper. • We estimate an upper bound on the number of user keys that can establish correct functionality based on their Hamming Distance (HD) from the valid secret key. This is possible in the MixLock 2.0 implementation as functionality corruption is a function of the user key while being independent of the input data. In contrast, in the MixLock 1.0 implementation, functionality corruption was independent of the user provided key while being highly dependent on the input data, thus not allowing a bound on valid user keys to be estimated. • We provide a comparison of the different A/M-S IC locking approaches in terms of generality, design complexity, overheads, and attack resiliency. The rest of the paper is organized as follows. In Section II, we discuss the prior art on A/M-S IC locking. In Section III, we present the proposed MixLock technique. In Section IV, we present the hardware experiment. In Section V, we present the audio demonstrator. In Section VI, we provide a comparison of existing A/M-S IC locking techniques. Section VII concludes the paper.

II. STATE-OF-THE-ART IN A/M-S IC LOCKING

A. Locking defenses 1) Biasing locking: The majority of analog locking techniques consider the insertion of a lock into the biasing circuitry. Providing the correct biases to the analog core is essential, given that the core will only function as foreseen if operated in the regime, i.e., the DC operating point, it was originally designed for.

Two types of approaches can be found in the literature, namely expanding the biasing circuit [START_REF] Rao | Protecting analog circuits with parameter biasing obfuscation[END_REF]- [START_REF] Rao | Mesh based obfuscation of analog circuit properties[END_REF], and the design of a standalone block that generates the desired bias [START_REF] Hoe | Towards secure analog designs: A secure sense amplifier using memristors[END_REF], [START_REF] Volanis | Analog performance locking through neural network-based biasing[END_REF].

In [START_REF] Rao | Protecting analog circuits with parameter biasing obfuscation[END_REF], a current source transistor is replaced with an array of parallel-connected transistors. The number of conducting transistors is controlled by a key. Thereby, in the case of a correct key, the aggregate width of the active transistors equals that of the replaced transistor, whereas a wrong key can lead to a different aggregate width, generating an incorrect bias current.

In [START_REF] Wang | Thwarting analog IC piracy via combinational locking[END_REF], it is shown how to redesign a current mirror to embed the lock mechanism. The mirror transistor is replaced with a structure composed of several branches. Each branch contains a mirror transistor with an individual current mirroring ratio and several pass transistors controlled by the key-bits. The resultant bias current depends on which branches are "on" and the geometry of the mirror transistors of the "on" branches.

In [START_REF] Rao | Mesh based obfuscation of analog circuit properties[END_REF], extending [START_REF] Rao | Protecting analog circuits with parameter biasing obfuscation[END_REF], a transistor is replaced with a number of parallel and series-connected transistors, thereby creating a mesh. Each transistor in the mesh is sized differently and is controlled with a key-bit. The aggregate width and length of such a mesh of transistors is then a function of the key.

In [START_REF] Hoe | Towards secure analog designs: A secure sense amplifier using memristors[END_REF], it is proposed to secure a sense amplifier by using memristor-based circuitry to program the matched transistor pair's body-biasing voltage, used to eliminate the offset of the amplifier arising due to process variations. A memristor crossbar is programmed via a secret key allowing in turn the programming of a voltage divider that generates the body biasing. When applying an incorrect key the breakdown voltage of the emerging technology device can be reached, thus limiting the number of trials an attacker has for an attack.

In [START_REF] Volanis | Analog performance locking through neural network-based biasing[END_REF], an on-chip neural network is used to generate the bias. The neural network receives as input an analog key in the form of DC voltages and is trained to implement an impulse function at the correct key, i.e., only when the correct DC voltages are provided at the key inputs will the neural network generate the correct biases at its output, while otherwise the output remains constantly at an incorrect level.

2) Calibration locking: Calibration locking mechanisms act on the programming or configuration of the circuit, thus blocking the compensation against process variations and the correct setting of the desired operation mode.

In [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF], it is proposed to apply logic locking in the digital optimizer block which is part of a calibration feedback loop. The calibration feedback loop comprises sensors to extract measurements, ADCs to digitize the measurements, digitallycontrolled tuning knobs, and the digital optimizer that maps the measurements to selected tuning knobs so as to reduce the impact of process variations on the performances. An incorrect key will result in a non-calibrated circuit showing performance degradation.

In [START_REF] Elshamy | Securing programmable analog ICs against piracy[END_REF], it is proposed to exploit the naturally available programmability fabric of a highly-digitized A/M-S IC in order to lock it. It is argued that inserting a lock is not strictly necessary, since the configuration settings can serve as secret key-bits. Furthermore, the calibration algorithm to determine the circuit's correct configuration is kept secret and must be sufficiently complex so it cannot be reverse engineered.

In [START_REF] Rao Nimmalapudi | Range-controlled floating-gate transistors: A unified solution for unlocking and calibrating analog ICs[END_REF], Analog Floating-Gate Transistors (AFGTs) that serve to calibrate the circuit are used for inserting a lock. When starting the unlocking procedure, the tuning range of the AFGTs is reduced and their full tuning range is only unlocked when a number of secret waypoints is followed. To follow these waypoints, the AFGTs must be programmed in a certain order and with certain voltage levels. The waypoints, i.e., the secret programming order and AFGT voltage levels, therefore constitute a secret key in the analog domain. Only when all waypoints have been tracked, the complete programming range of the AFGTs is unlocked.

3) Mixed-signal locking: It aims at locking M-S ICs via logic locking of their digital section. Logic locking of the digital optimizer in the calibration feedback loop [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] and MixLock [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF] fall into this category. The analog performance breaks unless the digital blocks are unlocked with the valid key. While biasing and calibration locking methods act on periphery circuits, i.e., biasing circuit and calibration mechanism, MixLock inserts the lock inside the core of the circuit, thereby acting on the signal processing. MixLock will be described in detail in Section III.

4) Compound locking: In [START_REF] Juretus | Securing analog mixedsignal integrated circuits through shared dependencies[END_REF], a compound locking method is proposed where a M-S circuit is locked via logic locking of its digital part and biasing locking of its analog part. Making analog and digital sections share an identical key, may stop an attacker from breaking the analog and digital blocks' locking mechanism independently.

B. Counter-attacks on locking

In parallel to developing A/M-S IC locking defenses, the first counter-attacks have surfaced recently.

The majority of them target biasing locking [START_REF] Jayasankaran | Breaking analog locking techniques[END_REF]- [START_REF] Leonhard | Breaking analog biasing locking techniques via re-synthesis[END_REF]. The counter-attack in [START_REF] Jayasankaran | Breaking analog locking techniques[END_REF] is demonstrated to break all existing biasing locking techniques. To recover the secret key, the attacker needs to derive three circuit equations that are solved thereafter using a Satisfiability Modulo Theory (SMT) solver. These equations include the relationships between: (a) the obfuscated component value, e.g., the geometry of the mirror transistor in a current mirror, and the key-bits; (b) the bias and the obfuscated component value; and (c) the bias and the performances listed in the data-sheet. Two counterattacks are proposed in [START_REF] Jayasankaran | Breaking analog locking techniques[END_REF] that apply to the biasing locking techniques in [START_REF] Rao | Protecting analog circuits with parameter biasing obfuscation[END_REF]- [START_REF] Rao | Mesh based obfuscation of analog circuit properties[END_REF]. The first exploits the key spacing, in particular the fact that there is an exclusion zone around the obfuscated parameter value, such that only the correct key produces values within this zone. The second exploits the monotonic relationship between a performance and the obfuscated component value when a single component is being obfuscated. Recommendations are also given on how to mitigate these two counter-attacks. The counter-attacks in [START_REF] Acharya | Attack of the genes: Finding keys and parameters of locked analog ICs using genetic algorithm[END_REF], [START_REF] Leonhard | Breaking analog biasing locking techniques via re-synthesis[END_REF] are the most powerful since they are generally applicable to any biasing locking scheme, they cannot be mitigated, and also, compared to [START_REF] Jayasankaran | Breaking analog locking techniques[END_REF] where the attacker must derive circuit equations, are easier to execute even by a weak attacker with no particular circuit design expertise. The underlying idea is to remove the locked biasing circuit and replace it with an unlocked version of it and, thereafter, use optimization to synthesize the biasing circuit together with the circuit core. Both attacks use Genetic Algorithms (GAs) to perform the optimization. They differ in the way the fitness function is defined. In [START_REF] Acharya | Attack of the genes: Finding keys and parameters of locked analog ICs using genetic algorithm[END_REF], the optimization aims at matching the frequency or transient response to that of the oracle, whereas in [START_REF] Leonhard | Breaking analog biasing locking techniques via re-synthesis[END_REF] the optimization aims at satisfying the performance tradeoff promised in the datasheet without requiring an oracle. In [START_REF] Acharya | Attack of the genes: Finding keys and parameters of locked analog ICs using genetic algorithm[END_REF], a second optimization is performed aiming at recovering the secret key by using the extracted obfuscated component value as a second fitness criterion. In this way, the search in the large space of keys, i.e., 2 n where n is the key size, can converge in reasonable time.

In [START_REF] Jayasankaran | Breaking analog locking techniques[END_REF], an attack on the existing mixed-signal locking techniques in [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF], [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] is also proposed. Both these techniques use SFLL [START_REF] Yasin | Provably-secure logic locking: From theory to practice[END_REF] as their underlying logic locking technique. The attack exploits the fact that SFLL corrupts the output of the digital section only for a handful of input patterns. The attacker finds this set of protected input patterns (PIPs) by analyzing the analog-digital interface signals and then determines the secret key using Boolean satisfiability (SAT) formulations. The attack is demonstrated for the calibration locking technique in [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] and it is claimed that it works also for the MixLock 1.0 implementation in [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF].

C. Physical obfuscation

Besides locking methods, other anti-piracy methods include split manufacturing [START_REF] Bi | Beyond the interconnections: split manufacturing in RF designs[END_REF] and camouflaging [START_REF] Ash-Saki | How multi-threshold designs can protect analog IPs[END_REF], [START_REF] Leonhard | Analog and mixed-signal IC security via sizing camouflaging[END_REF]. While locking is an end-to-end protection method against all potential threats, i.e., untrusted SoC integrator, foundry, and end-user, split manufacturing protects only against an untrusted foundry and camouflaging protects only against an untrusted end-user that attempts to clone the circuit via reverse-engineering.

III. MIXLOCK

A. Principle of operation

MixLock constructs a locked M-S IC by locking its digital section, as shown in Fig. 2. A M-S IC is composed of several analog, mixed analog-digital, and purely digital cores that are interconnected in a serial signal-processing chain and/or in feedback loops. By locking one or more digital cores, we gain control over the signal-processing flow. According to the M-S IC type, the digital cores can perform different whole functions or subfunctions. Using an incorrect key, the output of the digital core(s) will be corrupted, which will in turn affect the signal-processing flow and corrupt the M-S IC performance trade-off in a complex and unpredictable way; i.e., one or more performances will lie outside their acceptable specification range. In short, logic locking of the digital section ensures performance degradation of the M-S IC on application of an incorrect key.

B. Attributes

1) Wide applicability: The MixLock principle applies at system-level for large M-S ICs that comprise several blocks, some of which are mixed analog-digital or purely digital. This includes a wide range of M-S ICs, including data converters, Phase-Locked Loops (PLLs), and RF transceiver architectures. It also fits well the general trend towards digitally-assisted analog designs and digital centric M-S architectures, where the goal is to make a thoughtful shift of functionality from the analog into the digital domain, in order to alleviate analog design complexity and enable post-manufacturing tuning, selfcalibration, and re-configurability.

More specifically, all ADCs comprise digital blocks that can be targeted for locking. Σ∆ ADCs, which will serve as our case study, comprise a Σ∆ modulator and a digital decimation filter used for removing the out-of-band noise from the Σ∆ modulator output and down-sampling it to convert it to a high-resolution digital signal, sampled at the Nyquist rate. Successive Approximation Register (SAR) ADCs comprise several mixed analog-digital and purely digital blocks, including Digital-to-Analog Converters (DACs) that create the comparison levels and the SAR logic block that controls the conversion process. Pipeline ADCs comprise digital logic that assembles the digital codes of the cascaded stages and performs the digital correction to reduce the accuracy requirement of the flash sub-ADCs used inside each stage. Regarding PLLs, one can target locking the Voltage Controlled Oscillator (VCO) or the frequency divider. Regarding RF transceivers, the most common architectures, i.e., Zero Intermediate Frequency (Zero-IF), Low Intermediate Frequency (Low-IF), and super-heterodyne, are based on I/Q branches and both the receiver and transmitter require a digital block to correct for DC offset and/or I/Q imbalance. In this case, locking can be performed on this block to create artificial I/Q imbalance and corrupt the Bit Error Rate (BER). Regarding highlydigitized RF transceiver architectures, the receiver uses an RF ADC to directly convert the RF signal to the digital domain, which is then down-converted to DC by a digital mixer and filtered using a digital decimation filter. In the transmitter, the baseband signal passes through a digital interpolation filter before the digital up-conversion. Locking here can target the digital decimation and interpolation filters.

2) Non-intrusiveness: In fact, the main advantage of MixLock is that it achieves locking of the M-S IC while deliberately retaining intact the analog cores without needing to re-design them. Adding any lock mechanism inside the analog cores is likely to find analog designers reluctant since it inevitably degrades performance and consequently requires redesigning the analog cores together with the lock mechanism so as to meet the intent specifications, if this is possible at all. The fact that MixLock is transparent and non-intrusive to the analog cores makes it very attractive for analog designers and is vital for its wide adoption in the scope of a M-S design flow.

3) Large key size: The fact that MixLock inserts the lock mechanism inside the digital sections allows using a large key size which is a prerequisite for thwarting counter-attacks on locking that search for the secret key. Such a large key size is arguably difficult to be introduced into the analog cores without significant overheads and re-design effort.

4) Unaltered analog design flow and full automation: Another important advantage of MixLock is that it leaves intact the analog design flow, which is not automated and involves manual schematic and layout design, as well as manual layout floor-planning and routing. The M-S IC design flow with MixLock alters only the digital design flow and is fully automated, since logic locking is fully automated, involving a few additional steps after logic synthesis. The locking step can be seamlessly integrated into the digital design flow.

5) Low-overhead: The area and power overheads of MixLock are those of the locked digital section projected to the complete M-S IC. Typically, die area and power consumption in a M-S IC is largely dominated by the analog section. The area and power overhead in the digital section introduced by logic locking is already affordable considering the digital section alone; this overhead, when projected to the entire M-S IC, will be even easier to justify.

Furthermore, advanced logic locking algorithms and TRLL in particular [START_REF] Limaye | Thwarting all logic locking attacks: Dishonest oracle with truly random logic locking[END_REF] allow the designer to designate critical path locations in the digital design where no logic modifications are to be carried out. Ideally, the lock insertion is to be performed in non timing-critical paths with sufficient timing slack. Thereby, timing violations can be avoided and, in return, any small delay penalty in the digital section due to the insertion of the lock mechanism will be non-critical for meeting the M-S IC performance trade-off. For our case study circuit in Section IV-A, MixLock did not induce any performance degradation in the M-S domain. We expect that MixLock will generally only induce minor performance penalties.

6) Independence from logic locking: MixLock is independent of the underlying logic locking mechanism and can make use of the state-of-the-art logic locking technique at any given point in time. This is important to clarify since, as we will discuss in Section III-D, there have been a plethora of logic locking techniques which shortly after their appearance were broken by a counter-attack. Our current MixLock 2.0 implementation makes use of the state-of-the-art logic locking technique, namely DisORC in combination with TRLL [START_REF] Limaye | Thwarting all logic locking attacks: Dishonest oracle with truly random logic locking[END_REF], which is resilient to all known attacks on logic locking.

It should be mentioned, however, that in general logic locking techniques cannot be blindly applied in this context and they need to be fine-tuned so as to effectively break the performance of the M-S IC when incorrect keys are applied. This point will be discussed in more detail in Section III-E.

7) Resilience to attacks: As we will discuss in detail in Section III-G, the MixLock 2.0 implementation is capable of co-optimizing security in the analog and digital domains.

C. Security metrics

The security level offered by MixLock is defined in terms of security level of the underlying logic locking, called digital security level, and the security level of M-S performance tradeoff locking, called analog security level.

The digital security level is measured by the effort that the designer must spend for identifying the secret key. It is dictated by the resilience against known counter-attacks, as will be explained in more detail in Section III-D.

The analog security level is measured using three different metrics in the analog domain: 1) Percentage of failing keys. The percentage of incorrect keys resulting in violation of one or more performance specifications. This metric may be misleading if incorrect keys only slightly push performances outside their specifications. To account for this scenario, we also use the following two metrics. 2) Mean error. The average performance difference between the unlocked M-S IC and the locked versions with incorrect keys. 3) Minimum error. The minimum observed performance difference between the unlocked M-S IC and the locked versions with incorrect keys, indicating the worst-case locking scenario. These metrics can be quantified by putting to test a large set of random incorrect keys.

D. Short history on logic locking and counter-attacks

Initial logic locking solutions, such as Random Logic Locking (RLL) [START_REF] Roy | Ending piracy of integrated circuits[END_REF], Fault analysis-based Logic Locking (FLL) [START_REF] Rajendran | Fault analysis-based logic encryption[END_REF], and Strong Logic Locking (SLL) [START_REF] Yasin | On improving the security of logic locking[END_REF], were based on inserting key-controlled logic gates within the circuit and aimed at achieving high output corruption, i.e., a heavily nonfunctional circuit, on application of an incorrect key. However, such a strategy was outlived by the miter-based SAT attack [START_REF] Subramanyan | Evaluating the security of logic encryption algorithms[END_REF]. It recovered the secret key by pruning out multiple key-values per iteration. In the process, the attack queries a working chip (also referred to as an oracle) with carefully crafted input patterns, and also makes use of the existing scan infrastructure on the chip.

To overcome this attack strategy, researchers improved SAT resilience of logic locking techniques based on key-gate insertion [START_REF] Juretus | Characterization of in-cone logic locking resiliency against the SAT attack[END_REF] and also proposed point-function based locking techniques which pushed the limits of the oracle-based SAT attack to brute-force by eliminating exactly one key-value per iteration [START_REF] Yasin | Provably-secure logic locking: From theory to practice[END_REF]. The latter techniques faced the drawback of low output corruption on incorrect key assignment. Following this observation, a merger between pre-SAT high output corruption locking schemes and post-SAT low output corruption locking schemes was proposed [START_REF] Yasin | SARLock: SAT attack resistant logic locking[END_REF]. But the limitations of either of the schemes paved way for advanced and tailored oracle-based attacks [START_REF] Shamsi | AppSAT: Approximately Deobfuscating Integrated Circuits[END_REF].

The reason why oracle-based attacks are successful even on large sequential digital designs is because of the presence of scan-chains. Scan chains are necessary for thorough testing of the chips; they allow direct access to the internal nodes in the design without relying on multiple capture cycles. This construction within the design is utilized by SAT-based attacks to successfully and efficiently recover the secret key.

Still, there are oracle-based attacks that do not rely on scan chains and aim at recovering the secret key only by granting primary I/O access, such as the KC2 attack [START_REF] Shamsi | KC2: Key-condition crunching for fast sequential circuit deobfuscation[END_REF]. The KC2 attack unrolls the combinational part of the sequential circuit by creating multiple copies of it. The number of copies that the attack needs to create depends on the sequential depth of the design.

Another category of attacks is based on netlist or structural analysis. They inspect the locked netlist with the aim of deciphering the key-values from the structure and type of embedded logic gates. These attacks are referred to as oracleless attacks as they do not rely on a working chip. Structural analysis-based attacks using machine learning [START_REF] Chakraborty | SAIL: Machine learning guided structural analysis attack on hardware obfuscation[END_REF], [START_REF] Sisejkovic | Challenging the security of logic locking schemes in the era of deep learning: A neuroevolutionary approach[END_REF] undo the obfuscation realised by synthesis tools and map the logic gate type directly to its key-value. Other oracle-less, netlistonly attacks include the redundancy attack [START_REF] Li | Piercing logic locking keys through redundancy identification[END_REF] which inspects the netlist to identify redundant nodes on application of random key-values. If any key-value on the key-gate introduces redundancy in the netlist, then that key-value is discarded.

E. Choice of logic locking in the context of MixLock

In the context of MixLock, the chosen underlying logic locking technique should thwart all existing oracle-based and oracle-less attacks (digital security) all-the-while achieving high output corruption for incorrect keys (analog security).

For various reasons, M-S ICs do not always include scan chains into their digital section, even when the amount of logic is large. For example, the M-S IC will be, after all, tested as a whole; inserting scan chains affects speed; and many analog designers are not familiar with scan chains. If scan chains are absent, oracle-based attacks requiring scan access, such as the original SAT attack [START_REF] Subramanyan | Evaluating the security of logic encryption algorithms[END_REF], are disabled. Then, to attain digital security, a designer should be mindful of oracle-less attacks that analyze the reverse-engineered netlist for clues about the secret key [START_REF] Chakraborty | SAIL: Machine learning guided structural analysis attack on hardware obfuscation[END_REF], [START_REF] Sisejkovic | Challenging the security of logic locking schemes in the era of deep learning: A neuroevolutionary approach[END_REF] and of oracle-based attacks using I/O data and no scan access, such as the KC2 attack [START_REF] Shamsi | KC2: Key-condition crunching for fast sequential circuit deobfuscation[END_REF]. The objective is to select the smallest-overhead logic locking technique that achieves strong analog security while digital security is also ensured. If scan chains are present, then achieving digital security requires more effort to thwart both oracle-based and oracle-less attacks, and thus, a more sophisticated logic locking technique should be used.

The previous MixLock 1.0 implementation [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF] utilized the SFLL technique [START_REF] Yasin | Provably-secure logic locking: From theory to practice[END_REF] which thwarts only oracle-based attacks. In brief, SFLL hard-codes a comparison HD(IN, key) = h, where HD(x, y) is the HD between x and y and IN is the digital input pattern to the locked block. If the comparison does hold true, then a victim bit is flipped. A correction unit is used to implement the same comparison, but this time the key is sourced from the TPM. When a bit-flip happens, the correction unit will immediately flip again the bit upon application of the correct key, thus the error will be suppressed. SFLL produces incorrect functionality only for a small set of PIPs that have a HD=h from the key, when an incorrect key is applied. By increasing h we can increase functionality corruption, but this is at the expense of lower security levels against the SAT attack [START_REF] Yasin | Provably-secure logic locking: From theory to practice[END_REF]. New research shows that this trade-off doesn't necessarily hold true and higher corruption rates can be achieved without sacrificing security [START_REF] Juretus | Increased output corruption and structural attack resilience for SAT attack secure logic locking[END_REF], [START_REF] Shamsi | On the impossibility of approximation-resilient circuit locking[END_REF]. However, the area overhead for a high-security/high corruption locking may be large.

Still, low corruption rates are oftentimes sufficient for digital ICs. For example, to lock a microcontroller it suffices to lock one bit for one input in the program counter to safeguard against unauthorized execution [START_REF] Yasin | Provably-secure logic locking: From theory to practice[END_REF]. However, in the context of M-S IC locking, flipping a bit inside a digital block for a small set of its inputs may not result in any appreciable performance degradation. For example, in [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF], SFLL was used to lock a Σ∆ ADC via locking the most-significant bit (MSB) output of the first comb filter within the decimation filter. The analog input propagated to the input of the locked decimation filter rarely "hits" one of its PIPs. This essentially means that the performance will be corrupted under specific input conditions which are not necessarily met frequently. A suitable secret key was crafted so as to achieve the maximum possible functionality corruption while still achieving at least 64 bit resilience against the SAT attack. To this end, to further increase the functionality corruption, an additional second instantiation of SFLL, locking the MSB-1 of the comb filter, was used. This second lock mechanism increases functionality corruption but has a low resiliency against SAT attack and, thereby, can be broken, leaving the device protected with only the first lock mechanism. This variant of SFLL with two lock mechanisms is referred to as 1.5xSFLL in the MixLock 1.0 implementation.

In our new MixLock 2.0 implementation presented in this paper, we make use of the recently proposed state-of-the- art DisORC technique in combination with TRLL [START_REF] Limaye | Thwarting all logic locking attacks: Dishonest oracle with truly random logic locking[END_REF]. This technique heavily benefits MixLock as it leads to very high functionality corruption and, accordingly, a very strong analog security level, while achieving low area overhead and protecting against all known logic locking counter-attacks, thus delivering digital security as well.

F. DisORC with TRLL

DisORC and TRLL [START_REF] Limaye | Thwarting all logic locking attacks: Dishonest oracle with truly random logic locking[END_REF] are two orthogonal solutions, meaning that DisORC provides total resilience against oracle-based attacks that make use of the scan chain [START_REF] Subramanyan | Evaluating the security of logic encryption algorithms[END_REF] while TRLL provides maximum functionality corruption and total resilience against oracle-less attacks based on structural analysis using machine learning [START_REF] Chakraborty | SAIL: Machine learning guided structural analysis attack on hardware obfuscation[END_REF], [START_REF] Sisejkovic | Challenging the security of logic locking schemes in the era of deep learning: A neuroevolutionary approach[END_REF].

Fig. 3 presents a high-level description of the DisORC defense architecture. The DisORC principle is to withdraw the secret logic locking key upon detection of an access to the scan chains, while maintaining full testability of the circuit. More specifically, the key feeding the key-gates is controlled by a new signal called corrupt that is generated out of the scanenable signal, which denotes scan access. In functional mode, scan-enable is always set to 0, thereby allowing the correct key to be fed to the key-gates. In test mode, where correct functionality of the circuit is not required to attain structural test coverage, scan-enable is possibly exercised by the chip user to load and unload scan chains. This sets the corrupt signal to a permanent 1 until a chip power-reset, disconnecting the secret key from the design and instead allowing the chip user to choose any dummy incorrect key to drive the key-gates. A high fault coverage can still be attained as the keys act as test points. Authentic users can also load the correct secret key, but through the test interface instead, to perform scan-assisted functional debug. Unauthentic users cannot load/unload the scan chains while the secret key drives the design, thus scan access is not helpful to them in retrieving the secret key.

Further, the DisORC defense needs to be incorporated with another layer of logic locking to ensure good output corruption, which is of utmost importance in the context of MixLock. Traditional logic locking defenses, such as RLL [START_REF] Roy | Ending piracy of integrated circuits[END_REF], FLL [START_REF] Rajendran | Fault analysis-based logic encryption[END_REF], and SLL [START_REF] Yasin | On improving the security of logic locking[END_REF], deliver such corruption, but recently, machine learning-based oracle-less attacks were proposed on these schemes, recovering the key-value from the netlist without the need of any oracle [START_REF] Chakraborty | SAIL: Machine learning guided structural analysis attack on hardware obfuscation[END_REF], [START_REF] Sisejkovic | Challenging the security of logic locking schemes in the era of deep learning: A neuroevolutionary approach[END_REF]. The underlying reason is that the key-gate type (XOR or XNOR) implies the key-value (0 or 1, respectively) even though inverter/bubble pushing transformations are performed by the synthesis tool on the netlist after inserting the key-gates. Fig. 4 illustrates these transformation operations for an XOR key-gate. A naive integration of these locking schemes with DisORC makes them susceptible to such oracle-less attacks.

DisORC is instead integrated with the TRLL defense, which thwarts oracle-less attacks. TRLL inserts key-gates or replaces existing gates (inverters) with key-gates randomly in the netlist. As shown in Fig. 5, an existing inverter in the design may be replaced by a key-gate (Figs.

G. Attack resiliency in MixLock 2.0

We assume the most demanding threat model where the attacker has access to an oracle with the correct key stored in the TPM and also possesses the netlist of the locked design.

1) Brute-force and optimization attacks: Brute-force is the most straightforward attack involving trials of random keys by simulating the design at transistor-level or layout-level, hoping to identify a key that establishes correct functionality, that is, a desired performance trade-off within the specification range. For a key with k key-bits, the search space is 2 k . Alternatively, to guide the search the attacker can use optimization such as gradient descent, simulated annealing, and GAs, hoping to converge fast to the key.

Defense. MixLock 2.0 is resilient to such attacks since: (a) it allows introducing a large key size k (e.g., k = 128 bit in our case study), resulting in a very large key space; (b) simulating all the test benches of a M-S IC at transistor-level to measure the performances can be extremely time-consuming (e.g., in the order of hours for the Σ∆ ADC case study), thus the attacker in practice can afford carrying out just a few trials; and (c) using DisORC with TRLL we achieve high functionality corruption, thus there are no, or only a very limited number, of incorrect keys that could establish approximate functionality. Essentially, the desired performance trade-off behaves as a delta function on the correct key, thus the optimization is likely to "zigzag" endlessly.

2) Attacks on logic locking: Main attacks include oraclebased attacks utilizing SAT and scan access [START_REF] Subramanyan | Evaluating the security of logic encryption algorithms[END_REF], oracle-less attacks based on netlist analysis using machine learning [START_REF] Chakraborty | SAIL: Machine learning guided structural analysis attack on hardware obfuscation[END_REF], [START_REF] Sisejkovic | Challenging the security of logic locking schemes in the era of deep learning: A neuroevolutionary approach[END_REF], and the oracle-based KC2 attack [START_REF] Shamsi | KC2: Key-condition crunching for fast sequential circuit deobfuscation[END_REF].

Defense. As discussed in Section III-F, by construction DisORC thwarts oracle-based attacks utilizing SAT and scan access and TRLL thwarts oracle-less attacks based on netlist analysis using machine learning. The KC2 attack is the only oracle-based attack that can be applied. However, it is not scalable for large circuits and, in addition, it assumes I/O access, which may not be granted in a M-S IC. The reason is that I/O nodes of the target digital sub-block for locking may be highly sensitive, e.g., high frequency nodes shared with I/O of analog sub-blocks. Adding parasitics or wire load to a high frequency node, for instance by routing it to a pad, would greatly degrade the M-S IC performance and is therefore prohibitive. We launched the KC2 attack on our case study and it did not succeed as we demonstrate in Section IV-D.

3) Removal attack: It traces the key-bits structurally and aims at removing the lock.

Defense. Removing only the DisORC component, which can be easily identified, leaves the TRLL key-gates intact in the design, thus the removal attempt is incomplete. TRLL prevents identifying the functionality of the locked digital section, thus the removal attack cannot be completed. Even if the functionality is known, removing the digital section entirely and replacing it with a re-design is not straightforward. The reason is that digital cores are closely intertwined with the analog cores and redesigning them requires knowledge about the interfaces between A/M-S and digital cores, e.g., voltage levels, data synchronization procedures, or sampling frequency ratios, that go way beyond the information published in datasheets. This level of knowledge and the fact that digital section development may take several months of work even for expert designers render a re-design attack prohibitively expensive. Therefore, an attacker is left only with the analog cores which serve for nothing without their digital counterparts.

4) Attacks proposed for biasing locking: SMT-based and GA-based attacks targeting biasing locking were discussed in detail in Section II-B.

Defense. SMT-based and GA-based attacks assume the existence of an analog obfuscated component, e.g., the mirror transistor in a current mirror. Therefore, these attacks are nonapplicable to MixLock.

5) Attack on mixed-signal locking: The attack on mixedsignal locking proposed in [START_REF] Jayasankaran | Breaking analog locking techniques[END_REF] was described in Section II-B.

Defense. This attack concerns only SFLL that corrupts the output for a handful of PIPs. The MixLock 2.0 implementation employs TRLL, for which all input patterns to the locked digital section are PIPs. Thus, finding the PIPs, which is one of the steps in the attack in [START_REF] Jayasankaran | Breaking analog locking techniques[END_REF], is not possible.

IV. HARDWARE EXPERIMENT

A. Case study

We use as case study a state-of-the-art bandpass RF Σ∆ ADC implemented in a 65 nm CMOS process [START_REF] Sayed | A 1.5-to-3.0GHz tunable RF sigma-delta ADC with a fixed set of coefficients and a programmable loop delay[END_REF]. The highlevel architecture is illustrated in Fig. 6. The ADC has a tunable center frequency f 0 from 1.5 GHz to 3 GHz and a corresponding sampling frequency f s from 6 GHz to 12 GHz, converting a band of 47 MHz and 93 MHz centered around f 0 , respectively.

The analog section of the Σ∆ ADC is a 2nd order LC bandpass Σ∆ modulator, illustrated in Fig. 7. The modulator oversamples the analog input signal and generates a highfrequency, low-resolution 1 bit digital signal at its output.

The 1 bit digital output is interfaced with the Σ∆ ADC's digital section, which consists of a digital down-conversion (DDC) mixer and a multi-stage multi-rate decimation filter, illustrated in Fig. 8. The decimation filter removes the out-ofband noise from the Σ∆ modulator output and down-samples it by a factor of 64 to the baseband. Thereby, it provides a high resolution 28 bit Nyquist rate sampled digital signal at its output. Structurally the decimation filter is composed of three subfilters. The first being a comb filter (COMB) followed by two half-band filters (HBF1 and HBF2) with down-conversion ratios of 16, 2, and 2, respectively. The DDC mixer adds a supplementary down-conversion by a factor of 2, so the total down-sampling factor is 64 • 2 = 128.

To perform the experiment we use the Σ∆ modulator of the actual chip [START_REF] Sayed | A 1.5-to-3.0GHz tunable RF sigma-delta ADC with a fixed set of coefficients and a programmable loop delay[END_REF], while the digital section is implemented on a Xilinx Kintex-7 FPGA operating at a frequency of 187.5 MHz in order to facilitate the experiment, i.e., try out different locked versions and keys. The register-transfer level (RTL) design is first synthesized using the Nangate 45 nm open source cell library so as to insert the lock at gatelevel. The locked gate-level design is then implemented in the Xilinx Kintex-7 FPGA using Xilinx's Vivado Design Suite. Fig. 9 shows the FPGA implementation's architecture. The Σ∆ modulator output bit-stream is saved into the Read-Only Memory (ROM) of the FPGA. Fetching the key, as well as the acquisition of the 28 bit decimation filter output, is achieved via a JTAG-USB interface with the control PC. A PLL generates the three different clock frequencies required for the decimation filter's sub-stages.

The goal of the case study is to lock the main performance of the Σ∆ ADC, namely its Signal-to-Noise Ratio (SNR). This is achieved via locking of the decimation filter by leveraging DisORC with TRLL. In particular, TRLL is applied to lock the first sub-filter stage of the decimation filter, i.e., the comb filter, so as to make errors spread out down in the signal processing chain. We implement a 128 bit secret key which, in contrast to the work in [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF], is not crafted to present a sufficient amount of errors but instead is chosen at random. The Σ∆ ADC has a nominal SNR of 34.8 dB with a specification set at 30 dB. Any incorrect key should break the SNR performance, rendering the Σ∆ ADC unusable.

B. Experimental setup

To allow for the generation of comparable results from hundreds of repetitions of the same experiment in which different keys are applied, we record the Σ∆ modulator chip's high-frequency output bit-stream for a defined input waveform. In particular, we use a sinusoidal input with frequency f in = f 0 + ∆f = 1.5 GHz + 300 kHz, corresponding to a sampling frequency f s of 6 GHz. We then record 524 288 samples of the output bit-stream, corresponding to 12 full input signal periods. Subsequently, to interface the Σ∆ modulator chip's output to the FPGA, we down-convert it to the baseband with the help of a DDC mixer implemented in Simulink. This downconverted bit-stream is transformed to a memory initialization file and saved in the ROM of the FPGA. In each repetition of the experiment, the ROM provides this same bit-stream to the decimation filter with embedded locking.

A single experiment to try one key takes approximately 1.2 seconds and consists of the following steps:

1) The FPGA loads a key via the USB interface and applies it to the locked decimation filter.

2) The decimation filter processes the pre-recorded output bit-stream of the Σ∆ modulator which is retrieved from the ROM memory.

3) The integrated logic analyzer acquires 4096 samples from the decimation filter's output to export them as a commaseparated values (CSV) file to the control PC via the USB connection. 4) On the control PC a Fast Fourier Transform (FFT) is performed on the captured data and the SNR is derived.

C. Results and security analysis

The security metrics proposed in Section III-C are evaluated first for 10 3 randomly generated incorrect keys. We achieve the strong analog security metrics shown in the first row of Table I. The percentage of failing keys is 100 %, that is, any random key breaks the circuit's functionality. The mean SNR of failing keys is -15.4 dB, the mean error is 45.4 dB, and the minimum error is 35.1 dB, computed as a distance from the specification of 30 dB. Fig. 10 shows the SNR performance of the Σ∆ ADC for the 10 3 incorrect keys and the correct key. The unlocked Σ∆ ADC stands out with a correct SNR of 34.8 dB. Locked versions have an SNR well below the specification of 30 dB, actually below the noise level. This shows that unless the correct key is provided, the input signal gets completely buried under the noise floor.

Given that M-S ICs allow a large margin for their performances, it is likely that there exist incorrect keys that establish correct functionality. In the MixLock 2.0 implementation, such keys will have a small HD from the actual secret key. To approximate the space of such keys, we evaluate incorrect keys starting with HD=1 and increasing the HD until a value for which all keys fail. For HD=1, we evaluated all 128 keys, whereas for HD>1, we evaluated 10 3 randomly generated keys. As shown in Table I, for HD=1 74.42% of the keys fail. The percentage of failing keys increases with HD and beyond HD=7 all keys fail. We can estimate the number of passing incorrect keys as n=6 i=1 1 -wi 100 • 128 i , where w i is the percentage of failing keys for HD= i and n is the highest HD showing passing keys. This number equals approximately 10 20 , thus the nominal key width of 128 bit is reduced to 108 effective bits, still a very strong analog security level.

Table I also provides the security metrics for the MixLock 1.0 implementation that employs SFLL. By construction of the SFLL lock mechanism, for any incorrect key having HD > 1 from the correct key, every query of the circuit with the same input waveform leads to the same errors and, thereby, the SNR performance degrades by the same amount. As it can be seen from Table I, the MixLock 2.0 implementation results in higher functionality corruption for random incorrect keys, as shown by the larger mean and minimum SNR error. Finally, Fig. 11 illustrates the transient and frequency responses recorded at the Σ∆ ADC's output, where a random incorrect key leads to important levels of distortion in the time domain, while in the frequency domain this distortion is visible in the form of an important increase in the noise level.

D. Attacks on logic locking

The decimation filter is a sequential design with 30K gates and scan testing is a highly desirable feature. As explained in Section III-G, by construction DisORC with TRLL thwarts all attacks except the KC2 attack. The KC2 attack requires access to the I/O of the digital section of the Σ∆ ADC which, however, is not provided in a full ASIC implementation. This is because the input of the digital section is also the highfrequency Σ∆ modulator's output. Routing this node to a pad would greatly degrade the Σ∆ ADC's performance and is therefore prohibitive. Nevertheless, we set up the KC2 attack to evaluate its capability. Even when granting KC2 50 GB of memory and 48 h of runtime it fails to recover a functional key for the locked Σ∆ ADC.

E. Implementation costs

Table II presents the overheads that MixLock 2.0 induces with regard to the nominal Σ∆ ADC design. Overheads are reported for an ASIC implementation of the Σ∆ ADC and thus also an ASIC implementation of the decimation filter, synthesized using the Nangate 45 nm library. On the left hand side the overheads with respect to only the Σ∆ ADC's digital section are given, on the right hand side the overheads are projected to the entire Σ∆ ADC considering that the digital section occupies about 30% of the die area and is responsible for about 30% of the total power consumption. The slack reserve in the critical path of the digital section is large enough to accommodate the additional key-gates; thus, the added delay gets easily absorbed and does not translate to an SNR performance penalty. The unlocked Σ∆ ADC has an SNR of 34.8 dB, that is, there is no performance degradation due to locking. The area and power overheads of 10.7% and 21.3% for the digital section translate to area and power overheads of 3.6% and 7.1% for the complete Σ∆ ADC, which are very reasonable.

V. AUDIO DEMONSTRATOR

A. Demonstrator configuration and setup

To understand the impact of locking on real-world analog signals, we use an audio demonstrator originally presented in [START_REF] Leonhard | Mixed-signal hardware security using MixLock: Demonstration in an audio application[END_REF]. Herein, we show results obtained using the MixLock 2.0 implementation, while results obtained using the MixLock 1.0 implementation are provided in [START_REF] Leonhard | Mixed-signal hardware security using MixLock: Demonstration in an audio application[END_REF]. A high-level description of the audio demonstrator is illustrated in Fig. 12. In a first step we use Matlab to read in an audio waveform, either from an existing audio file or by recording it with a microphone via the function audioread. The audio is upsampled using linear interpolation between its data-points so as to provide enough data samples for the subsequent second digitization by the oversampling Σ∆ ADC. The Σ∆ ADC's output is written to the hard-disk as an audio file using the audiowrite function to then be played back through the PC's speakers. The Σ∆ modulator in this demonstrator is a system-level model of a second-order low-pass continuous-time Σ∆ modulator. The modulator is modeled and simulated in Simulink, while the decimation filter is modeled in RTL and is simulated in Modelsim.

Our experiment involves processing the audio samples listed in the first column of Table III through the system in Fig. 12 and examining the effect of locking on the audio quality. Audio samples include a speech recording in English and professional music recordings of various genres. Similar to Section IV, TRLL is applied to the comb filter of the decimation filter with a 128 bit key. All audio samples are evaluated using the correct key and four incorrect keys with HDs of 4, 8, 12 and 63 with respect to the correct key. While the first three incorrect keys are favorably chosen for the attacker, the latter key with a HD of 63 corresponds to a random key.

Herein, the SNR metric cannot be used for quantifying analog security as it was used in Section IV. The reason is that SNR requires a sinusoidal input, while audio signals are time-varying in nature; their spectral contents vary with time and they are rich in frequencies. For this purpose, we use Root-Mean-Square Error (RMSE) calculated over the complete duration of the audio file as metric to evaluate the error between two waveforms processed by an unlocked and a locked Σ∆ ADC for the same input.

While RMSE allows to quantify the error in the processed audio samples, it does not allow us to understand in what kind of way an audio sample is impacted, i.e., two RMSE values with similar magnitude may be derived from erroneous audio samples that sound differently. Even so, unless the secret key is applied to the Σ∆ ADC, locking introduces errors that get translated into audible glitches or noise that deteriorate the output signal, which can be measured via the RMSE metric.

B. Demonstrator results

The reader can download and listen to the output audio samples via this link: https://nuage.lip6.fr/s/j6F54tWqHgsdBGL. The downloadable archive includes the output audio samples listed in Table III for an unlocked design when the valid key is applied, as well as for a locked design using TRLL when incorrect keys with HDs 4, 8, 12 and 63 from the correct key are applied. The archive also includes the output audio samples using the methods SFLL and 1.5xSFLL [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF]. The fourth to last columns of Table III show the RMSE of the audio samples for the locked designs using TRLL, whereas for the correct key the RMSE metric is constantly zero.

TRLL leads to a corruption of the audio output in a way that is comparable to white noise. The higher the provided key's HD from the correct key is, the greater the impact of the corruption is. 1.5xSFLL also corrupts the audio quality dramatically distorting the recording with very frequent glitches. SFLL on the other hand results in a number of glitches for the music recordings that can be heard as single, loud "cracks". However, for the self-made voice recording, no glitches are noticed. Furthermore, given that the locations where TRLL modifies the comb filter's gate-level netlist are chosen randomly, the errors that are induced due to an incorrect key are not restricted to the MSB or MSB-1 such as was the case for both SFLL variants. Errors in fact appear anywhere in the comb filter circuit, thereby inciting faults of reduced scale, albeit in very elevated numbers. While both SFLL and 1.5xSFLL are independent of the user provided key, for TRLL we observe a dependence of the RMSE metric on the key. The closer a key is to being correct, the fewer errors are induced, as shown in Table III. Fig. 13 visualizes the effect of locking using TRLL in a transient waveform on the example of a short sequence of Beethoven's Symphony No. 9. While still roughly following the correct waveform, the locked waveform is erroneous in practically every single sample point. The listener perceives these errors as dominant and disturbing white noise overlaying the distantly recognizable remains of the original waveform.

At this point it is important to recall the objective of hardware locking and hardware obfuscation in general. The aim is not necessarily to encrypt the data that is processed by the hardware, i.e., corrupt audio quality to bare random noise. The aim is to render the hardware low-quality and unusable unless the valid secret key is known; e.g., glitches occurring at regular and frequent intervals are sufficient.

VI. MixLock COMPARISON TO OTHER A/M-S IC LOCKING

TECHNIQUES

Table IV compares the existing A/M-S IC locking techniques based on different criteria, namely applicability, overhead (i.e., performance, area, and power penalties), design complexity, attack resilience, and protection against cloning. All techniques are effective against other types of counterfeiting, thus for brevity these threats are not included in Table IV.

Biasing locking is the most general technique that applies also to purely analog blocks. Calibration locking requires the existence of a calibration mechanism that acts on tuning knobs judiciously inserted into the design. The technique in [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] is the most general since most on-chip calibration schemes comprise a digital processor. The technique in [START_REF] Elshamy | Securing programmable analog ICs against piracy[END_REF] is the most powerful but assumes high programmability and the offchip calibration algorithm must be complex enough such that it cannot be devised by the attacker. AFGTs are not often used for calibration, but the technique in [START_REF] Rao Nimmalapudi | Range-controlled floating-gate transistors: A unified solution for unlocking and calibrating analog ICs[END_REF] opens a new application domain. MixLock is generally applicable to any M-S IC, including data converters, PLLs, and RF transceivers, as discussed in Section III-A.

In terms of area overhead, biasing locking techniques based on biasing circuit expansion [START_REF] Rao | Protecting analog circuits with parameter biasing obfuscation[END_REF]- [START_REF] Rao | Mesh based obfuscation of analog circuit properties[END_REF] feature low area overhead, while memristor-based [START_REF] Hoe | Towards secure analog designs: A secure sense amplifier using memristors[END_REF] and neural network-based [START_REF] Volanis | Analog performance locking through neural network-based biasing[END_REF] biasing require large on-chip resources. In [START_REF] Rao | Protecting analog circuits with parameter biasing obfuscation[END_REF], a 6% area overhead is reported when applying biasing locking to a PLL based on transistor width obfuscation. M-S locking techniques that leverage logic locking, i.e., [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] and MixLock, also result in justifiable area overhead. MixLock applied to a Σ∆ ADC results in 6.7% and 8.1% area overhead respectively when using as the underlying logic locking technique SFLL and 1.5xSFLL [START_REF] Leonhard | MixLock: Securing mixed-signal circuits via logic locking[END_REF], while when using DisORC with TRLL the area overhead is 3.6% as shown in Table II. In [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF], the reported area overheads by locking the digital optimizer in the calibration loop for different case studies including a bandpass filter, low noise amplifier, and low-dropout regulator, are in the range of 2.6% to 8.8%. The extra on-chip resources Memristor crossbar [START_REF] Hoe | Towards secure analog designs: A secure sense amplifier using memristors[END_REF] memristor technology high high X

On-chip neural network [START_REF] Volanis | Analog performance locking through neural network-based biasing[END_REF] general high high X

Calibration locking

Calibration loop logic locking [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] tuning knobs low low on-chip digital calibration loop Highly-digitized A/M-S ICs [START_REF] Elshamy | Securing programmable analog ICs against piracy[END_REF] tuning knobs no no complex off-chip calibration algorithm Limiting tuning range of AFGTs [START_REF] Rao Nimmalapudi | Range-controlled floating-gate transistors: A unified solution for unlocking and calibrating analog ICs[END_REF] AFGT-based programming low low X X

MixLock (this work) mixed-signal low low

Compound locking [START_REF] Juretus | Securing analog mixedsignal integrated circuits through shared dependencies[END_REF] mixed-signal medium low for locking the tuning range of AFGTs should also present a small area overhead, although it is not reported in [START_REF] Rao Nimmalapudi | Range-controlled floating-gate transistors: A unified solution for unlocking and calibrating analog ICs[END_REF]. Using the actual programmability fabric to enable locking has zero overhead [START_REF] Elshamy | Securing programmable analog ICs against piracy[END_REF].

In terms of power overhead, biasing locking based on biasing circuit expansion [START_REF] Rao | Protecting analog circuits with parameter biasing obfuscation[END_REF]- [START_REF] Rao | Mesh based obfuscation of analog circuit properties[END_REF] seems to provide the lowest power overhead. In [START_REF] Rao | Protecting analog circuits with parameter biasing obfuscation[END_REF], a 1% power overhead is reported when applying biasing locking to a PLL based on transistor width obfuscation. For the calibration locking techniques in [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF], [START_REF] Rao Nimmalapudi | Range-controlled floating-gate transistors: A unified solution for unlocking and calibrating analog ICs[END_REF] that use an on-chip calibration scheme, power overhead does not apply as the calibration scheme is only active at startup. For the calibration locking technique in [START_REF] Elshamy | Securing programmable analog ICs against piracy[END_REF], there is no lock, thus there is no extra power consumption. MixLock offers justifiable power overhead. When applied to a Σ∆ ADC, MixLock results in 9.8% and 11.8% power overhead respectively when using SFLL and 1.5xSFLL, while when using DisORC with TRLL the power overhead is 7.1% as shown in Table II.

In terms of performance penalty, the effect of locking on the performance of the biasing circuit itself, e.g., accuracy, temperature stability, bandwidth, input/output compliance voltage, and input/output resistance, has not been adequately addressed so far. A small performance degradation is reported in [START_REF] Rao | Protecting analog circuits with parameter biasing obfuscation[END_REF] when applying transistor width obfuscation in a PLL. Certainly, memristor-based [START_REF] Hoe | Towards secure analog designs: A secure sense amplifier using memristors[END_REF] and neural network-based [START_REF] Volanis | Analog performance locking through neural network-based biasing[END_REF] biasing can be problematic in this regard. Calibration locking and MixLock do not incur any performance penalty.

The design complexity of the locking mechanism is considered to be acceptable by the designer for all techniques apart from memristor-based [START_REF] Hoe | Towards secure analog designs: A secure sense amplifier using memristors[END_REF] and neural network-based [START_REF] Volanis | Analog performance locking through neural network-based biasing[END_REF] biasing locking. The calibration locking technique in [START_REF] Elshamy | Securing programmable analog ICs against piracy[END_REF] does not require any extra design effort. Logic locking is automated, thus M-S locking, i.e., [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] and MixLock, is automated.

As explained in Section II-B, there are specific attacks developed for biasing locking. For M-S locking, i.e., [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] and MixLock, we assume that state-of-the-art logic locking is used that is resilient to all known counter-attacks on logic locking. We assume also that the locked digital sections cannot be easily re-designed by an attacker, thus MixLock thwarts cloning. While MixLock obfuscates the actual core of the circuit, calibration locking [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] leaves the core circuit unprotected but obfuscates its tuning capability instead. We believe that the latter technique is sufficient to thwart cloning and not just overproduction as motivated in [START_REF] Jayasankaran | Towards provably-secure analog and mixed-signal locking against overproduction[END_REF] since without tuning capability the circuit has a degraded performance trade-off, which renders it unusable. The calibration locking technique based on limiting the tuning range of AFGTs [START_REF] Rao Nimmalapudi | Range-controlled floating-gate transistors: A unified solution for unlocking and calibrating analog ICs[END_REF] is vulnerable to a lock removal attack. Thus, this technique cannot serve as a strong countermeasure against cloning.

The compound locking technique proposed in [START_REF] Juretus | Securing analog mixedsignal integrated circuits through shared dependencies[END_REF] employs MixLock for the digital section and biasing locking for the analog section. It is generally applicable to any M-S IC. However, using two locking schemes increases the area and power overhead. It inherits the security level offered by MixLock and, interestingly, it can resist a biasing locking attack if the two locks share key-bits. The reason is that a biasing locking attack may extract a valid key that correctly sets the bias point, yet this valid key is likely not the same as the actual secret key. Thus, applying the extracted shared key-bits of the valid key for the analog section to the locked digital section is unlikely to correctly unlock the digital section and will mislead any logic locking attack. In short, from a circuit locked via the compound technique in [START_REF] Juretus | Securing analog mixedsignal integrated circuits through shared dependencies[END_REF] a functional analog section can still be recovered, however unlocking the design as a whole becomes more challenging.

VII. CONCLUSIONS

We proposed MixLock, a generic, digitally-assisted security method for M-S ICs protecting against piracy. MixLock leverages logic locking of digital blocks in the signal path to lock M-S performances at system-level. The MixLock protection is resilient against all known attacks in both the analog and digital domain. It only acts on the digital blocks leaving analog blocks intact. This has important implications, i.e., the analog design flow is left unchanged, the locking method is automated and applied only once the design is finalized without requiring any analog design re-iteration, the locking incurs no M-S performance penalty, and area and power overheads due to locking are low and justifiable. These properties are key for the wide adoption of MixLock by analog designers. In our current MixLock implementation we use the state-of-the-art DisORC with TRLL logic locking method. We demonstrated MixLock on a Σ∆ ADC using hardware measurements and an audio demonstrator.

Fig. 1 :

 1 Fig. 1: Standard locking flow.

Fig. 2 :

 2 Fig. 2: MixLock high-level architecture.

Fig. 3 :

 3 Fig. 3: DisORC defense architecture.

Fig. 4 :

 4 Fig. 4: RLL using XOR key-gate.

Fig. 5 :

 5 Fig. 5: TRLL application on logic gates.

  5(a)-(c)) or a key-gate may be inserted to a design (Figs. 5(d)-(f)), negating the keyvalue polarity. Without knowing the original gate structure, the attacker cannot differentiate the designs in Figs. 5(b) and 5(f) and the designs in Figs. 5(c) and 5(e), thereby failing to identify the correct key-value. As these decisions are made randomly by TRLL, the attacker has no way of knowing or learning the key-value from the key-gate type or gate structures surrounding the key-gates.

Fig. 6 :Fig. 7 :

 67 Fig. 6: Architecture of the RF Σ∆ ADC.

Fig. 8 :Fig. 9 :

 89 Fig. 8: Architecture of the decimation filter of the Σ∆ ADC.

Fig. 10 :

 10 Fig. 10: SNR of the Σ∆ ADC for 10 3 random keys. The cross corresponds to the SNR of the unlocked Σ∆ ADC.

Fig. 11 :

 11 Fig. 11: Measured output of the locked Σ∆ ADC with the top plot showing a zoom of the output in the time domain and the bottom plot showing the Power Spectral Density (PSD).

Fig. 12 :

 12 Fig. 12: Block diagram of the audio demonstrator for MixLock.

Fig. 13 :

 13 Fig. 13: A short sequence of Beethoven's Symphony No. 9 shown as transient waveform processed by an unlocked and a locked Σ∆ ADC.

TABLE I :

 I Analog security metrics for invalid keys with different HD from the correct key computed with respect to the SNR specification.

	MixLock 2.0
	Hamming	Percentage	Mean error	Minimum error
	Distance	of failing keys
	random	100%		45.4 dB	32.4 dB
	1		74.42%	14.6 dB	0.2 dB
	2		93.92%	18.6 dB	0.2 dB
	3		98.30%	21.8 dB	0.4 dB
	4		99.60%	24.2 dB	0.4 dB
	5		99.90%	25.8 dB	1.0 dB
	6		99.98%	28.0 dB	2.0 dB
	7		100%		29.5 dB	2.3 dB
	MixLock 1.0
	any ≥ 1	100%		22.3 dB	22.3 dB
		40
	SNR [dB]	0 20
		0 -20	200	400	600	800	1000
				Key index

TABLE II :

 II MixLock 2.0 overheads.

	Decimation filter	Overhead	Σ∆ ADC	Overhead
	Area [%]	10.7	Area [%]	3.6
	Power [%]	21.3	Power [%]	7.1
	Delay [%]	13.4	Performance [%]	0.0

TABLE III :

 III Audio samples and impact of locking with MixLock 2.0 on audio quality measured in RMSE between the nominal waveform and the respective waveform of the locked Σ∆ ADC.

	Audio sample	Duration	Sample Rate		RMSE using DisORC with TRLL
		[s]	[Hz]	HD=4	HD=8	HD=12	HD=63
	English voice recording	4	8192	0.184	0.530	0.341	0.379
	Bob Marley -No Woman No Cry	15	16384	0.035	0.058	0.184	0.354
	Benny Goodman -Bugle Call Rag	15	16384	0.024	0.041	0.156	0.333
	Kenny Ball -I Wanna Be Like You	15	16384	0.025	0.043	0.167	0.335
	John Coltrane -Nature Boy	15	16384	0.026	0.044	0.161	0.349
	Beethoven -Symphony No. 9	15	16384	0.024	0.041	0.177	0.298

TABLE IV :

 IV Comparison of different A/M-S IC locking techniques.

		Applicability	Overhead	Design	Attack	Anti-Cloning
				complexity	resilience
	Biasing locking
	Transistor width obfuscation [8]	general	low	low	X
	Current mirror locking [9]	general	low	low	X
	Mesh transistor obfuscation [10]	general	low	low	X