When encrypting IP that contains multiple sub-modules, the best practice is to encrypt at the highest level possible as in cases where multiple modules are independently encrypted there can be an impact on the design QoR as logic optimization between independently encrypted modules can be limited for security reasons.
For QoR that most closely matches the plain-text design, applying encryption to the highest-level module as shown in the following figure, Case 3 would be preferred. If sub-modules of the design are encrypted independently, as illustrated in the figure, Case 1 or Case 2, there could be an impact to the design QoR, as optimizations between the encrypted sub-modules do not occur.
Figure 1. IP Packaging and Usage Flow
