Chip physical protection circuit and method

Abstract

The present invention discloses a chip physical protection circuit and method, wherein N shift registers in the circuit form a series structure; the Q end of each shift register is connected to an inverter and a top metal mesh line; the input of each XOR gate is connected to the output of the inverter and the output of a top metal mesh line, and the output of the XOR gate is connected to the input of the AND gate; the input of each XOR gate is connected to the output of a top metal mesh line, the output of the inverter and the key working signal of the chip; and the AND gate ANDs the outputs of the N XOR gates and then inputs the D end of the total latch. The present invention performs XOR on the top metal mesh line of the same level and the inverse of its input signal to prevent attackers from performing circuit repair at the input end of each XOR gate, resulting in detection failure; each level of the top metal mesh line and its input signal inverse perform XOR-N operations with the chip internal working signal to prevent illegal theft of normal data.

Description

Technical Field

[0001] The present invention belongs to the field of electronic circuits, and in particular relates to a chip physical protection circuit and method. Background Art

[0002] With the increasing use of electronic products related to personal information, the security design technology of chips that store personal information, privacy, passwords, etc. has gradually received attention. Since the data storage in the chip must rely on the internal physical medium, some physical attack techniques against these chip storage media have gradually been mastered by some illegal attackers, which has seriously challenged the security of the chip.

[0003] Currently, an effective attack method is invasive attack: the attacker uses methods and technologies such as laser technology or focused ion beam (FIB: Focused Ion Beam) to expose the internal signals of the chip to the surface, and uses probe technology to guide the signal to the receiving device. The attacker can then read the internal confidential information or inject modified data into the chip.

[0004] In order to prevent the above-mentioned physical attacks, chip design manufacturers have proposed the concept of layout protection circuit, that is, adding a layer of protective metal (Shield) and related layout protection circuit on the layout metal level of the effective circuit. The signal line of the protective layer is continuously monitored. Once the signal is destroyed, the chip will automatically turn on the alarm circuit and implement circuit self-destruction to prevent illegal manipulation of data.

[0005] Figure 1 The figure shows a commonly used layout protection circuit structure. Taking the structure of 8 top-level metal mesh lines 15 as an example, the data is output through the Q terminals of 8 latches 1. If a top-level metal mesh line 15 is damaged, the latch XOR gate 2 on the corresponding path of the mesh line will output "1". After passing through the OR gate 3, the D and Q terminals of the check bit register 4 will show a "1" signal. Designers often use the Q signal of the check bit register 4 to reset the chip to protect the internal information from being illegally stolen.

[0006] Due to the development of chip reverse engineering technology, as well as the further improvement and update of attack methods and techniques, physical attack techniques against security chips are gradually being mastered by illegal attackers, which poses a serious challenge to the security of this type of layout protection circuit. Figure 1 With this kind of layout protection circuit structure, after analyzing the circuit structure clearly, the attacker can use advanced laser technology or FIB technology to repair the circuit in real time, causing the layout protection circuit to lose its protection function. After that, the attacker can manipulate the internal signals of the chip as he pleases. Figure 1As for the layout protection circuit shown, as long as the attacker uses advanced FIB technology to fix the D or Q end of the check bit register 4 to "0", he can arbitrarily damage the top metal mesh line 15 without affecting the final result of the check bit of the layout protection circuit. Summary of the invention

[0007] In view of the above technical problems, the present invention provides a physical protection suitable for chips, which prevents illegal attackers from using simple FIB technology to destroy chips at a low cost, thereby achieving real protection against physical attacks on chips.

[0008] The following technical solutions are adopted:

[0009] A chip physical protection unit includes N shift registers, N inverters, N XOR gates, N XNOR gates, M AND gates and a total latch, wherein:

[0010] The Q end of the previous shift register is connected to the D end of the next shift register, and N shift registers form a series structure, and the D end of the first shift register inputs data; the Q end of each shift register is connected to an inverter and a top-level metal mesh line; the input of each XOR gate is connected to the output of the inverter and the output of a top-level metal mesh line, and the output of the XOR gate is connected to the input of the AND gate; the input of each XOR gate is connected to the output of a top-level metal mesh line, the output of the inverter and the key working signal of the chip, denoted as Ksig_i[i], i=0~N-1, and the output of the XOR gate is denoted as Ksig_o[i], i=0~N-1; the AND gate ANDs the outputs of the N XOR gates and inputs them into the D end of the total latch, denoted as Check_D, and the Q end of the total latch is denoted as Check_Q.

[0011] Preferably, top-level metal mesh lines input into different XOR gates are at different levels of circuits.

[0012] Preferably, the top metal mesh wires are arranged in a disordered manner.

[0013] Preferably, the output of the AND gate and the D terminal of the master latch are connected using bottom metal wiring.

[0014] Preferably, the input and output metal connections of the XOR gate are both bottom-layer metal connections.

[0015] Preferably, when the top metal mesh line works normally, Check_D is "1" and Check_Q is "1"; when the top metal mesh line is abnormal, Check_D is "0" and Check_Q is "0".

[0016] Based on the above purpose, the present invention also provides a chip physical protection method, which uses the above chip physical protection circuit and includes the following steps:

[0017] S10, the MCU core of the chip generates an N-bit random number as the D-end input of the first shift latch, and the key working signal Ksig_i[i] of the chip is input into the XOR gate;

[0018] S20, after several clocks, read the output Ksig_o[i] of the XOR gate;

[0019] S30, Ksig_i[i]==Ksig_o[i]?

[0020] S40: No, the chip is damaged and exception processing is performed;

[0021] S31, yes, then determine Check_D=1, Check_Q=1? ;

[0022] S32, if yes, it is determined that the chip is working normally; if no, the chip is damaged and abnormal processing is performed.

[0023] Preferably, the top metal mesh wires are arranged in a disordered manner.

[0024] Preferably, the abnormal processing is automatic chip resetting.

[0025] Preferably, the abnormal processing is automatic destruction of the chip.

[0026] The present invention has the following beneficial effects: greatly increasing the physical protection capability. First, the top metal mesh wires of the same level are XOR-compared with the inverse of their input signals to prevent attackers from performing circuit repair at the input end of each XOR gate, resulting in detection failure; second, each level of top metal mesh wires and the inverse of their input signals are XOR-N operations with a key working signal inside the chip at the same time, which will cause the chip to work abnormally when subjected to illegal attacks, thus preventing normal data from being illegally stolen; third, the top metal mesh wires are wired in disorder, increasing the difficulty of locating and operating the FIB and laser repair circuits; fourth, the bottom metal wires are used for the devices connected to the input and output of the total latch; through the above processing, illegal attackers can not only modify one or two circuits when using FIB and laser technology to repair the circuit to carry out physical attacks, but also abolish the layout circuit protection function. If at the level of 32 top metal mesh wires, the attacker needs to perform at least 64 successful FIB operations of 32 connections to obtain the operation space of part of the layout area, this requirement greatly increases the difficulty and cost of the attacker's operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a structural diagram of a chip protection circuit in the prior art;

[0028] Figure 2A chip physical protection circuit structure diagram of an embodiment of the present invention;

[0029] Figure 3 The figure is a flowchart of the chip physical protection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] Protection circuit embodiment

[0032] See also Figure 2 A chip physical protection circuit, taking the protection circuit of 8 top metal mesh lines 15 as an example, includes 8 shift registers 11, 8 inverters 12, 8 XOR gates 13, 8 XNOR gates 14, 3 AND gates 16 and a total latch 17, wherein,

[0033] The Q end of the previous shift register 11 is connected to the D end of the next shift register 11, and the N shift registers 11 form a series structure, and the D end of the first shift register 11 inputs data; the Q end of each shift register 11 is connected to an inverter 12 and a top metal mesh line 15; the input of each XOR gate 13 is connected to the output of the inverter 12 and the output of a top metal mesh line 15, and the output of the XOR gate 13 is connected to the input of the AND gate 16; the input of each XOR gate 14 is connected to the output of a top metal mesh line 15, the output of the inverter 12 and the key working signal of the chip, which is recorded as Ksig_i[i], i=0~N-1, and the output of the XOR gate 14 is recorded as Ksig_o[i], i=0~N-1; the AND gate 16 ANDs the outputs of the N XOR gates 13 and inputs them to the D end of the total latch 17, which is recorded as Check_D, and the Q end of the total latch 17 is recorded as Check_Q.

[0034] Through the above settings, the shift register 11 is used to shift the input data and generate a continuously changing monitoring signal. The top metal mesh wire 15 output of the same level circuit is XOR-compared with the inverse of its input signal, and the outputs of the XOR gates 13 of different levels of circuits are ANDed to generate the check bit register signal output by the total latch 17 of the monitoring signal, so as to prevent the input end of each XOR gate 13 from being patched by an illegal attacker, resulting in detection failure. The top metal mesh wire 15 output of each level of circuit is XOR-N-compared with the inverse of its input signal and a key working signal inside the chip, so that when it is attacked illegally, the chip will work abnormally to prevent illegal theft of normal data.

[0035] In a specific embodiment, the top metal mesh lines 15 input to different XOR gates 13 are at different levels of circuits.

[0036] The top metal mesh wire 15 is a random wiring. The key working signal of the chip is the data transmission signal or state transfer signal in the chip.

[0037] The output of AND gate 16 and the D terminal of total latch 17 are connected by bottom metal wires; the input and output metal wires of XOR gate 14 are both connected by bottom metal wires. Using bottom metal wires can prevent illegal attackers from easily modifying circuit functions by using circuit repair technologies such as FIB and laser technology.

[0038] When the top metal mesh cable 15 works normally, Check_D is "1" and Check_Q is "1"; when the top metal mesh cable 15 is abnormal, Check_D is "0" and Check_Q is "0".

[0039] The XOR gate 14 connects the output of a top metal mesh line 15, the output of the inverter 12 and the key working signal of the chip, and introduces the output of a top metal mesh line 15 and the output of the inverter 12 into the key signal path of the chip.

[0040] Method Embodiment

[0041] See also Figure 3 A chip physical protection method, using the above chip physical protection circuit, includes the following steps:

[0042] S10, the MCU core of the chip generates an N-bit random number as the D-end input of the first shift latch, and the key working signal Ksig_i[i] of the chip is input into the XOR gate;

[0043] S20, after several clocks, read the output Ksig_o[i] of the XOR gate;

[0044] S30, Ksig_i[i]==Ksig_o[i]?

[0045] S40: No, the chip is damaged and exception processing is performed;

[0046] S31, yes, then determine Check_D=1, Check_Q=1? ;

[0047] S32, if yes, it is determined that the chip is working normally; if no, the chip is damaged and abnormal processing is performed.

[0048] Double insurance is provided by double determining whether the chip has been attacked.

[0049] In a specific embodiment, the top metal mesh wires are wired in a disordered manner.

[0050] The abnormal processing in S40 is automatic chip reset or automatic chip damage.

[0051] The above embodiment uses 8 top-level metal mesh wires as a specific embodiment, which can be simply extended to 32 or 64 top-level metal mesh wires by analogy. When using 32 top-level metal mesh wires or more, and using FIB and other chip repair technologies to perform simple top-level metal repair, the attacker needs to perform at least 64 successful FIB operations of 32 connections to obtain the operating space of part of the layout area. Based on the positioning accuracy and operation time of FIB, the success rate of circuit repair without the layout protection function is already very low. Therefore, this physical protection method greatly increases the difficulty and cost of the attacker's operation.

[0052] It should be understood that the exemplary embodiments described herein are illustrative rather than restrictive. Although one or more embodiments of the present invention have been described in conjunction with the accompanying drawings, it should be understood by those skilled in the art that various changes in form and detail may be made without departing from the spirit and scope of the present invention as defined by the appended claims.

Claims

1. A chip physical protection circuit, characterized in that: It includes N shift registers, N inverters, N XOR gates, N XNOR gates, M AND gates and a total latch, where: The Q end of the previous shift register is connected to the D end of the next shift register, and N shift registers form a series structure, and the D end of the first shift register inputs data; the Q end of each shift register is connected to an inverter and a top-level metal mesh line; the input of each XOR gate is connected to the output of the inverter and the output of a top-level metal mesh line, and the output of the XOR gate is connected to the input of the AND gate; the input of each XOR gate is connected to the output of a top-level metal mesh line, the output of the inverter and the key working signal of the chip, denoted as Ksig_i[i], i=0~N-1, and the output of the XOR gate is denoted as Ksig_o[i], i=0~N-1; the AND gate ANDs the outputs of the N XOR gates and inputs them into the D end of the total latch, denoted as Check_D, and the Q end of the total latch is denoted as Check_Q.

2. A chip physical protection circuit according to claim 1, characterized in that: The top metal mesh wires inputting different XOR gates are at different levels of the circuit.

3. A chip physical protection circuit according to claim 1, characterized in that: The top metal mesh wires are arranged in a disordered manner.

4. A chip physical protection circuit according to claim 1, characterized in that: The output of the AND gate is connected to the D terminal of the master latch by using bottom metal wiring.

5. A chip physical protection circuit according to claim 1, characterized in that: The input and output metal connections of the XOR gate are both bottom metal connections.

6. A chip physical protection circuit according to claim 1, characterized in that: When the top metal mesh cable works normally, Check_D is "1" and Check_Q is "1".

7. A chip physical protection method, using the chip physical protection circuit according to any one of claims 1 to 6, characterized in that: The following steps are involved: S10, the MCU core of the chip generates an N-bit random number as the D-end input of the first shift latch, and the key working signal Ksig_i[i] of the chip is input into the XOR gate; S20, after several clocks, read the output Ksig_o[i] of the XOR gate; S30, determine whether Ksig_i[i]= Ksig_o[i]; S40: No, the chip is damaged and exception processing is performed; S31, if yes, then further determine whether Check_D=1, Check_Q=1; S32, if yes, it is determined that the chip is working normally; if no, the chip is damaged and abnormal processing is performed.

8. A chip physical protection method according to claim 7, characterized in that: The top metal mesh wires are wired in a disordered manner.

9. A chip physical protection method according to claim 7, characterized in that: The abnormal processing is automatic chip reset.

10. A chip physical protection method according to claim 7, characterized in that: The abnormal processing is that the chip is automatically destroyed.

Images