Physical unclonable function device and method

Abstract

Embodiments of the present disclosure relate to physically unclonable function devices and methods. One embodiment system includes a physically unclonable function device, wherein the device includes a first component of non-volatile memory cells each having a select transistor embedded in a semiconductor substrate and a depletion mode state transistor having a control gate and a floating gate electrically connected, the state transistor having a respective effective threshold voltage belonging to a common random distribution; and processing circuitry configured to transmit an output data set to an output interface of the device based on a reading of the effective threshold voltage of the state transistor of the memory cells of the first component.

Description

[0001] Cross-reference to related applications

[0002] This application claims the benefit of French application No. 2002929, filed on March 25, 2020, the contents of which are incorporated herein by reference in their entirety. Technical Field

[0003] The embodiments, devices, and methods relate to physically unclonable functions (PUFs), and more particularly to physically unclonable functions performed within an integrated circuit. Background Technology

[0004] Physically unclonable functions automatically generate unique, unpredictable codes based on the random or partially random physical properties of the function. These physical properties can be caused by variations during the creation of the physically unclonable function.

[0005] Therefore, cloning this function is extremely difficult, if not impossible.

[0006] Furthermore, the content of the generated code is unique because it differs from one physically unclonable function to another, cannot be predicted, and can, for example, depend on the specific configuration of the components during function activation. Thus, for example, physically unclonable functions can be generated by non-volatile memory whose content during activation depends on some random physical characteristics of the memory; these manufacturing variations cause different physical characteristics in different memories. Summary of the Invention

[0007] On the one hand, physically unclonable functions need to be robust enough to remain unchanged after repeated use and under temperature variations, especially over time.

[0008] On the other hand, random variations in physical properties need to be easily identifiable in order to clearly distinguish different data.

[0009] Furthermore, embodiments requiring physically unclonable functionality require few or no dedicated manufacturing steps.

[0010] Unique unpredictable codes typically consist of a series of random data and are primarily used as encryption keys. This data is usually kept secret.

[0011] For example, random access or non-volatile memory, even a ring oscillator, or even specific logic circuitry can be used to generate physically unclonable functions.

[0012] However, in some cases, these prior art devices may be more or less detectable within integrated circuits, or not particularly robust to temperature changes or aging, or even sensitive to attacks via fault implantation, or even have a punitive surface footprint.

[0013] Therefore, there is a need for physically non-clonable functional structures that are robust to external changes and / or aging, whose data can be clearly identified upon reading and are difficult to extract by third-party attacks. It will also be advantageous if the structures are easily manufactured using existing technologies and have a non-punitive surface footprint.

[0014] According to one aspect, a system is proposed comprising a physically unclonable functional device, the device comprising:

[0015] - A first component of a non-volatile memory cell, each having a selection transistor embedded in a semiconductor substrate and a depletion-type state transistor having an electrically connected control gate and a floating gate, the state transistor having a corresponding effective threshold voltage belonging to a common random distribution; and

[0016] - The processing circuit is configured to transmit output data sets to the output interface of the device based on reading the effective threshold voltage of the state transistor of the memory cell of the first component.

[0017] The output data is typically a unique, unpredictable code formed from a series of random data, which can be advantageously used as an encryption / decryption key.

[0018] This non-volatile memory cell with an embedded selection transistor has a particularly compact structure. It has been described in detail in patent application US2013 / 0228846.

[0019] However, in this case, compared to conventional cells, the state transistors of the memory cells in the first component are depletion-type and have electrically connected control gates and floating gates.

[0020] These features are particularly advantageous because the memory cell of the first component can then be read by applying zero voltage to the control gate (e.g., by connecting the control gate to ground), since the state transistor is typically on.

[0021] Furthermore, since there is zero voltage on the control gate during reads, no stress (“read stress”) is generated in the gate dielectric during reads. This makes it possible to significantly reduce or even eliminate the risk of a phenomenon known to those skilled in the art as “read interference”, which can be manifested by changes in the logic value of the storage bit.

[0022] Furthermore, the state transistor is depletion-type, meaning that when the memory cell is in a blank state and zero voltage is applied to the control gate, the "normal turn-on" property of the state transistor is associated with the value of the threshold voltage in the blank state and the memory cell, for example, the value can be selected to be negative or essentially zero.

[0023] As an indicator, the threshold voltage can be -1 volt.

[0024] All memory cells have the same theoretical threshold voltage for their state transistors. However, these are effective threshold voltages; in other words, the actual values ​​of the threshold voltages vary slightly after random dispersion, for example, due to random physical factors in manufacturing.

[0025] Furthermore, these units provide a very large effective threshold voltage dispersion.

[0026] For example, the dispersion of the obtained effective threshold voltage is equal to -1 volt plus or minus 100%.

[0027] Furthermore, the common random distribution is advantageous for the distribution of the effective threshold voltage of the state transistors of blank memory cells that have not been written to, where the floating gate and command gate are connected.

[0028] According to an embodiment, each memory cell includes a gate oxide disposed between the floating gate of a state transistor and a substrate, the gate oxide having a thickness greater than 8 nanometers, for example, between 8 nanometers and 10 nanometers.

[0029] Such a thick gate oxide enables good robustness to physically unclonable functional devices in terms of aging.

[0030] According to an embodiment, the processing circuit includes a read circuit configured to execute an effective threshold voltage of a read state transistor, and a first component of the non-volatile memory cell is organized into two first matrix sub-components arranged symmetrically with respect to the read circuit, wherein all lines or rows of the two first matrix sub-components are parallel.

[0031] Furthermore, the read circuit is configured to perform a read that includes a differential read of the effective threshold voltage of the state transistors of the symmetric memory cell pair, which are located in two first matrix sub-components on the same source column of the two first matrix sub-components, respectively.

[0032] Two columns from the same source in two first child components are understood as columns with the same column address.

[0033] Assigning the first component to two symmetric matrix sub-components associated with the differential method at the read level is particularly advantageous in the sense that the dispersion can be increased within a common random distribution of the effective threshold voltage of the state transistor.

[0034] Furthermore, it is particularly preferred to ensure the reliability of the memory cells of the first component so that only reliable pairs of memory cells are retained for the transmission of output data sets; in other words, the pairs of memory cells are not easily changed between one power-on and another power-off.

[0035] Furthermore, according to an embodiment, the processing circuit advantageously includes a second component of memory cells, each memory cell having a selection transistor embedded in a semiconductor substrate and a depletion-state transistor having a control gate and a floating gate. The memory cells of the second component are intended to contain reliability information indicating the reliability or unreliability of the contents of the symmetrical memory cell pair of the first component.

[0036] Unlike the memory cells of the first component, the memory cells of the second component (intended to contain reliability information) do not include state transistors with electrically connected floating gates and control gates. However, these state transistors are also advantageously depletion-type.

[0037] Therefore, just as the memory cell of the first component can be read by applying zero voltage to the control gate (as described above), for example by connecting the control gate to ground, since the state transistor is usually on, the memory cell of the second component can also be read by applying zero voltage to the control gate, since the state transistor of such a cell is also advantageously usually on.

[0038] In other words, the memory cell of the second component is a conventional memory cell with a state transistor and an embedded select transistor, such as the cell type described in the aforementioned U.S. patent application, but wherein, for example, arsenic is implanted in the channel region to obtain a depletion-type transistor.

[0039] According to an embodiment, the second component includes a matrix arrangement of memory cells that shares the same columns as the matrix arrangement of memory cells in the first component.

[0040] This is beneficial for decoding because the first and second components share the same decoding column.

[0041] Furthermore, it is advantageous that the second component also includes two second matrix sub-components, which are respectively distributed on either side of the two first sub-components.

[0042] In addition, reliability information associated with the memory cell pair is stored in the memory cell of the second component, which is located in the same column as the corresponding memory cell of the memory cell pair of the first component.

[0043] This symmetrical storage of reliability information on either side of the first sub-component makes reading easier.

[0044] According to an embodiment, the processing circuit includes a first generation circuit configured to generate reliability information by taking into account margin values ​​on a differential readout of the effective threshold voltage of the state transistors of the memory cell pair.

[0045] More precisely, according to the first possible variation, the first generation circuit includes:

[0046] -The aforementioned read circuit is configured to also perform the following for each memory cell pair of the first component:

[0047] • The difference between the current flowing through the first memory cell of the memory cell pair on one hand and the current flowing through the second memory cell of the memory cell pair on the other hand is read to obtain the first binary data. The current flowing through the first memory cell of the memory cell pair is increased by a reference current representing a margin value.

[0048] • The difference between the current flowing through the second memory cell on one side and the current flowing through the first memory cell on the other side is read to obtain second binary data, wherein the current flowing through the second memory cell is increased by a reference current representing a margin value.

[0049] A comparator circuit is configured to compare one of the first or second binary data with the inverse of the other binary data, and to transmit reliability information associated with the pair of memory cells, the logic value of which depends on the result of the comparison.

[0050] - Write circuitry, used to write reliability information into the corresponding memory cell of the second component.

[0051] Although in this variant a pair of memory cells of the first component stores a segment of reliability information, in another variant an odd number of segments of reliability information called "temporary" can be stored, and the actual reliability information can then be selected by a majority vote on the temporary reliability information.

[0052] More specifically, according to this other variation, the first generating circuit includes

[0053] - The read circuitry is configured to perform the following operation on each pair of memory cells of the first component:

[0054] a) First read: Read the difference between the current flowing through the first memory cell of the memory cell pair and the current flowing through the second memory cell of the memory cell pair to obtain first binary data. The current flowing through the first memory cell of the memory cell pair is increased by a reference current representing a margin value.

[0055] b) A second read involves reading the difference between the current flowing through the second memory cell and the current flowing through the first cell, in order to obtain second binary data. This second read includes a reference current representing a margin value.

[0056] - The comparator circuit is configured as follows:

[0057] c) Compare one binary data point from the first binary data and the second binary data with the inverse of the other binary data in the first binary data and the second binary data; and

[0058] d) Transmit a temporary reliability information associated with a pair of memory cells, the logical value of which depends on the result of a comparison; and

[0059] -Write circuitry, configured as follows:

[0060] e) Write the temporary reliability information into the corresponding memory cell of the second component;

[0061] - The control circuit is configured to perform an odd number of steps a), b), c), d), and e) by reading, comparing, and writing to obtain reliability information temporarily stored in an odd number of segments; and

[0062] - The selection circuit is configured to perform a majority vote on the logic value of the temporary reliability information in order to select the reliability information.

[0063] According to an embodiment, the processing circuit includes a second generation circuit configured to generate the set of output data from at least differential reads of the effective threshold voltages of the state transistors of the memory cell pair and reliability information of the memory cell pair.

[0064] While the above embodiments provide a satisfactory solution to the problem, in some cases, structural asymmetry may affect the randomness of the output data sets transmitted by physically unclonable functional devices.

[0065] Furthermore, advantageously, the second generation circuit is configured to generate output data sets not only from differential readings of the effective threshold voltages of the state transistors of the memory cell pairs and reliability information of these memory cell pairs, but also from the addresses of the columns in which the memory cell pairs reside.

[0066] Furthermore, according to another embodiment, for example, the low-weight bits of the address of the column can be used by the memory cell.

[0067] More precisely, these two generation circuits can therefore include

[0068] - The read circuit is configured to perform differential reads on each pair of memory cells in order to obtain a first segment of binary information with a first logic value;

[0069] - An inverting circuit, configured to invert or not invert a first logic value based on the logic value of the low-weighted bits of the address of the column containing the pair, and to transmit a second segment of binary information having a second logic value; and

[0070] - The masking circuit is configured to retain the second binary information as output data only when the memory cell pair is associated with a reliable segment of information that represents it as reliable.

[0071] Furthermore, it is particularly advantageous that the first component of the memory cell, the second component of the memory cell, and the processing circuit are located within the same integrated circuit.

[0072] In particular, this introduces a high level of protection against invasive physical analysis.

[0073] More precisely, if an attacker attacks the back of the integrated circuit in order to get as close as possible to the state transistor, he will damage the vertical transistor, thus making it impossible to read the state transistor of the memory cell of the first component.

[0074] The system can form a system-on-a-chip, which further includes the same integrated circuit; encoding / decoding circuitry configured to use the set of output data as encryption / decryption keys; control circuitry configured to transmit control logic signals and analog voltage signals to the same integrated circuitry; and another non-volatile memory.

[0075] It should be noted that in this case, there is no binary data exchange between the integrated circuit containing physically unclonable functional devices and other non-volatile memories.

[0076] The only data emitted from an integrated circuit containing physically unclonable functional devices is output data, but it is extremely difficult, if not impossible, to attack because it preferably circulates simultaneously on a bus with multiple lines (e.g., 256 lines) and on different metal layers.

[0077] According to another approach, a method is proposed for automatically generating a unique unpredictable code at the output interface of a physically unclonable functional device belonging to a system as defined above. The method includes turning on and reading the effective threshold voltage of the state transistors of the memory cells of a first component, the control gates of which are grounded during the reading.

[0078] According to another aspect, a method is proposed for generating an unclonable functional device as described above, including generating the device within an integrated circuit and generating and storing reliability information, for example, during the testing phase of the integrated circuit (abbreviated as "EWS" as known to those skilled in the art). Attached Figure Description

[0079] Other advantages and features of the present invention will become apparent from the detailed description of embodiments and implementations of the invention, which are not limited in any way, and as can be seen from the accompanying drawings, wherein:

[0080] Figure 1 This demonstrates a physically unclonable functional device;

[0081] Figure 2 The structure of a non-volatile memory cell is shown;

[0082] Figure 3 This illustrates a component of non-volatile memory cells organized in two matrix sub-components;

[0083] Figure 4 The differential readout performed by a readout circuit including a sense amplifier is shown;

[0084] Figure 5 The differential readout considering the margin value is shown;

[0085] Figure 6 Another differential readout is shown, performed by reading the circuitry and taking margin values ​​into account;

[0086] Figure 7 A first generation circuit capable of generating reliability information for a mask is shown;

[0087] Figure 8 A second generation circuit configured to generate output data sets is shown;

[0088] Figure 9 An integrated circuit including physically unclonable functional devices is shown;

[0089] Figure 10 Another integrated circuit is shown, which includes physically unclonable functional devices;

[0090] Figure 11 The masking circuit is shown;

[0091] Figure 12 Another masking circuit is shown;

[0092] Figure 13 A method for generating and storing reliability information is shown;

[0093] Figure 14A method for automatically generating unpredictable unique codes is shown;

[0094] Figure 15 A method for storing temporary reliability information for each data point is shown; and

[0095] Figure 16 A method for performing majority voting on provisional reliability information to determine reliability information is shown. Detailed Implementation

[0096] exist Figure 1 In the figure, the reference numeral DIS indicates a physically unclonable functional device.

[0097] The device DIS includes a first component 1, a non-volatile memory cell CEL, the structure of which will be described in more detail below.

[0098] The device DIS also includes a processing circuit MT, which is configured to transmit an output data set SD to the output interface INTS based on a read of the effective threshold voltage of the state transistor of the memory cell CEL of the first component 1.

[0099] Before returning to the other components of the processing circuit MT in more detail, let's now refer to more specific details. Figure 2 In order to describe the structure of the non-volatile memory cell CEL of the first component.

[0100] The unit CEL includes a state transistor T, which has a command gate or control gate CG and a floating gate FG. In this case, the two gates CG and FG are electrically connected through a via or contact, which is not located in... Figure 2 It lies within a plane, but is schematically represented by two dashed lines.

[0101] The floating gate FG is separated from the semiconductor substrate SUB by the gate oxide layer OX, the thickness of which is advantageously greater than 8 nanometers, for example, between 8 and 10 nanometers.

[0102] The drain D of the state transistor T is connected to the bit line via contact CBL.

[0103] The control gate CG of transistor T is connected to the gate control line.

[0104] The state transistor has a floating gate in its channel, which includes an implanted surface region CH. The channel is connected to the source line SL via a select transistor ST embedded in the substrate SUB.

[0105] The transistor ST has a vertically selected gate embedded in the substrate, and the source line SL is also embedded.

[0106] The drain (D) of transistor ST and the source (S) of state transistor T form a common semiconductor region.

[0107] As described above, the channel of the state transistor T includes a channel implanted at the surface CH, for example, N-doped, so that the corresponding memory cell operates in depletion mode.

[0108] In other words, the state transistor T is depletion-type. When the memory cell is in a blank state and zero voltage is applied to the control gate, the normal behavior of the state transistor is associated with the value of the threshold voltage in the blank state of the memory cell. The value of the threshold voltage can be selected as a negative voltage or essentially zero.

[0109] In the case of an n-type conductive channel, the implanted dopant can be, for example, arsenic (As), and the concentration of the dopant determines the threshold voltage of the transistor T of the memory cell in the blank state.

[0110] Here, the state transistor is configured to have such a negative threshold voltage.

[0111] The dosage of the implanted dopant can be adjusted to obtain a negative theoretical threshold voltage, such as -1 volt.

[0112] All state transistors in all cells of the first component (CEL) are designed to have the same threshold voltage.

[0113] These are valid threshold voltages; in other words, the actual value of the threshold voltage changes slightly after random dispersion, for example, due to random physical factors in manufacturing. This type of dispersion is usually known.

[0114] State transistors have a control gate and a floating gate that are electrically connected. Due to these random physical factors, state transistors are inherently more variable and therefore have a greater distribution than other types of electronic components, such as MOS transistors or resistors.

[0115] Therefore, each transistor T of the cell CEL in the first component 1 has an effective threshold voltage belonging to a common random distribution.

[0116] In particular, the common random distribution can be the distribution of threshold voltages of memory cell transistors that have not been written to in a blank state.

[0117] Refer again Figure 1 It can be seen that the processing circuit MT includes the memory cell CELM of the second component 3. Each memory cell CELM also has a selection transistor embedded in the semiconductor substrate and a state transistor with a control gate and a floating gate.

[0118] In fact, the memory cell CELM is similar to the memory cell CEL, except that the floating gate and control gate of the state transistors are not electrically connected. Each state transistor in the CELM is also advantageously a transistor that operates in depletion mode.

[0119] Such a memory cell CELM is, for example, the cell type described in more detail in patent application US2013 / 0228846, and also has an arsenic implant in the channel region of, for example, the memory cell CEL for the first component as described above.

[0120] As described in more detail below, these memory cells CELM are intended to store reliability information representing the reliability or unreliability of the contents of the memory cell CEL of the first component.

[0121] In addition, the processing circuit MT includes a first generation circuit MGEN1 configured to generate reliability information.

[0122] The processing circuit MT also includes a second generation circuit MGEN2, which is configured to generate a group of output data SD from at least the effective threshold voltage of the state transistor of the memory cell CEL pair, as well as reliability information contained in these memory cells CELM in the second component 3.

[0123] We will return in detail to the example of the operational structure of the matrix arrangement of the units of the first generation circuit MGEN1, the second generation circuit MGEN2, and the second component 3.

[0124] Now for more specific reference Figure 3 As can be seen, in this advantageous embodiment, the first component 1 non-volatile memory cell CEL is organized in two first matrix sub-components 10L and 10R, which are arranged symmetrically with respect to the conventional read circuit LECT and are known in themselves, the read circuit LECT typically including a "sensor amplifier" 5.

[0125] All lines or rows of the two first matrix subcomponents 10L and 10R are parallel.

[0126] The row decoding of each of the two sub-components 10L and 10R is performed by a row decoder XDEC with a conventional structure known in itself, while the column decoding of the two first sub-components is performed by two column decoders YDEC with a conventional structure and known in itself, arranged symmetrically about the sensing amplifier 5.

[0127] Furthermore, the read circuit LECT is configured to differentially read the effective threshold voltages of the state transistors of the symmetric memory cells CELijL and CELijR or CELmpL and CELmpR located in the two first sub-components 10L and 10R, respectively, which are located on the same column of the two first sub-components.

[0128] Furthermore, these memory cells of the second component 3 are intended to contain reliability information indicating the reliability or unreliability of the contents of the memory cell pair of the first component.

[0129] Here, the reliability information is binary data with a first logic value (e.g., logic value 0) indicating the unreliability of the contents of a given memory cell pair of the first component, or binary data with a second logic value (e.g., logic value 1) indicating the reliability of the contents of a given memory cell pair.

[0130] Therefore, for example, in Figure 3 In this context, the reliability information Mij with a logic value of 0 indicates the unreliability of the contents bijL and bijR of the memory cells of the first component to CELijL and CELijR.

[0131] In contrast, the reliability information Mmp with a logic value of 1 indicates the reliability of the memory cell of the first component here for the contents bmpL and bmpR of CELmpL and CELmpR.

[0132] All of this reliability information forms the mask MSK.

[0133] Now for more specific reference Figure 4 This is to describe the differential readout RD performed by the readout circuit LECT, which includes the sense amplifier 5.

[0134] exist Figure 4 In the example shown, the read circuit LECT is configured to measure the difference between the effective threshold voltage of the pair of state transistors T and the two memory cells CELijL and CELijR, respectively.

[0135] The read circuit is coupled to transistor T via the corresponding bit lines BLL and BLR.

[0136] The select transistor ST is controlled on its gate by signals carried on the corresponding word lines WLL and WLR.

[0137] In addition to the sensing amplifier 5, the readout circuit also includes a reference current generator 51, which can be connected or not connected to the sensing amplifier 5 via a switch.

[0138] In such Figure 4In the background of the differential readout RD shown, it is advantageous to perform the disconnection of the reference current generator to the sense amplifier 5 by means of the control gate of the state transistor connected to ground.

[0139] The sensing amplifier 5 is configured to amplify the difference between the current ICL flowing in cell CELijL and the current ICR flowing in cell CELijR.

[0140] The read currents ICL and ICR represent the effective threshold voltages of the floating gate transistors of the corresponding cells CELijL and CELijR, and the difference between these currents represents the difference between the effective threshold voltages of the transistors in these states.

[0141] Therefore, the readout circuit LECT is able to measure the difference in effective threshold voltage between state transistor pairs of two cells arranged on the same source bit line.

[0142] Furthermore, by way of a non-limiting example, it can be determined that if the current ICL is greater than the current ICR, the data DATAij contained in this pair of cells has a logic value of 0, and if the current ICL is less than the current ICR, the data has a logic value of 1.

[0143] Of course, the opposite rule can be adopted.

[0144] Now for more specific reference Figure 5 and Figure 6 This is to describe the differential readout of the effective threshold voltage of the state transistor for a pair of memory cells that takes into account the margin value.

[0145] Also here, these differential reads are performed via the control gate of a state transistor connected to ground.

[0146] Figure 5 The first differential read RDM0, taking into account the margin value, is shown.

[0147] More precisely, during the reading of RDM0, an additional current IREF generated by a current generator of current generator 51 is added to the current flowing through cell CELijR.

[0148] This allows the difference between effective threshold voltages to be measured with a certain margin.

[0149] The margin value corresponds to the current IREF, which represents the deviation from the reference voltage.

[0150] The margin value should be selected based on the accuracy of the LECT (Limited Electron Circuit) reading circuit.

[0151] As an indicator, the value of the current IREF can be equal to 2 microamps.

[0152] Furthermore, in this case, if the current ICL is greater than the sum of the currents ICR and IREF, then the stored data DATAij will be equal to 0, for example.

[0153] Figure 6 Another differential read, RDM1, is shown, performed via the read circuit LECT and taking into account margin values.

[0154] More precisely, in this case, the reference current IEF is added to the current ICL flowing in the cell CELijL.

[0155] Furthermore, for example, if the current ICR is greater than the sum of the currents ICL and IREF, then DATAij equals 1.

[0156] Now for more specific reference Figure 7 This is an example of the structure of the first generation circuit MGEN1, which is capable of generating reliability information for the mask MSK.

[0157] like Figure 7 As shown, the reliability information is generated by differentially reading margin values ​​on RDM0 and RDM1, taking into account the effective threshold voltages of the state transistors of the memory cell pair.

[0158] More precisely, the first generation circuit MGEN1 includes a read circuit LECT configured to perform a first read on each memory cell pair of the first component 1, such as reading RDM0, to read the difference between the current flowing through the first memory cell of the memory cell pair on one side and the current flowing through the second memory cell of the memory cell pair on the other side, in order to obtain first binary data, wherein the current flowing through the first memory cell of the memory cell pair is increased by a reference current representing a margin value.

[0159] The read circuit LECT is also configured to perform a second read, such as reading RDM1, reading the difference between the current flowing through the second memory cell on one side and the current flowing through the first memory cell on the other side, in order to obtain second binary data, wherein the current flowing through the second memory cell is increased by a reference current representing a margin value.

[0160] In the example described here, for simplicity, a set of 16-bit first binary data DB1 obtained at the end of the first read of RDM0 is shown, such as [0000 0111 11111111], and a corresponding set of 16-bit second binary data DB2 obtained at the end of the read of RDM1 is shown, such as [0000 0000 0000 1111].

[0161] The generation circuit MGEN1 also includes a module, globally indicated by reference numeral 2, configured to generate and write the mask MSK in the memory cell of the second component 3.

[0162] The module 2 includes an inverter IV for inverting a set of binary data in a binary data group, for example, the first binary data group DB1 derived from reading RDM0, so as to obtain the group [1111 1000 0000 0000] in the illustrated case.

[0163] Then, a comparison circuit, such as an OR gate indicated by the reference numeral PL, allows a bit-by-bit comparison of the second binary data DB2 group from reading RDM1 with the inverse of the first binary data DB1 group from reading RDM0.

[0164] If the antiphase effectively has a logic value opposite to the corresponding non-antiphase, the data can be considered reliable, and 1 can be assigned to the corresponding reliability information obtained through a logic OR gate.

[0165] In contrast, if the logic value of the out-of-phase condition is equal to the logic value of the corresponding non-out-of-phase condition, the data is considered unreliable, and the corresponding reliability information will have a logic value of 0.

[0166] This yields a mask MSK, which includes the same number of bits as the memory cell pairs in the first component 1. In the case shown, the mask MSK is equal to [1111 1000 0000 1111].

[0167] Of course, inverters and OR gates can be replaced with XOR logic gates.

[0168] Module 2 also includes a write circuit PROG with a known conventional structure for writing the reliability information (bits) of the mask MSK into the corresponding memory cell of the second component 3.

[0169] Now for more specific reference Figure 8 To describe a structural example of the second generation circuit MGEN2, the second generation circuit MGEN2 is configured to generate output data groups, as well as reliability information of these memory cell pairs, by differentially reading at least the effective threshold voltages of the state transistors of the memory cell pairs.

[0170] More precisely, the read circuit LECT has conventional differential readers RD located in pairs of homologous memory cells in two sub-components 10L and 10R, respectively, to obtain the first output data group JS1, such as [0000 0000 0111 1111], which in this simplified example includes 16-bit output binary data.

[0171] This read can be advantageously performed by connecting the control gate of the state transistor to ground.

[0172] The conventional read circuit MLCT also includes a sense amplifier such as sense amplifier 5, which performs conventional read RDMSK of the corresponding reliability information MSK, such as [1111 1000 00001111], in the memory cell CELM of the second component 3.

[0173] This read of RDMSK can also be advantageously performed by connecting the control gate of the state transistor to ground.

[0174] Then, the second generation circuit MGEN2 includes a masking circuit 4, which is configured to retain only the binary data of group JS1 as output data SD, which is assigned a segment of reliability information indicating that the data is reliable, in this case, the segment of reliability information is equal to 1.

[0175] In this example, the reliable data (value 1) is considered to be the first five and last four bits from the left, while the other bits are uncertain (X).

[0176] Therefore, as Figure 8 As shown, as an example, the output data SD set will only include 9 bits out of the 16 bits of the set JS1[0000 0XXX XXXX1111].

[0177] Now for more specific reference Figure 9 It schematically illustrates an integrated circuit (IC), including various devices with the aforementioned physically unclonable functionalities.

[0178] More precisely, there are two sub-components, 10L and 10R, of the memory cell, each comprising 16 rows and 128 columns.

[0179] The row decoder XDEC is assigned to each of the two sub-components, and the column decoder YDEC is assigned to either side of the sensing amplifier 5.

[0180] The controller CTRL uses control signals MGCTRL and MMCTRL to control the operation of module 2, which is used to generate and store the mask MSK, as well as the operation of the masking circuit 4.

[0181] For example, under the control of the control signal MSKADD, data is extracted from each 8-bit block of the two sub-components 10R and 10L, and the mask MSK is stored in each 8-bit block unit of the second component 3.

[0182] Similarly, the reliability information of the mask is extracted from the 8-bit block.

[0183] The output data SD can be 32, 64, 128, or 256 bits, depending on the requirements.

[0184] although Figure 9 The illustrated embodiments are conceivable, but are provided Figure 10 The embodiments of the type shown are particularly preferred.

[0185] More precisely, according to this embodiment, the second component 3 of the memory cell intended to store reliability information includes two sub-components 30L and 30R, respectively distributed on either side of the first sub-components 10L and 10R.

[0186] In addition, reliability information associated with the memory cell pair is stored in a memory cell of the second component, which is located in the same column as the corresponding memory cell pair.

[0187] Furthermore, the first component 1, which includes two sub-components 10L and 10R, the second component 3, which includes two sub-components 30L and 30R, and the processing circuit MT are located within the same integrated circuit IC.

[0188] This simplifies column decoding and makes it more difficult to extract data through attacks (such as on the back of the device's DIS).

[0189] Furthermore, the integrated circuit IC (including device DIS) is advantageously located on the system-on-chip (SoC), which further includes:

[0190] - The bus BSOUT, connected to the output interface INT, is preferably distributed across multiple metal layers and is designed to transmit output data SD.

[0191] The MEDC encoding / decoding circuit is configured to use the output data SD group as the encryption / decryption key.

[0192] Control circuits 6 and 7 are configured to transmit control logic signals and analog voltage signals to the integrated circuit IC, and

[0193] - Another non-volatile memory 9.

[0194] It should be noted in this regard that there is no data exchange between the non-volatile memory planes 10L, 10R, 30L and 30R and the memory plane of non-volatile memory 9.

[0195] Now for more specific reference Figure 11 and 12 To illustrate a possible embodiment of the masking circuit 4.

[0196] exist Figure 11As can be seen from the diagram, the masking circuit includes a register RG, which is designed to contain data D extracted from the memory cells of the first component and the memory cells of the second component, respectively, and reliability information M.

[0197] In the example described here, 32 pairs of registers are provided to store in parallel 32 data items D retrieved from the first component of the memory cell and 32 reliability information items M retrieved from the second component of the memory cell.

[0198] In addition, logic circuits G, such as AND gates, are associated with each register RG and are designed to store a piece of reliability information M and to turn the clock signal CLK (“clock strobe”) off or on.

[0199] More precisely, if the reliability information has a value of 0, which corresponds to the unreliability of the corresponding data D, then the clock signal is not sent as an output from gate G.

[0200] In contrast, if the reliability information M has a value of 1 corresponding to the reliability of the corresponding data D, then the clock signal is effectively transmitted as the output from the gate G.

[0201] Here, the masking circuit 4 also includes 32 shift registers SRG, each of which is designed to receive data D at the rate of the corresponding clock signals CLK31-CLK0 transmitted by the corresponding gate G.

[0202] In other words, when the corresponding clock signal is effectively transmitted at the output of gate G, the corresponding data D can be stored in the shift register.

[0203] In addition, each time the clock signal CLK is transmitted at the output of gate G, the data is shifted and the new data is stored in the shift register SRG.

[0204] This also provides 32 counters C, each with a counting capacity of 8.

[0205] When transmitted by the corresponding gate G, these counters increment at each leading edge of the corresponding clock signal.

[0206] Furthermore, when counter C has reached its maximum count value, this indicates that the corresponding shift register SRG is full, and therefore its eight data entries can be extracted.

[0207] although Figure 11 The embodiments shown are entirely conceivable, but for generating the masking circuit 4, it is preferable to use... Figure 12 Examples of implementations.

[0208] However, in Figure 11In this embodiment, the output data is obtained from data D extracted from two sub-components 10L and 10R, and the reliability information M (this output data is in...) Figure 12 The data obtained in the embodiment can also be derived from the logic value of the low-weight bit of the column address where the extracted data D is located. In other words, the memory cell corresponding to the first component 1 is CELij.

[0209] More accurately, Figure 12 Implementation examples and Figure 11 The difference is that a logic circuit TGL is added, which is timed by the clock signal CLK and transmits the low-weight bits of the column address.

[0210] In addition, the XOR logic gate G receives a portion of the low-weight address bits and the corresponding data D.

[0211] These XOR gates therefore allow the logical value of data D to be extracted either inverted or not inverted based on the logical value of the low-weight bits of the column address.

[0212] Therefore, improved random characters were obtained for the output data SD.

[0213] like Figure 13 As illustrated very schematically, after the device DIS is generated within the integrated circuit (step S120), and before the device is actually used, for example during the testing phase of the integrated circuit (known to those skilled in the art, abbreviated as EWS: Electronic Wafer Sorting), reliability information is generated and stored (step S121).

[0214] Regarding the automatic generation of unpredictable unique code SD at the device's output interface INTS, this is performed during actual use of the device. Figure 14 ).

[0215] It includes a switching device (step S122).

[0216] The control gate of the state transistor T of cell CEL in the first component 1 is connected to ground (step S123).

[0217] Then, the effective threshold voltage of the state transistor of the cell pair is read (step S124).

[0218] Then, in step S126, step S125 is performed to mask the data using a mask MSK so that only reliable data SD is transmitted.

[0219] This invention is not limited to the embodiments and implementations already described, but includes all variations.

[0220] Therefore, in Figure 11 and Figure 12For example, the counter C can be replaced by locking the memory via a gate loopback.

[0221] In addition, such as Figure 15 and Figure 16 As shown, the first generation circuit MGEN1:

[0222] - Determine and store reliability information for odd-numbered segments for each data point; this information is subsequently treated as provisional reliability information.

[0223] - A majority vote is taken on the provisional reliability information to determine its reliability, which will be used to determine whether the data is reliable.

[0224] More precisely, in Figure 15 In this process, for each pair of units CELijL and CELijR, the read circuit LECT performs a reference check in steps S150 and S151. Figure 5 and Figure 6 The differential reads RDM0 and RDM1 are described to extract the first binary data D1jk (k=1) and the second binary data D2ijk (k=1).

[0225] Then, as described above, the comparator circuit PL (OR gate) performs a comparison S152 on the two binary data (one of which is inverted) in order to extract the first piece of temporary reliability information Mijk (k=1) from them.

[0226] Then, the writing circuit PROG stores the temporary reliability information Mijk (step 153) in three corresponding memory cells of the second component 3.

[0227] Then, the control circuit MCM commands to repeat steps S150 to S153 in order to obtain temporary reliability information for the odd k segments (steps S154 and S155).

[0228] In the example described here, k equals 3.

[0229] Therefore, three reliability information segments, Mij1, Mij2, and Mij3, are ultimately obtained.

[0230] Then, as Figure 16 As shown, during the generation of output data SD, for the data extracted from the cell pair, the reading circuit MLCT reads three segments of temporary reliability information (step S160), and the selection circuit SEL performs a majority vote on the logic values ​​of these three segments of reliability information (step S161) in order to infer the reliability information associated with the data, where the logic value of the data is the majority logic value.

[0231] Although the invention has been described with reference to exemplary embodiments, this specification is not intended to be limiting. Various modifications and combinations of the illustrative embodiments and other embodiments of the invention will be apparent to those skilled in the art from the description. Therefore, the appended claims are intended to cover any such modifications or embodiments.

Claims

1. An electronic system comprising: Physically unclonable functional devices, the devices comprising: A first component of a non-volatile memory cell, each non-volatile memory cell having a select transistor embedded in a semiconductor substrate and a depletion-type state transistor having a control gate and a floating gate electrically connected to each other, the state transistor having a corresponding effective threshold voltage belonging to a common random distribution, and the select transistor having a vertical select gate embedded in the semiconductor substrate, the first component of the non-volatile memory cell being organized into two first matrix sub-components arranged symmetrically with respect to a read circuit, all rows of the two first matrix sub-components being parallel; and The processing circuitry is configured to transmit an output data set to the output interface of the device based on a read of the effective threshold voltage of the state transistor of the memory cell of the first component. The processing circuit includes the read circuit, and the read circuit is configured to perform the read, which includes a differential read of the effective threshold voltage of the state transistor of the symmetric memory cell pair, the symmetric memory cell pair being located in the two first matrix sub-components on the same source column of the two first matrix sub-components, respectively.

2. The electronic system of claim 1, wherein each memory cell includes a gate oxide disposed between the floating gate of the state transistor and the substrate, the gate oxide having a thickness greater than 8 nanometers.

3. The electronic system of claim 1, wherein the processing circuitry includes a second component of non-volatile memory cells, each non-volatile memory cell having a selection transistor embedded in the semiconductor substrate and a depletion-state transistor having a control gate and a floating gate, the memory cells of the second component being configured to contain reliability information indicating the reliability or unreliability of the contents of the symmetric memory cell pair of the first component.

4. The electronic system of claim 3, wherein the second component includes a matrix arrangement of memory cells, the matrix arrangement of the memory cells of the second component sharing the same columns as the matrix arrangement of the memory cells of the first component.

5. The electronic system of claim 4, wherein the second component comprises two second matrix sub-components, the two second matrix sub-components being distributed on either side of the two first matrix sub-components.

6. The electronic system of claim 4, wherein the reliability information associated with the symmetric memory cell pair is stored in a memory cell of the second component, the memory cell of the second component being located in the same column as the memory cell of the corresponding symmetric memory cell pair.

7. The electronic system of claim 3, wherein the processing circuitry includes a first generation circuitry configured to generate the reliability information based on a margin value on the differential read of the effective threshold voltage of the state transistor of the symmetric memory cell pair.

8. The electronic system of claim 7, wherein the first generating circuit comprises: The read circuit is configured to additionally perform the following for each memory cell pair of the first component: The first read reads the difference between the current flowing through the first memory cell in the memory cell pair and the current flowing through the second memory cell in the memory cell pair to obtain first binary data, wherein the current flowing through the first memory cell in the memory cell pair is increased by a reference current representing the margin value. as well as The second read involves reading the difference between the current flowing through the second memory cell and the current flowing through the first memory cell to obtain second binary data, wherein the current flowing through the second memory cell is increased by the reference current. The comparison circuit is configured to compare one of the first binary data or the second binary data with the inverse of the other binary data in the first binary data and the second binary data, and to transmit the reliability information associated with the memory cell pair, the logical value of which depends on the result of the comparison; as well as A write circuit is used to write the reliability information into the corresponding memory cell of the second component.

9. The electronic system of claim 7, wherein the first generating circuit comprises: The read circuit is configured to perform the following operation on each pair of memory cells of the first component: a) First read: Read the difference between the current flowing through the first memory cell in the memory cell pair and the current flowing through the second memory cell in the memory cell pair to obtain first binary data, wherein the current flowing through the first memory cell in the memory cell pair is increased by a reference current representing the margin value. b) A second read, reading the difference between the current flowing through the second memory cell and the current flowing through the first memory cell on the other hand, in order to obtain second binary data, wherein the current flowing through the second memory cell is increased by the reference current; The comparator circuit is configured as follows: c) Compare one binary data item from the first binary data or the second binary data with the inverse of the other binary data item in the first binary data or the second binary data; and d) Transmit a temporary reliability information associated with the memory cell pair, the logical value of which depends on the result of the comparison; and The write circuit is configured as follows: e) Write the temporary reliability information into the corresponding memory unit of the second component; as well as The control circuit is configured to perform an odd number of steps a), b), c), d), and e) by reading, comparing, and writing in order to obtain reliability information of the odd number of temporary segments; as well as The selection circuit is configured to perform a majority vote on the logic value of the temporary reliability information in order to select the reliability information.

10. The electronic system of claim 3, wherein the processing circuitry includes a second generation circuitry configured to generate the output data set from at least the differential reads of the effective threshold voltages of the state transistors of the symmetric memory cell pair and the reliability information of the symmetric memory cell pair.

11. The electronic system of claim 10, wherein the second generation circuit is configured to generate the output data set from differential reads of the effective threshold voltage of the state transistor of the symmetric memory cell pair, the address of the co-originating column of the symmetric memory cell pair therein, and the reliability information of the symmetric memory cell pair.

12. The electronic system of claim 11, wherein the second generating circuit comprises: The read circuit is configured to perform the differential read on each pair of memory cells in order to obtain a first segment of binary information having a first logic value; An inverting circuit is configured to invert or not invert the first logic value based on the logic value of the low-weight bits of the address located in the same source column therein, and to transmit a second segment of binary information having a second logic value. as well as The masking circuit is configured to retain the second binary information as output data only when the memory cell pair is associated with a reliable segment of information that represents the contents of the memory cell pair as reliable data.

13. The electronic system of claim 3, wherein the first component of the non-volatile memory cell, the second component of the non-volatile memory cell, and the processing circuit are located within the same integrated circuit.

14. The electronic system of claim 13, wherein the system is a system-on-a-chip, comprising: The same integrated circuit; An encoding / decoding circuit is configured to use the output data group as an encryption / decryption key; The control circuit is configured to transmit control logic signals and analog voltage signals to the same integrated circuit; as well as Another non-volatile memory.

15. A method of operating a system comprising physically unclonable functional devices, the physically unclonable functional devices comprising a first component of non-volatile memory cells, each non-volatile memory cell having a selection transistor embedded in a semiconductor substrate and a depletion-type state transistor having a control gate and a floating gate electrically connected to each other, the state transistor having a corresponding effective threshold voltage belonging to a common random distribution. The method includes processing circuitry configured to transmit an output data set to an output interface of the device based on a read of an effective threshold voltage of the state transistor of the memory cell of the first component, wherein the selection transistor has a vertical selection gate embedded in the semiconductor substrate, and the first component of the non-volatile memory cell is organized into two first matrix sub-components arranged symmetrically with respect to the read circuitry, all rows of the two first matrix sub-components being parallel. Connect the physically unclonable functional device; Connect the control gate of the state transistor of the memory cell to ground; Read the effective threshold voltage of the state transistor of the memory cell of the first component; and A unique, unpredictable code is generated at the output interface of the physically unclonable functional device. The read includes differentially reading the effective threshold voltage of the state transistor of the symmetric memory cell pair by a read circuit in the processing circuit, the symmetric memory cell pair being located in two first matrix sub-components on the same source column of the two first matrix sub-components, respectively.

16. A method for producing an electronic device, comprising: Manufacturing integrated circuits that include physically unclonable functional devices, said physically unclonable functional devices comprising: A first component of a non-volatile memory cell, each non-volatile memory cell having a select transistor embedded in a semiconductor substrate and a depletion-type state transistor having a control gate and a floating gate electrically connected to each other, the state transistor having a corresponding effective threshold voltage belonging to a common random distribution, the first component of the non-volatile memory cell being organized into two first matrix sub-components symmetrically arranged with respect to a read circuit, all rows of the two first matrix sub-components being parallel, and the select transistor having a vertical select gate embedded in the semiconductor substrate; and Processing circuitry, including: The read circuit is configured to perform a read, the read comprising differential reading of the effective threshold voltage of the state transistor of the symmetric memory cell pair, the symmetric memory cell pair being located in the two first matrix sub-components respectively on the same column of the two first matrix sub-components; and A second component of a non-volatile memory cell, each non-volatile memory cell having a selection transistor embedded in the semiconductor substrate and a depletion-state transistor having a control gate and a floating gate, the memory cell of the second component being configured to contain reliability information indicating the reliability or unreliability of the contents of the symmetric memory cell pair of the first component. The processing circuit is configured to transmit an output data group to the output interface of the device based on the read of the effective threshold voltage of the state transistor of the memory cell of the first component; and The reliability information is generated and stored during the testing phase of the integrated circuit.

17. The method of claim 16, wherein: The second component includes a matrix arrangement of memory cells, wherein the matrix arrangement of the memory cells of the second component shares the same columns as the matrix arrangement of the memory cells of the first component; The storage includes storing the reliability information associated with the symmetric memory cell pair in the memory cell of the second component, wherein the memory cell of the second component is located in the same column as the memory cell of the corresponding symmetric memory cell pair.

18. The method of claim 16, wherein the generation includes generating the reliability information based on the margin value of the differential read of the effective threshold voltage of the state transistor of the symmetric memory cell pair.

Images