Integrated circuit and method for protecting power-on timing of integrated circuit

Abstract

The present invention provides an integrated circuit and a method for protecting the power-up sequence of the integrated circuit. This integrated circuit includes a non-volatile memory (NVM) and a secure power-up circuit. The non-volatile memory is configured to store the operating state of this IC. The secure power-up circuit is configured to (1) perform a first read of the operating state from the NVM during the power-up sequence of the IC when the supply voltage of the IC is within a first voltage range, (2) verify that the supply voltage is within a second voltage range that is tighter than the first voltage range if the operating state read from the NVM for the first time is in a state that permits access to sensitive resources of the IC, and (3) initiate a response action in response to the difference between the first read and the second read of the operating state from the NVM.

Description

Technical Field

[0001] The present invention generally relates to secure integrated circuits (ICs), and more particularly to integrity verification of a memory circuit that stores the life cycle state of an IC. Background Art

[0002] Some integrated circuits (ICs) include non-volatile memory (NVM), such as one-time programmable (OTP) memory. This memory stores the operating state of the IC. The state stored in this memory can be used to manage access to the security features of the IC.

[0003] For example, U.S. Patent Application Publication 2019 / 0026497 describes an integrated circuit that includes a control circuit and a one-time programmable circuit. The control circuit determines whether the one-time programmable circuit is programmed, and the programming reflects an access attempt to a mode of the integrated circuit after the integrated circuit is powered on. When the control circuit determines that the one-time programmable circuit has been programmed and indicates a previous access to the mode of the integrated circuit, the control circuit generates a signal to indicate to the user of the integrated circuit that the mode of the integrated circuit has been previously accessed.

[0004] As another example, U.S. Patent 10 / 095,889 describes an integrated circuit that includes a control circuit, a one-time programmable circuit, and security features. The control circuit determines whether the one-time programmable circuit is programmed to reflect the access security features requested by the integrated circuit user. When the control circuit determines that the one-time programmable circuit has been programmed and indicates a previous access to the security features, the control circuit generates a signal to indicate to the user of the integrated circuit that the security features have been previously accessed. When the control circuit determines that the one-time programmable circuit has not been programmed, the control circuit responds to the request to cause the one-time programmable circuit to be programmed. Summary of the Invention

[0005] Embodiments of the present invention provide an integrated circuit (IC) including a non-volatile memory (NVM) and a secure power-on circuit. The NVM is configured to store the operating state of the IC. The secure power-on circuit is configured to (1) perform a first read of the operating state from the NVM during the power-on sequence of the IC when the supply voltage of the IC is within a first voltage range, (2) verify that the supply voltage is within a second voltage range that is tighter than the first voltage range when the operating state read from the NVM in the first read is a state that permits access to sensitive resources of the IC, and (3) initiate a response action in response to a difference between the first read and a second read of the operating state from the NVM.

[0006] In some embodiments, the secure power-on circuit is configured to verify that the supply voltage is within the first voltage range by verifying that the supply voltage has reached a first voltage, and to verify that the supply voltage is within the second voltage range by verifying that the supply voltage has reached a second voltage that is at least higher than the first voltage. In one embodiment, the first voltage is within the operating voltage range of the functional circuits of the IC but lower than the operating voltage range of the NVM, and the second voltage is within the operating voltage range of the NVM.

[0007] In one embodiment, the state that permits access to sensitive resources is an initial state of a newly fabricated IC. In another embodiment, the state that permits access to sensitive resources is a test state. In some embodiments, the NVM includes a one-time programmable memory.

[0008] In another embodiment, the secure power-on circuit is configured to wait at least a preset time period between the first read and the second read. In another embodiment, the NVM is further configured to store (1) calibration data of a voltage sensor of the IC and (2) a computed error detection code that exceeds the calibration data, and during the first read, the secure power-on circuit is configured to read the calibration data and the error detection code and perform a second read in response to error detection by the error detection code.

[0009] In one disclosed embodiment, the secure power-on circuit is configured to compare the supply voltage with the first voltage range and the second voltage range by modifying at least one adjustable threshold in a voltage sensor that senses the supply voltage. In one exemplary embodiment, the secure power-on circuit is configured to compare the supply voltage with the first voltage range and the second voltage range by using a first voltage detector and a second voltage detector that detect voltages, respectively.

[0010] According to an embodiment of the present disclosure, a method for protecting the power-on sequence of an integrated circuit (IC) is further provided. The method includes, during the power-on sequence of the IC, when the supply voltage of the IC is within a first voltage range, performing a first read of the operating state of the IC from a non-volatile memory (NVM). If the operating state read in the first read from the NVM is a state that allows access to sensitive resources of the IC, verification is made that the supply voltage is within a second, more stringent voltage range than the first, and then a second read of the operating state is performed from the NVM. A reaction action is initiated in response to a difference between the first and second reads of the operating state from the NVM.

[0011] The present invention will be described in detail in the following embodiments and in conjunction with the drawings to understand the principles of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 Shown is a block diagram schematically illustrating a secure IC according to an embodiment of the present invention.

[0013] Figure 2 Shown is a flowchart of a method for a secure power-on sequence in an IC Figure 1 in accordance with an embodiment of the present invention.

[0014] REFERENCE NUMERALS:

[0015] 20: Secure IC

[0016] 24: Functional circuitry

[0017] 26: Interface

[0018] 28: One-time programmable memory

[0019] 32: Lifecycle state

[0020] 36: Voltage detector

[0021] 40: Power-on circuit

[0022] 50: Voltage confirmation step

[0023] 54: Release step

[0024] 58: First read step

[0025] 62: State confirmation step

[0026] 66: Normal operation step

[0027] 70: Threshold increase step

[0028] 74: Second read step

[0029] 78: Status Reconfirmation Step

[0030] 82: Suspected Attack Initiation Reaction Action Detailed Implementation Manner

[0031] The embodiments of the present invention described herein provide improvement methods and circuits for protecting the power-on sequence of integrated circuits (ICs). The disclosed technology can be used on a wide range of ICs, such as security controllers and memory devices.

[0032] In some embodiments, an IC includes a non-volatile memory (NVM) configured to store the operating state of the IC. Most of the embodiments described herein are related to one-time programmable memories. However, the disclosed technology can be used on other types of NVMs, such as flash memories or EEPROMs (electrically erasable programmable read-only memories). In this context, the term "operating state" is indicated as the state at the life cycle level of the IC. Here, the terms "operating state" and "life cycle state" are used interchangeably. Non-limiting examples of the operating state include DEFAULT (newly manufactured, virgin IC), TEST (IC for testing), DEVELOP (IC in development), OPERATION (operating IC provided to the user), and RMA (IC returned to the manufacturer, e.g., due to a fault).

[0033] At different life cycle levels, different operating states can enable different access permissions to IC resources for proper handling of the IC. For example, an IC in the DEFAULT state is typically assumed not to hold any sensitive information, so the above state relatively permits the user to access IC resources. Since testing is usually performed in the absence of sensitive resources, the TEST mode is generally relatively permissive and unrestricted access is required for proper testing. On the other hand, in the OPERATION state, the IC in the user system is assumed to be fully operational and may contain sensitive information. Thus, the OPERATION state is typically restricted to allow the user to access IC resources.

[0034] In an exemplary implementation, during the power-on sequence of the IC, appropriate access permissions are enabled or disabled. In this implementation, the IC includes a power-on circuit that performs the power-on sequence of the IC. As part of the power-on sequence, the power-on circuit reads the operating state of the IC from the NVM to enable or disable access to different resources based on the read operating state.

[0035] However, this type of power-on sequence may be subject to security attacks. For example, an attacker may attempt to cause the power-on circuit to misread the operating state, in the hope that the power-on circuit of the IC determines more allowed operating states than the actual operating state. In a possible attack scenario, the attacker may attempt to set an intermediate supply voltage, for example, via subtle voltage control or voltage spike insertion, to make the power-on circuit think it is valid, but in the above state, the NVM is not completely stable. With these possibilities on the supply voltage, such as the NVM returning incorrect data when read, and the above incorrect data may be interpreted by the power-on circuit as an allowed operating state.

[0036] In some embodiments, the power-on circuit mitigates the vulnerabilities described above by establishing a more stringent supply voltage range and rereading the operating state from the NVM. In some embodiments, the power-on circuit performs a first read of the operating state from the NVM when the IC supply voltage is verified to be within a first voltage range. When the operating state of the NVM read from the first read is a state that allows access to sensitive resources of the IC, such as DEFAULT or TEST, then the power-on circuit verifies whether the supply voltage is within a second voltage range that is more stringent than the first voltage range, and performs a second read of the NVM from the operating state. If a difference is found between the operating states read from the first read and the second read, then the power-on circuit initiates an appropriate reaction action. The second voltage range may be more stringent (narrower) than the first voltage range at its upper limit, lower limit, or both.

[0037] For example, the power-on circuit may implement different thresholds for the minimum required supply voltage for the first read and the second read. In other words, the power-on circuit verifies that the supply voltage is within the first voltage range by verifying that the supply voltage has reached at least a first voltage. The power-on circuit verifies that the supply voltage is within the second voltage range by verifying that the supply voltage has reached at least a second voltage higher than the first voltage.

[0038] In some implementations, the first voltage (the voltage threshold set for the first read of the NVM) is within the operating range of the functional circuit of the IC, but below the operating voltage range of the NVM. The second voltage (the voltage threshold set for the second read of the NVM) is within the operating range of the NVM.

[0039] Different exemplary implementations and variations of the disclosed technology are described herein.

[0040] [System Description]

[0041] Figure 1For an embodiment in accordance with the present invention, a block diagram of a security IC 20 is schematically illustrated. The security IC 20 may include, for example, a security controller used, particularly for performing cryptographic operations, and a secure memory for storing sensitive information or other suitable types of ICs.

[0042] The IC 20 includes functional circuitry 24. The term "functional circuitry" relates to circuitry that is configured to perform the designated functions of the IC 20, for example, different processing and / or data storage operations. In this example, the functional circuitry 24 may be accessed via an interface 26. The interface 26 may include, for example, a suitable serial or parallel bus that is normally used for communication between the IC 20 and a host or a tester.

[0043] The IC 20 also includes an OTP memory 28 (also abbreviated as OTP) that stores the current life cycle state 32 of the IC 20. As described above, most of the examples are related to OTP as follows, but the disclosed technology may also be applied to other types of non-volatile memories. In addition to the life cycle state 32, the OTP 28 may store any other suitable information.

[0044] The various elements in the IC 20, including the functional circuitry 24 and the OTP 28, are driven by a supply voltage labeled Vcc and referenced to ground GND.

[0045] In some embodiments, the IC 20 includes a power-on circuit 40 that performs the power-on process (also referred to as the power-on procedure) of the IC. In this document, the term "power-on procedure" refers to the process of the initial operation of the IC when an external supply voltage Vcc is applied.

[0046] In one embodiment, the IC 20 includes a voltage sensor 36 that is connected between Vcc and GND and senses the level of the supply voltage Vcc. In this embodiment, the voltage sensor 36 is configured to compare Vcc with a threshold and output an indication of whether Vcc is higher or lower than the threshold. As described below, to protect the power-on timing, the power-on circuit 40 has the ability to modify the threshold. In an alternative embodiment, a voltage sensor with two separate thresholds, or two separate voltage sensors with different respective thresholds, may be used instead of a single adjustable threshold.

[0047] The configuration of the IC 20 and the elements thereof, such as Figure 1As shown, it is an exemplary configuration depicted purely for the sake of clarity and comprehensibility of the concept. In alternative embodiments, any other suitable device may be used. In different embodiments, IC 20 and its components are implemented by any suitable hardware, such as in an Application-Specific Integrated Circuit (ASIC) or a Field-Programmable Gate Array (FPGA).

[0048] In some embodiments, some or all of the functions in the power-on circuit 40 will be executed by a general-purpose processor, which is programmed by software to execute the functions described herein. The software is securely pre-programmed in a Read-Only Memory (ROM) accessible by the processor, or downloaded electronically to the processor via a network, for example, or alternatively provided and / or stored in a non-transitory tangible medium, such as magnetic storage, optical storage, or electronic storage.

[0049] [Protect the power-on timing by a tight OTP supply voltage range]

[0050] As described above, IC 20 can enable different access permissions to its resources in different lifecycle states. Lifecycle states, such as DEFAULT and TEST, are typically more permissive, whereas the OPERATION state is typically restricted to allow access to IC resources.

[0051] In this context, the term "resource" is related to the information stored in the memory of the IC, such as the functional circuit 24 or other different hardware circuits in IC20, and also, for example, the functional circuit 24 or other circuits that can be configured or monitored. The term "resource" is also related to the functions, capabilities, or operations to be executed. For example, debugging capabilities may be allowed in some lifecycle states but not in others. In this embodiment, the user accesses various resources in the IC through the interface 26. However, generally, access to the resources can be built into the IC, for example, by internal hardware or software.

[0052] In a typical example, the power-on circuit 40 reads the lifecycle state 32 from the OTP 28 during the power-on timing, and then enables or disables appropriate access to resources according to the read lifecycle state. Any suitable resources in IC 20 can be managed according to the above method.

[0053] Unless properly protected, the above power-on timing is vulnerable to malicious attacks. For example, consider the following real example:

[0054] In the DEFAULT state, the OTP 28 is "virgin", i.e., not yet programmed, so the reading of the life cycle state 32 will return to all zeros. Other life cycle states (e.g., OPERATION) are represented by other values (not all zeros) of the life cycle state 32 stored in the OTP 28. Note that this DEFAULT state is not actively stored as a value in the OTP 28, but rather, in an unprogrammed OTP memory, this known all-zero state is interpreted as the DEFAULT state.

[0055] The operating voltage range of the OTP 28 is more stringent than that of the functional circuit 24. Specifically, there is an intermediate voltage Vint that is within the guaranteed operating range of the functional circuit 24 but outside the guaranteed operating range of the OTP 28. In a typical use case, the operating range of the OTP 28 is between 2.0 and 3.6 V, while the operating voltage range of the functional circuit 24 (or at least a part of the functional circuit responsible for startup) is 1.8 to 3.6 V. In the above non-limiting example, any voltage between 1.8 and 2.0 V is within the guaranteed operating range of the functional circuit 24 but outside the guaranteed operating range of the OTP 28.

[0056] Without proper protection, when the operating voltage Vcc is set such that Vcc equals Vint, the functional circuit 24 is operating but the OTP 40 may return unexpected data when read. An attacker may attempt to apply Vcc equal to Vint to the IC 20, which is in the OPERATION state (or other non-DEFAULT states that allow access to sensitive resources). At the above supply voltage, there is a possibility that the power-on circuit 40 reads the life cycle state 32 from the OTP 28, and the OTP will erroneously return all zeros instead of the correct value of the life cycle state 32. According to the permissions of the DEFAULT state, this incorrect reading will cause the power-on circuit 40 to enable access to the resources, even though the IC 20 is actually in the OPEARTION state. When Vcc equals Vint, the attacker can perform repeated power-on attempts to increase the likelihood of a successful attack.

[0057] In some embodiments, when the reading of the life cycle state 32 returns to all zeros, the power-on circuit 40 protects the IC 20 from the above type of attack by requiring a more stringent voltage range.

[0058] Figure 2 For an embodiment in accordance with the present invention, a flowchart of a secure power-on sequence implemented by the power-on circuit 40 in the IC 20 is schematically illustrated. At the start of the process, the voltage threshold of the voltage detector 36 is activated to an operating threshold denoted as V1. V1 is selected to be within the guaranteed operating voltage range of the functional circuit 24 but can be lower than the guaranteed operating voltage range of the OTP 28.

[0059] At voltage confirmation step 50, based on the indication provided by voltage detector 36, power-on circuit 40 confirms whether Vcc is greater than V1. Under normal conditions, when power is applied to IC 20, Vcc gradually rises until it enters a specific voltage range. As long as Vcc is less than V1, the method returns to step 50. At release step 54, when Vcc is greater than V1, power-on circuit 40 releases functional circuit 24 from reset.

[0060] At first read step 58, power-on circuit 40 reads the life cycle status 32 from OTP 28, possibly following a specific time delay for stabilization. At status confirmation step 62, power-on circuit 40 confirms whether the read life cycle status is in the DEFAULT state. If not, at normal operation step 66, power-on circuit 40 implements a complete power-on timing and starts normal operation of the IC.

[0061] On the other hand, if the result of step 62 is that the read life cycle status, the above status is the DEFAULT state (e.g., when OTP 28 has returned to all zeros), then at threshold increase step 70, power-on circuit increases the voltage threshold of voltage detector 36 to a value higher than V1, denoted as the threshold V2. V2 is selected within the guaranteed operating voltage range of OTP 28.

[0062] At second read step 74, with the voltage threshold V2 increased, power-on circuit 40 rereads the life cycle status 32 from OTP 28. In one embodiment, power-on circuit 40 may enforce a waiting period, which is at least a preset duration, and between the first read at step 58 and the second read at step 74 (if the supply voltage Vcc does not reach V2, the process stops).

[0063] At status reconfirmation step 78, power-on circuit 40 confirms whether the read life cycle status is still in the DEFAULT state. If so, since the second read is performed with Vcc within the guaranteed operating range of OTP 28, power-on circuit 40 concludes that no attack is suspected and the life cycle status of IC 20 is indeed in the DEFAULT state. Therefore, power-on circuit 40 continues with normal operation step 66.

[0064] Otherwise, for example, when the second read of the life cycle state 32 from the OTP 28 does not return to DEFAULT (all zeros), the power-on circuit initiates a reaction operation. Such a difference between the second read (performed when the OTP 28 is considered operational and stable) and the first read (performed at the initial voltage threshold V1) may indicate an attack. The power-on circuit 40 can implement any suitable reaction operation, such as issuing an alarm, disabling part or all of the IC 20, resetting the IC 20, clearing part or all of the data from the IC 20, etc.

[0065] In principle, it may be possible to protect the power-on timing by other means. For example, it is feasible to define the DEFAULT state as a non-permitted state, and this above state cannot access any sensitive resources. For example, only a transition to the TEST state is allowed. As another embodiment, whenever the functional circuit operates, it is feasible to use very accurate voltage detection to ensure that the OTP operates. However, another possibility is to use a dedicated voltage detection to drive the OTP. However, all of the above solutions are very complex in terms of implementation or restricted operational flexibility compared to the technology disclosed herein.

[0066] [Additional Embodiments and Variations]

[0067] In other embodiments, the OTP 28 is configured to store calibration data for the voltage detector 36 and the calculated error detection bits in the above calibration data. The calibration data typically compensates for variations in the voltage detector 36, such as those due to temperature or relative to some "gold standard" detector. The error detection bits can include, for example, Cyclic Redundancy Check (CRC) codes, parity bits, Secure Hash Algorithm (SHA) digests, Hash-based Message Authentication Code (HMAC) along with an on-chip key or other signature, or any other suitable code. The error detection bits are typically assigned at least a predetermined protection level.

[0068] Verification of errors can be performed by reading the calibration data and error detection bits from the OTP, recalculating the error detection bits from the above calibration data, and comparing the recalculated error detection bits with the error detection bits read from the OTP. An unburned OTP (e.g., in the DEFAULT state) typically does not contain calibration data and will therefore fail the test.

[0069] In some embodiments, the power-on circuit 40 uses the presence or absence of calibration data containing valid error detection bits as a means to determine whether the OTP 28 is in the DEFAULT state. For example, in Figure 2In step 62, the power-up circuit 40 may attempt to read the above correction data and error detection bits from the OTP 28. When an error is detected, the power-up circuit 40 determines that the OTP is in the DEFAULT state and proceeds to step 70.

[0070] The embodiments described above are merely exemplary, and the present invention is not limited to those shown and described above. Rather, the scope of the present invention encompasses combinations and sub-combinations of the various features described above, and variations and modifications thereof will occur to those skilled in the art upon reading the foregoing description and the disclosure of the prior art. Documents incorporated by reference into this patent application are considered a part of this application, and only the definitions in this specification shall be considered, except for any terms defined in the incorporated documents that conflict with these expressly or implicitly defined terms.

Claims

1. An integrated circuit, characterized in that, Comprising: A non-volatile memory configured to store the operating state of the integrated circuit; And A secure power-on circuit configured to perform: During the power-on sequence of the integrated circuit, when the supply voltage of the integrated circuit is within a first voltage range, perform a first read of the operating state stored in the non-volatile memory; When the operating state obtained from the first read of the non-volatile memory is a state that allows access to sensitive resources of the integrated circuit, verify whether the supply voltage is within a second voltage range that is tighter than the first voltage range. If so, perform a second read of the operating state stored in the non-volatile memory; and Initiate a response action in response to a difference between the operating state obtained from the first read of the non-volatile memory and the operating state obtained from the second read of the non-volatile memory.

2. The integrated circuit according to claim 1, wherein The secure power-on circuit is configured to verify that the supply voltage is within the first voltage range by verifying that the supply voltage has reached a first voltage, and to verify that the supply voltage is within the second voltage range by verifying that the supply voltage has reached a second voltage that is higher than the first voltage.

3. The integrated circuit according to claim 2, wherein, The first voltage is within the operating voltage range of the functional circuits of the integrated circuit but lower than the operating voltage range of the non-volatile memory, and wherein the second voltage is within the operating voltage range of the non-volatile memory.

4. The integrated circuit according to claim 1, characterized in that, The state that allows access to the sensitive resources is a preset state indicating that the integrated circuit is a newly manufactured integrated circuit.

5. The integrated circuit according to claim 1, characterized in that, The state that allows access to the sensitive resources is a test state.

6. The integrated circuit according to claim 1, wherein, The non-volatile memory includes a one-time programmable memory.

7. The integrated circuit according to claim 1, wherein, The secure power-on circuit is configured to wait for at least one preset time period between the first read and the second read.

8. The integrated circuit according to claim 1, wherein, The non-volatile memory is further configured to store calibration data of a voltage detector of the integrated circuit and an error detection code calculated from the calibration data; And wherein the secure power-on circuit is configured to read the calibration data and the error detection code during the first read and perform the second read in response to an error detected by the error detection code.

9. The integrated circuit according to claim 1, wherein The secure power-on circuit is configured to compare the supply voltage with the first voltage range and the second voltage range by correcting at least one adjustable threshold in a voltage detector used to detect the supply voltage.

10. The integrated circuit according to claim 1, characterized in that, The secure power-on circuit is configured to use a first voltage detector and a second voltage detector for detecting the supply voltage to compare the supply voltage with the first voltage range and the supply voltage with the second voltage range, respectively.

11. A method for protecting the power-on timing of an integrated circuit, characterized in that, The method includes: During the power-on timing of the integrated circuit, when the supply voltage of the integrated circuit is within a first voltage range, perform a first read of the operating state of the integrated circuit stored in a non-volatile memory; When the operating state obtained from the first read of the non-volatile memory is a state that allows access to sensitive resources of the integrated circuit, verify whether the supply voltage is within a second voltage range that is tighter than the first voltage range. If so, perform a second read of the operating state stored in the non-volatile memory; and Initiate a reaction operation to respond to the difference between the operation state obtained by the first read from the non-volatile memory and the operation state obtained by the second read from the non-volatile memory.

12. The method according to claim 11, wherein It also includes verifying that the supply voltage has reached a first voltage to verify that the supply voltage is within the first voltage range, and verifying that the supply voltage has reached a second voltage higher than the first voltage to verify that the supply voltage is within the second voltage range.

13. The method according to claim 12, wherein The first voltage is within the operating voltage range of the functional circuits of the integrated circuit but lower than the operating voltage range of the non-volatile memory, and the second voltage is within the operating voltage range of the non-volatile memory.

14. The method according to claim 11, wherein The state that allows access to the sensitive resource is a preset state indicating that the integrated circuit is a newly manufactured integrated circuit.

15. The method according to claim 11, wherein The state that allows access to the sensitive resource is a test state.

16. The method according to claim 11, wherein The non-volatile memory includes a one-time programmable memory.

17. The method according to claim 11, wherein It also includes waiting for at least one preset time period between the first read and the second read.

18. The method according to claim 11, wherein It also includes, during the first read, reading calibration data of the voltage sensor of the integrated circuit from the non-volatile memory and an error detection code calculated from the calibration data, and performing the second read in response to an error detected by the error detection code.

19. The method according to claim 11, characterized in that, It also includes comparing the supply voltage with the first voltage range and the second voltage range by correcting at least one adjustable threshold in a voltage detector that detects the supply voltage.

20. The method according to claim 11, characterized in that, And it includes a first voltage detector and a second voltage detector that detect the supply voltage to respectively compare the supply voltage with the first voltage range and the supply voltage with the second voltage range.

Images