Integrated circuit device with capacitor

Abstract

An integrated circuit device is provided. In some examples, an integrated circuit die (502) of the device includes a first capacitor (504) arranged such that, when the integrated circuit die (502) is coupled to a package (518), the package (518) affects a capacitance of the first capacitor (504), a second capacitor (506) disposed directly below the first capacitor (504), and a capacitance measurement circuit (508) coupled to the first capacitor (504) and the second capacitor (506) to determine the capacitance of the first capacitor (504) and a capacitance of the second capacitor (506). The integrated circuit device can detect tampering with the die (502) and / or the package (518) based on the capacitances of the first capacitor (504) and the second capacitor (506).

Description

Background Technology

[0001] Integrated circuits can contain any number of electrically interconnected active circuit elements (e.g., bipolar junction transistors, field-effect transistors, etc.) and / or passive circuit elements (e.g., resistors, capacitors, inductors, diodes, transformers, etc.). These circuit elements can be fabricated on a semiconductor substrate and connected by a multilayer electrical interconnect structure disposed on the substrate. The semiconductor substrate housing the circuit elements and multilayer electrical interconnects can be assembled into a die or chip.

[0002] Dies are often small and fragile. Therefore, one or more dies can be incorporated into an integrated circuit package. The package surrounds and protects the incorporated dies. For this purpose, the package may include a rigid insulating material layer. The package may also include a conductive material layer that extends through the insulating material to form a package-level interconnect structure. Package-level interconnects electrically couple the dies to each other and to the rest of the computing system. Specifically, package-level interconnects may include several connectors, such as ball grid array connectors, that couple to receptacles to provide power and data signals to and from the dies. Summary of the Invention

[0003] In some instances, an integrated circuit die and package are provided. The die includes one or more sets of tamper-sensing capacitors. The tamper-sensing capacitors can be configured to detect disallowed modifications to the die and / or the package. In some such instances, a set of tamper-sensing capacitors includes a first capacitor formed in die interconnects near the package and a second capacitor formed directly below the first capacitor. The first capacitor is configured such that its capacitance changes when the package is tampered with (e.g., by removing some or all of the package). The second capacitor near the first capacitor can be used as a reference for detecting changes in the first capacitor, and in some instances, tampering determination is based on a comparison of the capacitance of the first capacitor and the capacitance of the second capacitor.

[0004] In some instances, the integrated circuit die includes a first capacitor such that when the die is coupled to a package, the package affects the capacitance of the first capacitor. The die further includes a second capacitor disposed directly below the first capacitor and includes capacitance measurement circuitry coupled to the first and second capacitors to determine the capacitances of the first and second capacitors. In some such instances, the die includes a multilayer interconnect. The first capacitor includes a first capacitor plate in a first layer of the multilayer interconnect and a second capacitor plate surrounding the first capacitor plate in the first layer of the multilayer interconnect. In some such instances, the die further includes a set of conductive shielding features disposed between the first and second capacitors in a second layer of the multilayer interconnect. In some such instances, the second capacitor includes: a first capacitor plate containing conductive features in the second layer of the multilayer interconnect; and a second capacitor plate containing conductive features surrounding the conductive features of the first capacitor plate in the second layer. In some such instances, the first capacitor plate of the second capacitor further includes conductive features in a third layer of the multilayer interconnect, and the second capacitor plate of the second capacitor further includes conductive features in the third layer. In some such examples, the integrated circuit die further includes a substrate disposed beneath the second capacitor and a set of conductive shielding features disposed between the second capacitor and the substrate. In some such examples, the capacitance measurement circuit is configured to provide the ratio of the capacitance of the first capacitor to the capacitance of the second capacitor. In some such examples, the integrated circuit die further includes encryption control circuitry coupled to the capacitance measurement circuitry to receive the ratio of the capacitance of the first capacitor to the capacitance of the second capacitor. In some such examples, the encryption control circuitry detects tampering based on the ratio of the capacitance of the first capacitor to the capacitance of the second capacitor. In some such examples, the encryption control circuitry is configured to attempt to decrypt an encryption key based on the ratio. In some such examples, the encryption control circuitry is configured to delete an encryption key based on the ratio.

[0005] In another example, the integrated circuit includes a die comprising: a first capacitor; a second capacitor disposed in proximity to the first capacitor; a capacitance measurement circuit coupled to the first capacitor and the second capacitor to determine the capacitance of the first capacitor and the capacitance of the second capacitor; and circuitry that determines tampering with the integrated circuit based on the capacitance of the first capacitor and the capacitance of the second capacitor.

[0006] In yet another example, the computing system includes processing resources and non-transitory computer-readable media coupled to the processing resources. The non-transitory computer-readable media stores instructions that, when executed by the processing resources, cause the processing resources to: receive the capacitance of a first capacitor holding a die, receive the capacitance of a second capacitor holding the die, and detect tampering based on the ratio of the capacitance of the first capacitor to the capacitance of the second capacitor. Attached Figure Description

[0007] Examples are described in the following detailed implementation and accompanying drawings. In this regard:

[0008] Figure 1 This is a cross-sectional view of a portion of an example integrated circuit device.

[0009] Figure 2 This is an exploded view of a portion of an example integrated circuit die.

[0010] Figure 3 This is an exploded view of a portion of an example integrated circuit die.

[0011] Figure 4 This is an exploded view of a portion of an example integrated circuit die.

[0012] Figure 5 This is a block diagram of an instance computational system that includes a tamper detection capacitor.

[0013] Figure 6 This is a flowchart of a method for using a computing system to detect instances of tampering. Detailed Implementation

[0014] Specific examples are described in detail below with reference to the accompanying drawings. These examples are not limiting, and unless otherwise stated, no particular example requires any feature. Furthermore, the formation of a first feature above or on a second feature in the following description may include instances where the first and second features are formed in direct contact, and instances where additional features are formed between the first and second features such that the first and second features are not in direct contact.

[0015] The relative terms used to describe orientation (such as "above", "below", "over", "under", "up") are provided for clarity and are not absolute relationships. For example, if the orientation of the device is reversed, then the first element "above" the second element can be precisely described as "below" the second element.

[0016] This description provides a die having one or more sets of capacitors for detecting whether the die or its package has been tampered with. In some instances, the die includes a first capacitor located near a portion of the die that is at risk of tampering, such as a substrate or package. The first capacitor may be configured such that the electric field of the capacitor is controlled only by the package or substrate and is protected from the influence of other electric fields in the surrounding area. If the die is depackaged or otherwise tampered with, the capacitance of the first capacitor is affected, and the change in capacitance can be used to detect the intrusion.

[0017] Because the capacitance of the first capacitor can be sensitive to other environmental factors, the die may contain a second capacitor located close to the first capacitor for use as a reference. The second capacitor can share the same environment but is relatively unaffected by changes in packaging or substrate. In many instances, the ratio between the capacitances of the first and second capacitors (which comprises the capacitance of the first capacitor divided by the capacitance of the second capacitor, and vice versa) remains stable across temperature and voltage variations while still producing detectable changes in the event of tampering. This provides a reliable and cost-effective mechanism for detecting tampering, applicable to a wide variety of die and packaging materials. In many instances, due to the small size and negligible cost of each capacitor bank, the die may contain multiple sets of capacitors distributed throughout the die, providing even higher sensitivity.

[0018] While the capacitance ratio of a capacitor bank can be fixed for a given die, it can vary significantly across the die. Therefore, in some instances, the capacitance ratio is used as a chip identifier and for encryption. Encryption keys or other security data are based on the capacitance ratio. This protects secure data from de-packaging attacks because the attack alters the capacitance ratio, and once the original capacitance ratio is lost, the system cannot decrypt the secure data.

[0019] Refer to the diagram below to describe an example of an integrated circuit device. In this regard, Figure 1 This is a cross-sectional view of a portion of an integrated circuit device 100 in some examples. The integrated circuit device 100 includes an integrated circuit die 102 coupled to an integrated circuit package 104.

[0020] The integrated circuit die 102 includes a substrate 106 on which integrated circuit elements (e.g., transistors, diodes) are formed. In various examples, the substrate 106 comprises one or more layers of elemental semiconductor materials (e.g., bulk silicon, bulk germanium), compound semiconductor materials (e.g., silicon germanium, silicon carbide, gallium arsenide, gallium phosphide, indium phosphide, indium arsenide, indium antimonide), and / or dielectric materials (e.g., semiconductor oxides, semiconductor nitrides, semiconductor oxide nitrides, semiconductor carbides). For forming integrated circuit elements, regions of the substrate 106 may be doped with n-type dopants such as phosphorus or arsenic, or p-type dopants such as boron or BF2.

[0021] A die-level interconnect structure 108 is disposed on a substrate 106 and includes an interlayer dielectric (ILD) layer 110 and conductive features extending through the ILD layer 110. Each ILD layer 110 may contain a suitable dielectric material (e.g., semiconductor oxide, semiconductor nitride, semiconductor oxide nitride, semiconductor carbide). The dielectric material may be characterized by its dielectric constant relative to silicon oxide, and in some instances, the ILD layer 110 contains a low-k dielectric material, such as hydrogen silsesquioxane (HSQ), silicon oxyfluoride, silicon oxycarbide, and fluorinated amorphous carbon.

[0022] Conductive features extend through ILD layer 110 to carry signals and power between integrated circuit elements on die 102. These features may be defined between predominantly horizontally extending conductor layers 112 to 124 and predominantly vertically extending conductor layers 126 to 136. For ease of reference, the horizontal conductor layers are referred to as M1 layer 112, M2 layer 114, M3 layer 116, M4 layer 118, M5 layer 120, M6 layer 122, and M7 layer 124; and the vertical conductor layers are referred to as V1 layer 126, V2 layer 128, V3 layer 130, V4 layer 132, V5 layer 134, and V6 layer 136. The conductive features within layers 112 to 136 may comprise any suitable conductive material, such as copper, aluminum, gold, silver, nickel, tungsten, and / or alloys thereof.

[0023] In addition to carrying signals and power, the conductive features of interconnect 108 can be used to form other structures. In some instances, these include a first capacitor 138 disposed in one of the upper ILD layers 110 near package 104 and a second capacitor 140 disposed directly below the first capacitor 138. The first and second capacitors 138 and 140 can have any suitable shape and structure. Thus, in some instances, the first capacitor 138 includes a first set of plates 142 (indicated by a first shading pattern) and a second set of plates 144 (indicated by a second shading pattern), the second set of plates 144 being horizontally disposed between and alongside the first set of plates 142. The first and second sets of plates 142 and 144 can be formed by features of one of the uppermost conductor layers (e.g., M6 layer 122, M7 layer 124), and the features forming the first set of plates 142 can be electrically coupled to each other through features in the same conductor layer located outside the cross-sectional plane. Similarly, the features forming the second set of plates 144 can be electrically coupled to each other through features in the same conductor layer located outside the cross-sectional plane.

[0024] Furthermore, capacitors 138 and 140 may be formed by features on more than one conductor layer. For example, the second capacitor 140 may include features forming a first set of plates 146 (indicated by a first shading pattern) and a second set of plates 148 (indicated by a second shading pattern) in layers M2 114 and M3 116. The features forming the first set of plates 146 in layer M2 114 can be electrically coupled to the features forming the first set of plates 146 in layer M3 116 via features in layer V2 128, and the features forming the second set of plates 148 in layer M2 114 can be electrically coupled to the features forming the second set of plates 148 in layer M3 116 via features in layer V2 128.

[0025] Other conductive features can be used to control the electric fields of the first and second capacitors 138 and 140. In some instances, interconnect 108 includes conductive features forming an isolation shield in M1 layer 112 to decouple the second capacitor 140 from the substrate 106, and features forming an isolation shield in M4 layer 118 and / or M5 layer 120 to decouple the first capacitor 138 from the second capacitor 140. Where the isolation shield includes slots or other recesses, slots in adjacent conductor layers may be offset to obtain better shielding. The isolation shield may be coupled to a ground or constant voltage source.

[0026] In this configuration, the first capacitor 138 is shielded below by features on layers M4 118 and M5 120, and the shape and strength of the electric field top of the capacitor are controlled by package 104. As long as package 104 is not tampered with, the first capacitor 138 can provide a relatively constant capacitance, except for fluctuations caused by environmental factors (such as temperature or voltage fluctuations). Similarly, the second capacitor 140 is shielded above and below, and therefore can provide a relatively constant capacitance except for fluctuations caused by environmental factors.

[0027] Thus, the second capacitor 140 can be used to correct these fluctuations in the first capacitor 138. In some instances, the capacitance ratio of the first capacitor 138 to the second capacitor 140 has proven to be relatively stable over a wide range of temperature and external influences. Therefore, this ratio provides a mechanism to account for environmental factors. If package 104 is tampered with as part of a depackaging process or other attack, the capacitance ratio of the first capacitor 138 to the second capacitor 140 will change. In the examples below, this change will be used to detect tampering and take remedial action, such as preventing encryption or decryption by the bare die 102.

[0028] Next, the die 102 is attached to a package 104, which includes a package-level interconnect structure 150 comprising one or more dielectric layers 152 and an interconnect conductor network 154. The dielectric layers 152 provide physical support and isolation and may contain a dielectric material selected to be rigid, impermeable to air and moisture, and providing good crack resistance. Each dielectric layer 152 may contain different materials based on its location and purpose, and the outer dielectric layer 152 may contain a solder resist to control solder flow when coupling the package 104. Intermediate dielectric layers 152 may contain a resin laminate.

[0029] Outside of package 104, package-level interconnect structure 150 may include package interconnect connectors 156, such as ball grid array connectors, shore grid array connectors, pin grid array connectors, and / or surface mount leads. A first subset of interconnect connectors 156 is coupled to a receptacle, while a second subset of interconnect connectors 156 is coupled to bonding pads on die 102. Thus, package-level interconnect structure 150 carries signals and power between the receptacle and the integrated circuit elements on die 102.

[0030] During die mounting, the bonding pads of die 102 can be electrically coupled to package 104 using appropriate techniques, such as soldering, thermo-ultrasonic bonding, ultrasonic bonding, epoxy die mounting, and / or other suitable techniques. Many of these techniques also provide a degree of physical coupling, as the material of the electrically coupled bonding pads (e.g., solder, underfill material) also physically couples the top or face of die 102 to package 104. To further secure die 102 and prevent the intrusion of air and / or moisture, a molding compound can be applied to the top, sides, and / or bottom of integrated circuit die 102. The molding compound may contain an epoxy resin having one or more fillers, catalysts, flame retardants, adhesion promoters, and / or other additives, and may be configured to form a hermetically sealed area around die 102. Suitable molding compounds include epoxy cresol (ECN) resins and other types of resins.

[0031] The integrated circuit die 102 can be physically coupled to the package 104 in any suitable configuration. For example, the integrated circuit die 102 can be coupled to a flip-chip arrangement opposite a subset of the package interconnect connectors 156 coupled to the receptacle. In other instances, the integrated circuit die 102 is coupled in a bottom-mount arrangement, wherein the integrated circuit die 102 and the subset of the package interconnect connectors 156 coupled to the receptacle are located on the same side of the package, or in an embedded arrangement, wherein the integrated circuit die 102 is disposed between the dielectric layers 152 of the package 104.

[0032] refer to Figure 2 Describes some suitable configurations for tamper-sensing capacitors in integrated circuit devices. Figure 2This is an exploded view of a portion of an integrated circuit die 200 in some examples.

[0033] In many respects, the integrated circuit die 200 is substantially similar to the die 102, and the die 200 includes a substrate 106 and conductor layers 112 to 136, which may be substantially similar to those described above. For clarity, the substrate 106 and conductor layers 112 to 136 have been separated in the vertical direction, and the ILD layer 110 in which conductive features are disposed is omitted.

[0034] In layer M1 112, the die 200 may include conductive features as part of a first set of shielding elements 202. The shielding elements 202 may comprise a single, integral conductive feature extending beneath the entire capacitor, or a set of conductive features separated by regions of dielectric material. The shielding elements 202 may be electrically coupled to ground or a voltage source.

[0035] In layers 114 and 116 of M2 and M3, die 200 contains similar... Figure 1 The capacitor of the second capacitor 140. For consistency, this capacitor of the die 200 is designated as the second capacitor 204. The second capacitor 204 provides a reference capacitance for another tamper-sensing capacitor of the die 200. The second capacitor 204 may contain any number of features on any number of layers, and in the illustrated example, it includes a first set of M2 and M3 conductive features forming the first capacitor plate 206 and a second set of M2 and M3 conductive features forming the second capacitor plate 208. The M2 features forming the first capacitor plate 206 can be coupled to the M3 features forming the first capacitor plate 206 through vias in the V2 layer 128, and the M2 features forming the second capacitor plate 208 can be coupled to the M3 features forming the second capacitor plate 208 through other vias in the V2 layer 128.

[0036] The second capacitor 204 can have any suitable configuration, and the illustrated example represents a box-in-box configuration. The first capacitor plate 206 of the box-in-box capacitor includes a central portion extending in the M2 layer 114 along a first direction 210 and a plurality of side portions extending in the M2 layer 114 along the first direction 210 on the sides opposite to the central portion. The side portions are coupled to the central portion via portions extending in a second direction 212 perpendicular to the first direction 210. The second capacitor plate 208 includes a central portion extending in the M2 layer 114 along the first direction 210 and a plurality of side portions extending in the M2 layer 114 along the first direction 210 on the sides opposite to the central portion. The side portions of the second capacitor plate 208 are coupled to the central portion via portions extending in the second direction 212. Specifically, the central portion and side portions of the second plate 208 are configured to extend between and around the central portion and side portions of the first plate 206. The first and second capacitor plates 206 and 208 may have similar shapes and configurations in the M3 layer 116.

[0037] In another example, the first and second capacitor plates 206 and 208 may have different shapes in the M2 layer 114 and M3 layer 116, while still accommodating the electric field of the second capacitor 204 between the shields 202, 214 and 216 and within the outermost plate (e.g., capacitor plate 208). To further confine the electric field, additional conductive features within the M2 layer 114, M3 layer 116 and V2 layer 128 may be arranged side-by-side with the first and second capacitor plates 206 and 208 to make the second capacitor 204 insensitive to its surrounding environment.

[0038] In these and other arrangements, the bulk of the electric field of the second capacitor 204 extends horizontally within the layer and vertically between layers M2 114 and M3 116. Vertically, the electric field is shielded by a first set of shielding elements 202 in layer M1 112 and other shielding elements described later. Of course, this is merely one example configuration of the second capacitor 204, and other configurations are considered and provided.

[0039] The die 200 may contain any number of shielding material layers disposed on the second capacitor 204. In the illustrated example, the die 200 includes conductive features that form a second set of shielding elements 214 and a third set of shielding elements 216 in layers M4 118 and M5 120, respectively. Shielding elements 214 and 216 may comprise a single, integral conductive feature extending beneath the entire capacitor, or a set of conductive features separated by regions of dielectric material. In an example where shielding elements 214 and 216 comprise regions of dielectric material between conductive features, the dielectric material regions may be horizontally offset to avoid a direct path through the dielectric material between the second capacitor 204 and the first capacitor, as described below. Shielding elements 214 and 216 may be electrically coupled to ground or a voltage source.

[0040] At or near the top metal layer, die 200 contains similar... Figure 1 The first capacitor 138 is a capacitor. For consistency, this capacitor is designated as the first capacitor 218. The first capacitor 218 is configured to have a capacitance that varies based on the package to which the die 200 is coupled, in order to detect whether the package has been tampered with. In some instances, this is achieved by forming the first capacitor 218 on one or more of the top layers of the die 200 such that no conductive shielding is formed between the first capacitor 218 and the package. In some instances where the first capacitor 218 is not formed on the top layer, the intermediate conductive layer is configured to have no conductive features directly between the first capacitor 218 and the package. Thus, there is little or no conductive shielding between the first capacitor 218 and the package.

[0041] The first capacitor 218 may include features on any number of layers. In the illustrated example, the first capacitor 218 includes a first set of M6 conductive features forming a first capacitor plate 220 and a second set of M6 conductive features forming a second capacitor plate 222. The features of the first capacitor 218 may have any suitable configuration, and the illustrated example represents a box-in-box configuration. The first capacitor plate 220 of the box-in-box capacitor includes a central portion extending in the M6 ​​layer 122 along a first direction 210 and a plurality of side portions extending in the M6 ​​layer 122 along the first direction 210 on opposite sides of the central portion. The side portions are coupled to the central portion through portions extending in a second direction 212. The second capacitor plate 222 includes a central portion extending in the M6 ​​layer 122 along the first direction 210 and a plurality of side portions extending in the M6 ​​layer 122 along the first direction 210 on opposite sides of the central portion. The side portions of the second capacitor plate 222 are coupled to the central portion through portions extending in the second direction 212. Specifically, the central portion and side portions of the second plate 222 are configured to extend between and around the central portion and side portions of the first plate 220.

[0042] In this arrangement, the electric field of the first capacitor 218 extends horizontally within the M6 ​​layer 122. Vertically below the first capacitor 218, the electric field is shielded by the second and / or third sets of shielding elements 214 and 216. However, vertically above the first capacitor 218, the shape and intensity of the electric field are partially determined by the dielectric and / or conductive characteristics of the package coupled directly above the first capacitor 218. Because any change in the dielectric or conductive characteristics of the package can produce a change in the capacitance of the first capacitor 218, this provides a mechanism for detecting when the package has been tampered with. Of course, this is merely one example configuration of the first capacitor 218, and other configurations are considered and provided.

[0043] Interconnects can be placed in various different ways or shapes. In many instances, for high efficiency, the first capacitor 218 is implemented using a metal layer (or an N-well in the case of a substrate). This capacitor 218 is surrounded by an outer plate layer (e.g., a second plate 222), which can be considered as the base plate in a striped capacitor structure. In this capacitor 218, the electric field can be contained by the outer plate 222, the second and third sets of shields 214 and 216, and the package on top. Because the spacing between the interconnects can be very small (e.g., less than a micrometer), this electric field does not diffuse very deeply into the package. In many instances, the depth to which it extends is essentially the same as the separation of the interconnects at this stage. This can be very small relative to the height of the package, and therefore, this ensures that the capacitor is insensitive to the environment outside the package.

[0044] The aforementioned configuration can be used to detect tampering with the package positioned above the die. (See reference) Figure 3 Other suitable configurations for tamper-sensing capacitors are described, which can be used to detect tampering from beneath the die, such as grinding, drilling, or other forms of substrate alteration. A single die may contain multiple sets of tamper-sensing capacitors of each type to prevent both types of intrusion. Figure 3 This is an exploded view of a portion of an integrated circuit die 300 in some examples.

[0045] In many respects, the integrated circuit die 300 is substantially similar to dies 102 and / or 200, and dies 300 includes a substrate 106 and conductor layers 112 to 136, which may be substantially similar to those described above. For clarity, substrate 106 and conductor layers 112 to 136 have been separated in the vertical direction, and ILD layer 110 in which conductive features are disposed is omitted.

[0046] In layer M1 112, die 300 includes a first capacitor 302 configured to have a capacitance varying based on the substrate 106 of die 300 to detect whether the substrate 106 has been tampered with. In some instances, the first capacitor 302 is formed on the bottom one or more layers of die 300, such that no conductive shielding is formed between the first capacitor 302 and the substrate 106. In some instances where the first capacitor 302 is not formed on the bottom layer, the intermediate conductive layer is configured to have no conductive features directly between the first capacitor 302 and the substrate 106. Thus, there is little or no conductive shielding between the first capacitor 302 and the substrate 106.

[0047] The first capacitor 302 may include features on any number of layers. In the illustrated example, the first capacitor 302 includes a first set of M1 conductive features forming a first capacitor plate 304 and a second set of M1 conductive features forming a second capacitor plate 306. The features of the first capacitor 302 may have any suitable configuration, and the illustrated example represents a box-in-box configuration, wherein the first capacitor plate 304 of the box-in-box capacitor includes a central portion and a plurality of side portions extending along a first direction 308 in an M1 layer 112. The side portions are coupled to the central portion via portions extending in a second direction 310 perpendicular to the first direction 308. The second capacitor plate 306 includes a central portion and a plurality of side portions extending along the first direction 308 in an M1 layer 112. The side portions of the second capacitor plate 306 are coupled to the central portion via portions extending along the second direction 310, and the central portion and side portions of the second plate 306 are arranged to extend between and around the central portion and side portions of the first plate 304.

[0048] In this arrangement, the electric field of the first capacitor 302 extends horizontally within layer M1 112. Vertically above the first capacitor 302, the electric field is shielded by sets of shielding elements 312 and 314, described below. Vertically below the first capacitor 302, the shape and intensity of the electric field are determined in part by the structure, shape, and materials (e.g., semiconductor materials, dopants, dielectric materials) present in the substrate 106 beneath the first capacitor 302. Because any change in the substrate 106 can produce a change in the capacitance of the first capacitor 302, this provides a mechanism for detecting when the substrate 106 has been tampered with. Of course, this is merely one example configuration of the first capacitor 302, and other configurations are considered and provided.

[0049] The die 300 may contain any number of shielding material layers disposed on the first capacitor 302. In the illustrated example, the die 300 includes conductive features of a first set of shielding elements 312 and a second set of shielding elements 314, respectively, in layers M2 114 and M3 116. Shielding elements 312 and 314 may comprise a single, integral conductive feature extending beneath the entire capacitor, or a set of conductive features separated by regions of dielectric material. In examples where shielding elements 312 and 314 comprise regions of dielectric material between conductive features, the dielectric material regions may be horizontally offset to avoid a direct path through the dielectric material between the second capacitor 316 and the first capacitor 302. Shielding elements 312 and 314 may be electrically coupled to ground or a voltage source.

[0050] Similar to Figure 1 The die 300 may include a second capacitor 316 disposed on shields 312 and 314, the second capacitor 316 providing a reference capacitance for the first capacitor 302. The second capacitor 316 may include features on any number of layers, and in the illustrated example, the second capacitor 316 includes conductive features of a first set of M4 layers 118 and M5 layers 120 forming the first capacitor plate 318, and conductive features of a second set of M4 layers 118 and M5 layers 120 forming the second capacitor plate 320. The M4 features forming the first capacitor plate 318 can be coupled to the M5 features forming the first capacitor plate 318 via vias in the V4 layer 132, and the M4 features forming the second capacitor plate 320 can be coupled to the M5 features forming the second capacitor plate 320 via other vias in the V4 layer 132.

[0051] The second capacitor 316 can have any suitable configuration, and the illustrated example represents a box-in-box configuration, wherein the first capacitor plate 318 of the box-in-box capacitor includes a central portion and a plurality of side portions extending along a first direction 308 in the M4 layer 118. The side portions are coupled to the central portion via portions extending along a second direction 310 perpendicular to the first direction 308. The second capacitor plate 320 includes a central portion and side portions extending along the first direction 308 in the M4 layer 118. The side portions of the second capacitor plate 320 are coupled to the central portion via portions extending along the second direction 310. Specifically, the central portion and side portions of the second plate 320 are arranged to extend between and around the central portion and side portions of the first plate 318. The first and second capacitor plates 318 and 320 can have similar shapes and configurations in the M5 layer 120.

[0052] In another example, the first and second capacitor plates 318 and 320 may have different shapes in the M4 layer 118 and M5 layer 120, while still accommodating the electric field of the second capacitor 316 between the shields 312, 314 and 322 and within the outermost plate (e.g., capacitor plate 320). To further limit the electric field, additional conductive features within the M4 layer 118, M5 layer 120 and V4 layer 132 may be arranged side-by-side with the first and second capacitor plates 318 and 320 to make the second capacitor 316 insensitive to its surrounding environment.

[0053] In these and other arrangements, the bulk of the electric field of the second capacitor 316 extends horizontally within the layers and vertically between layers M4 118 and M5 120. The electric field is shielded by first and second sets of shields 312 and 314 at the bottom and a third set of shields 322 (described below) at the top. Of course, this is only one example configuration of the second capacitor 316, and other configurations are considered and provided.

[0054] As described above, the bare die 300 may include a set of conductive features in the M6 ​​layer 122, which form a third set of shielding elements 322 disposed on the second capacitor. The shielding elements 322 may comprise a single, integral conductive feature extending over the entire capacitor, or a set of conductive features separated by regions of dielectric material. The shielding elements 322 may be electrically coupled to ground or a voltage source.

[0055] An additional configuration for detecting tampering with the bottom of the die uses a bottom capacitor formed by a doped region of substrate 106. Figure 4 This is an exploded view of a portion of an integrated circuit die 400 in some examples.

[0056] In many respects, the integrated circuit die 400 is substantially similar to dies 102, 200, and / or 300, and the die 400 includes a substrate 106 and conductor layers 112 to 136, which may be substantially similar to those described above. For clarity, the substrate 106 and conductor layers 112 to 136 have been separated in the vertical direction, and the ILD layer 110 in which conductive features are disposed is omitted.

[0057] The die 400 includes a first capacitor 402 formed by doped regions (doped regions 404 and 406) defining a capacitor plate on the substrate 106. Doped regions 404 and 406 can be doped with n-type or p-type dopants and are disposed in regions of the substrate 106 that contain intrinsic semiconductor material or semiconductor material doped to have a conductivity of the opposite type to that of regions 404 and 406 (e.g., n-type doped regions 404 and 406 are disposed in and surrounded by p-type regions of the semiconductor material, and vice versa). Thus, doped regions 404 and 406 form the first capacitor 402, which has a capacitance that varies based on the thickness of the substrate 106 to detect whether the substrate 106 has been tampered with.

[0058] The doped regions 404 and 406 of the first capacitor 402 may have any suitable configuration, and the illustrated example represents a cell-in-cell configuration, wherein the first capacitor plate (e.g., region 404) of the cell-in-cell capacitor comprises a central portion and a plurality of side portions extending along a first direction 408 in the substrate 106. The side portions are coupled to the central portion via portions extending in a second direction 410 perpendicular to the first direction 408. The second capacitor plate (e.g., region 406) comprises a central portion and a plurality of side portions extending along the first direction 408 in the substrate 106. The side portions of the second capacitor plate are coupled to the central portion via portions extending along the second direction 410, and the central portion and side portions of the second plate are arranged to extend between and around the central portion and side portions of the first plate.

[0059] In this arrangement, the electric field of the first capacitor 402 is shielded above by the groups of shields 412 and 414, while below the first capacitor 402, the shape and intensity of the electric field are determined in part by the structure, shape, and material of the remaining portion of the substrate 106 extending far to the back side of the substrate 106. Because any change to the substrate 106 can produce a change in the capacitance of the first capacitor 402, this provides a mechanism for detecting when the substrate 106 has been tampered with. Of course, this is merely one example configuration of the first capacitor 402, and other configurations are considered and provided.

[0060] The die 400 may contain any number of shielding material layers disposed on the first capacitor 402. In the illustrated example, the die 400 includes conductive features of a first set of shielding elements 412 and a second set of shielding elements 414, respectively, in layers M1 112 and M2 114. Shielding elements 412 and 414 may comprise a single, integral conductive feature extending beneath the entire capacitor, or a set of conductive features separated by regions of dielectric material. In an example where shielding elements 412 and 414 comprise regions of dielectric material between conductive features, the dielectric material regions may be horizontally offset to avoid a direct path through the dielectric material between the second capacitor 416 and the first capacitor 402. Shielding elements 412 and 414 may be electrically coupled to ground or a voltage source.

[0061] Similar to Figure 1 The die 400 may include a second capacitor 416 disposed on shields 412 and 414, the second capacitor 416 providing a reference capacitance for the first capacitor 402. The second capacitor 416 may include features on any number of layers, and in the illustrated example, the second capacitor 416 includes conductive features of a first set of M3 layers 116 and M4 layers 118 forming the first capacitor plate 418, and conductive features of a second set of M3 layers 116 and M4 layers 118 forming the second capacitor plate 420. The M3 features forming the first capacitor plate 418 can be coupled to the M4 features forming the first capacitor plate 418 via vias in the V3 layer 130, and the M3 features forming the second capacitor plate 420 can be coupled to the M4 features forming the second capacitor plate 420 via other vias in the V3 layer 130.

[0062] The second capacitor 416 can have any suitable configuration, and the illustrated example represents a box-in-box configuration, wherein the first capacitor plate 418 of the box-in-box capacitor includes a central portion and a plurality of side portions extending along a first direction 408 in the M3 layer 116. The side portions are coupled to the central portion via portions extending along a second direction 410 perpendicular to the first direction 408. The second capacitor plate 420 includes a central portion and side portions extending along the first direction 408 in the M3 layer 116. The side portions of the second capacitor plate 420 are coupled to the central portion via portions extending along the second direction 410. Specifically, the central portion and side portions of the second plate 420 are arranged to extend between and around the central portion and side portions of the first plate 418. The first and second capacitor plates 418 and 420 can have similar shapes and configurations in the M4 layer 118.

[0063] In another example, the first and second capacitor plates 418 and 420 may have different shapes in the M3 layer 116 and M4 layer 118, while still accommodating the electric field of the second capacitor 416 between the shields 412, 414 and 422 and within the outermost plate (e.g., capacitor plate 420). To further limit the electric field, additional conductive features within the M3 layer 116, M4 layer 118 and V3 layer 130 may be arranged side-by-side with the first and second capacitor plates 418 and 420 to make the second capacitor 416 insensitive to its surrounding environment.

[0064] In these and other arrangements, the bulk of the electric field of the second capacitor 416 extends horizontally within the layers and vertically between layers M3 116 and M4 118. The electric field is shielded by first and second sets of shields 412 and 414 at the bottom and a third set of shields 422 (described below) at the top. Of course, this is only one example configuration of the second capacitor 416, and other configurations are considered and provided.

[0065] As described above, the bare die 400 may include a set of conductive features in the M5 layer 120, which form a third set of shielding elements 422 disposed on the second capacitor. The shielding elements 422 may comprise a single, integral conductive feature extending over the entire capacitor, or a set of conductive features separated by regions of dielectric material. The shielding elements 422 may be electrically coupled to ground or a voltage source.

[0066] refer to Figure 5 and 6 Describe a system and technique for tamper detection using capacitors. Figure 5 This is a block diagram of a computing system 500 including a tamper detection capacitor, according to aspects described herein. Figure 6 This is a flowchart of a method 600 for detecting tampering using a computing system 500 according to the aspects described herein. Some procedures of method 600 may be executed in a sequence other than that described, and many procedures may be executed in parallel. Furthermore, in some instances, procedures of method 600 may be omitted or substituted.

[0067] First refer to Figure 5 The computing system 500 includes a die 502 (e.g., dies 102, 200, 300, and / or 400), which in turn includes a first capacitor 504 having a capacitance that varies in response to tampering with the die 502 and / or the package, a package 518 coupled to the die 502, or another component of the computing system 500. In this regard, the first capacitor 504 may be substantially similar to the capacitors 138, 218, 302, and / or 402 described above.

[0068] The die 502 may also include a second capacitor 506 located near (e.g., directly above or below) the first capacitor 504. The second capacitor 506 may be substantially similar to the capacitors 140, 204, 316, and / or 416 described above, and may be shielded so that the capacitance of the second capacitor 506 is unaffected by tampering. However, the capacitance of the second capacitor 506 may be affected by temperature, voltage, and / or other environmental factors. Because the second capacitor 506 is close to the first capacitor 504, the capacitance of each capacitor may be affected by environmental factors to a similar degree. Therefore, when there is no tampering, the ratio of the capacitance of the first capacitor 504 to the capacitance of the second capacitor 506 may be relatively stable over a wide range of environmental conditions, while exhibiting a large change when the system 500 is tampered with.

[0069] The die 502 also includes a capacitance measurement circuit 508 coupled to the first capacitor 504 and the second capacitor 506 to measure their capacitance. The capacitance measurement circuit 508 can measure and provide capacitance as an independent value, as a capacitance ratio, or in any other suitable expression.

[0070] The die 502 also includes processing resources 510 coupled to the capacitance measurement circuitry system 508. Processing resources 510 may include one or more central processing units (CPUs), graphics processing units (GPUs), microcontrollers, application-specific integrated circuits (ASICs), and / or other processing resources configured to execute instructions.

[0071] For this purpose, processing resource 510 is coupled to a non-transitory computer-readable medium 512 of system 500, the non-transitory computer-readable medium 512 storing instructions for execution by processing resource 510. In some instances, non-transitory computer-readable medium 512 stores instructions for performing the process of method 600. Non-transitory computer-readable medium 512 may include one or more HDDs, SSDs, other flash memory devices, optical media, battery-supported RAM, and / or other memory devices suitable for storing instructions for processing resource 510.

[0072] Processing resource 510 may include encryption circuitry 514 to perform encryption, decryption, key management, and other encryption-related operations. The encryption circuitry is coupled to capacitance measurement circuitry 508 and configured to perform some encryption-related operations based on the capacitance of a first capacitor 504 and a second capacitor 506 provided by capacitance measurement circuitry 508. Encryption circuitry 514 may also be coupled to secure storage medium 516 (e.g., flash memory) within die 502 to store and retrieve secure data, such as encryption keys.

[0073] Then, turning to method 600, computing system 500 may use any combination of dedicated hardware and instructions stored in a non-transitory medium, such as non-transitory computer-readable medium 512, to perform the process of method 600.

[0074] First refer to Figure 5 The frame 602 receives a die 502 comprising a first capacitor 504, a second capacitor 506, a capacitance measurement circuit 508, and a processing resource 510 having encryption circuitry 514. In some instances, the die 502 is coupled to a package 518, such as the package 104 described above.

[0075] Reference block 604, capacitance measurement circuit 508 determines the capacitance of first capacitor 504 and second capacitor 506. These capacitances can represent the state of die 502 when the die 502, package 518, and the rest of system 500 have not been tampered with. Reference block 606, encryption circuit 514 receives capacitance from capacitance measurement circuit 508. Capacitance measurement circuit 508 can provide capacitance as an independent value, a capacitance ratio, or in any other suitable representation to encryption circuit 514.

[0076] It has been determined that the capacitance properties of the first and second capacitors 504 and 506 of any given die 502 can be significantly different from the capacitance properties of other dies 502, even if they are manufactured using the same wafer, mask, and manufacturing facilities. Therefore, the capacitance can be used as a unique identifier for the die 502. Thus, in some instances, the encryption circuitry 514 generates a set of encryption keys for the die 502 based on the properties of these capacitors (e.g., the capacitance ratio of the first capacitor 504 to the second capacitor 506) and stores them in secure storage medium 516, as shown in box 608. In this way, the encryption keys are unique to the die 502.

[0077] Referring to block 610, encryption circuitry 514 encrypts a set of encryption keys based on the properties of the capacitance received in block 606 (e.g., capacitance ratio) and stores them in secure storage medium 516. This helps ensure that the encryption keys can be decrypted and used only if the capacitance properties remain unchanged. The processes of blocks 604 through 610 can be performed by the manufacturer or supplier as part of the authentication process.

[0078] In reference block 612, when the customer puts die 502 into operation, the processing resource 510 of die 502 receives instructions to perform encryption-related operations, such as performing encryption instructions, decrypting encrypted data, encrypting unencrypted data, or other appropriate operations. In reference block 614, in response, the capacitance measurement circuit 508 determines the capacitance of the first capacitor 504 and the second capacitor 506. These capacitances can represent the current state of die 502 when there is a possibility that system 500 has been tampered with. In reference block 616, the encryption circuit 514 receives the current capacitance from the capacitance measurement circuit 508. The capacitance measurement circuit 508 can provide the capacitance as an independent value, as a capacitance ratio, or in any other suitable representation to the encryption circuit 514.

[0079] Referring to block 618, encryption circuitry 514 attempts to retrieve a key from secure storage medium 516 and decrypts the key using the capacitive properties of the first and second capacitors 504 and 506 used for encryption in block 610. In some instances, this involves attempting to decrypt the key using the ratio of the capacitance of the first capacitor 504 to the capacitance of the second capacitor 506.

[0080] Referring to box 620, encryption circuit 514 uses the properties of capacitance to determine whether the key has been correctly decrypted. If so, encryption circuit 514 uses the key to perform encryption-related operations, as described in box 622. Method 600 can then return to box 612 and wait for further instructions.

[0081] However, the bare die 502 may have been tampered with in a way that reflects changes in capacitance properties (e.g., a change in capacitance ratio). If so, decryption may fail. In this case, method 600 continues from box 620 to box 624, where the encryption circuit 514 detects tampering based on capacitance properties and / or decryption failure and takes corrective action. In some instances, this corrective action involves removing the keys from the secure storage medium 516 so that they cannot be accessed improperly. In some instances, the corrective action involves triggering an alarm at the user interface, warning that encryption and decryption cannot be performed. In other instances, other corrective actions are taken. In any case, even without corrective action, encrypted data may not be recoverable because the key is lost.

[0082] The integrated circuit device and tamper detection capacitor described herein can be advantageously used in other applications, whether related to or unrelated to encryption. In this regard, while an encryption key encoded based on capacitance properties such as capacitance ratio is one example, the applicability of these teachings to other applications is consistent with and taken into consideration by this description.

[0083] Modifications are possible in the described embodiments, and other embodiments are possible within the scope of the claims.

Claims

1. An integrated circuit die, comprising: A first capacitor is arranged such that when the integrated circuit die is coupled to the package, tampering with the package changes the capacitance of the first capacitor. The second capacitor is positioned directly below the first capacitor; and A capacitance measurement circuit, coupled to the first capacitor and the second capacitor, is used to determine the capacitance of the first capacitor and the capacitance of the second capacitor.

2. The integrated circuit die of claim 1, further comprising multilayer interconnects, wherein the first capacitor comprises: A first capacitor plate, which is disposed in the first layer of the multilayer interconnect; and A second capacitor plate is disposed in the first layer of the multilayer interconnect, surrounding the first capacitor plate.

3. The integrated circuit die of claim 2, further comprising a set of conductive shielding features disposed between the first capacitor and the second capacitor in the second layer of the multilayer interconnect.

4. The integrated circuit die of claim 2, wherein the second capacitor comprises: A first capacitor plate, which includes conductive features in the second layer of the multilayer interconnect; and The second capacitor plate includes conductive features in the second layer surrounding the conductive features of the first capacitor plate.

5. The integrated circuit die according to claim 4, wherein: The first capacitor plate of the second capacitor further includes conductive features in the third layer of the multilayer interconnect; and The second capacitor plate of the second capacitor further includes the conductive features of the third layer.

6. The integrated circuit die according to claim 1, further comprising: A substrate disposed below the second capacitor; and A set of conductive shielding features is disposed between the second capacitor and the substrate.

7. The integrated circuit die of claim 1, wherein the capacitance measurement circuit is used to provide the ratio of the capacitance of the first capacitor to the capacitance of the second capacitor.

8. The integrated circuit die of claim 7, further comprising an encryption control circuit coupled to the capacitance measurement circuit to receive the ratio of the capacitance of the first capacitor to the capacitance of the second capacitor.

9. The integrated circuit die of claim 8, wherein the encryption control circuit is used to detect tampering based on the ratio of the capacitance of the first capacitor to the capacitance of the second capacitor.

10. The integrated circuit die of claim 8, wherein the encryption control circuit is used to attempt to decrypt the encryption key based on the ratio.

11. The integrated circuit die of claim 8, wherein the encryption control circuit is used to delete the encryption key based on the ratio.

12. An integrated circuit, comprising: Nude films, which include: First capacitor; The second capacitor is placed near the first capacitor; A capacitance measurement circuit, coupled to the first capacitor and the second capacitor, is used to determine the capacitance of the first capacitor and the capacitance of the second capacitor. and A circuit for determining tampering with the integrated circuit based on the capacitance of the first capacitor and the capacitance of the second capacitor, and The tampering with the integrated circuit alters the capacitance of the first capacitor.

13. The integrated circuit according to claim 12, wherein: The integrated circuit includes a package coupled to the die and arranged such that the package affects the capacitance of the first capacitor; and The tampering is relative to the encapsulation and changes the capacitance of the first capacitor.

14. The integrated circuit according to claim 12, wherein: The die includes a substrate disposed below the first capacitor and arranged such that the substrate affects the capacitance of the first capacitor; and The tampering is relative to the substrate and alters the capacitance of the first capacitor.

15. The integrated circuit of claim 12, wherein the second capacitor is arranged such that when the capacitance of the first capacitor is affected by the tampering, the capacitance of the second capacitor is not affected by the tampering.

16. The integrated circuit of claim 12, wherein the circuit is configured to determine the tampering based on a change in the ratio of the capacitance of the first capacitor to the capacitance of the second capacitor.

17. A computing system comprising: Processing resources; A non-transitory computer-readable medium coupled to the processing resource and storing instructions that, when executed by the processing resource, cause the processing resource to: The capacitance of the first capacitor that receives the bare die; The capacitance of the second capacitor that receives the bare die; and Tampering is detected based on the ratio of the capacitance of the first capacitor to the capacitance of the second capacitor, wherein the tampering is relative to an element consisting of a package coupled to the die and a substrate of the die, and the tampering alters the capacitance of the first capacitor.

18. The computing system according to claim 17, wherein: The capacitance of the first capacitor is the first capacitance of the first capacitor and is received during the identification process; The capacitance of the second capacitor is the first capacitance of the second capacitor, and is received during the identification process; and The non-transitory computer-readable medium stores additional instructions that cause the processing resource to: Encryption is performed based on the comparison encryption key between the first capacitance of the first capacitor and the first capacitance of the second capacitor; The second capacitor receives the first capacitor; The second capacitor receives the second capacitor; Based on the ratio of the second capacitance of the first capacitor to the second capacitance of the second capacitor, attempt to decrypt the encryption key; and The tampering is detected based on the failure to decrypt the encryption key.

19. The computing system of claim 17, wherein the non-transitory computer-readable media storage enables the processing resources to be configured based on additional instructions to tamper with and delete the encryption key.

Images