Voltage Glitch Fault Injector with Low Spurious Parameters

Abstract

The present invention provides a voltage glitch fault injector with low spurious parameters. After the pulse broadening circuit and the pulse delay network synchronously receive a control signal, they input it into four sub-branches. The broadened control signal is output as U1 and U4 through the first and fourth sub-branches, and the delayed control signal is output as U2 and U3 through the second and third sub-branches. When the high-side voltage-controlled electronic switch receives the signals from U2 and the first energy storage array, it outputs a voltage signal; when the low-side voltage-controlled electronic switch receives the signals from U3 and the second energy storage array, it outputs another voltage signal. After the glitch attack output interface receives the two voltage signals, it outputs a voltage glitch attack signal. The present invention generates a control signal group from a single pulse control signal, and the generated voltage glitch width is equal to the pulse width of the input pulse control signal; it can remove and reduce the spurious parameters of the circuit system, so that the slope, width, and depth of the voltage glitch injected into the integrated circuit are not affected.

Description

Technical Field

[0001] The present invention relates to the fields of integrated circuits and information security, and particularly to a voltage glitch fault injector with low stray parameters. Background Art

[0002] Integrated circuits are an essential infrastructure for information systems. The generation, transmission, operation, storage, etc. of information all use integrated circuits as carriers without exception, and the information security of information systems highly depends on the security defense capabilities of integrated circuits. In view of this, a series of security assessment methods have evolved in the fields of integrated circuits and information security - using various means to attack integrated circuits and observing the attack effects to evaluate the information security of integrated circuits.

[0003] Voltage glitch attack is an important method for evaluating the information security of integrated circuits. Its basic principle is to inject instantaneously changing voltage pulses at key nodes of integrated circuits to change the operating state of integrated circuits and thus "illegally" obtain their internal information (referred to as voltage glitch fault injection). As a very effective means of illegally obtaining information, voltage glitch attack has also been noticed by many integrated circuit manufacturers. In the design of their integrated circuits, a certain number of filters or sensors are usually designed, and even special algorithms are added at the cost of increasing costs to protect their integrated circuits from leaking information due to voltage glitch attacks.

[0004] There are the following problems in using voltage glitch attack to evaluate the information security of integrated circuits:

[0005] 1. The width of the injected voltage glitch is large and is detected and filtered by the filters or sensors of the integrated circuit.

[0006] 2. The energy of the injected voltage glitch is insufficient and cannot reach the expected glitch depth.

[0007] 3. The stray parameters of the circuit system are large, resulting in a slowdown in the slope of the injected voltage glitch, broadening of the voltage glitch width, and deterioration of the voltage glitch amplitude.

[0008] 4. Multiple control signals are required to generate voltage glitches, and a complex synchronization mechanism is needed between them.

[0009] Therefore, inventing an advanced voltage glitch attack method and device has become an urgent problem to be solved in the evaluation of the information security of integrated circuits. Summary of the Invention

[0010] The present invention provides a voltage glitch fault injector with low stray parameters to solve the problems in the prior art, such as large width of the injected voltage glitch, insufficient energy of the injected voltage glitch, large stray parameters of the circuit system, and complex control signals.

[0011] To achieve the above object, the technical solution of the present invention provides a voltage glitch fault injector with low spurious parameters, including: a pulse broadening circuit and a pulse delay network that synchronously receive a control signal. The pulse broadening circuit broadens the control signal after receiving it and inputs it to the first sub-branch and the fourth sub-branch. The first sub-branch and the fourth sub-branch output a first voltage signal and a fourth voltage signal. The first voltage signal and the fourth voltage signal respectively control the voltage-controlled electronic switches of the first sub-branch and the fourth sub-branch, so that the first sub-branch and the fourth sub-branch supply power to the second sub-branch and the third sub-branch in the pulse delay network through their respective energy storage arrays. The pulse delay network applies a delay to the control signal after receiving it to obtain a delayed control signal, and the delayed control signal is synchronously input to the second sub-branch and the third sub-branch. The second sub-branch broadens and buffers the delayed control signal to obtain a second voltage signal, and the third sub-branch reverses and applies a delay to the delayed control signal and buffers it to obtain a third voltage signal. When the high-side voltage-controlled electronic switch of the second sub-branch receives the second voltage and the signal sent by the first energy storage array of the first sub-branch, it outputs a voltage signal to the glitch attack output interface. When the low-side voltage-controlled electronic switch of the third sub-branch receives the third voltage and the signal sent by the second energy storage array of the fourth sub-branch, it outputs another voltage signal to the glitch attack output interface. After receiving the two voltage signals, the glitch attack output interface outputs a voltage glitch attack signal.

[0012] As a preference of the above technical solution, preferably, the first sub-branch and the fourth sub-branch broaden the control signal to obtain the first voltage signal and the fourth voltage signal, including: at the first moment, the pulse broadening circuit of the pulse broadening circuit broadens the control signal to obtain an activation control signal. The buffer and drive circuits of the first sub-branch and the buffer and drive circuits of the fourth sub-branch synchronously buffer and drive the activation control signal, and respectively output the first voltage signal and the fourth voltage signal. At this time, the first voltage-controlled electronic switch and the second voltage-controlled electronic switch are turned off. The first energy storage array inputs a voltage to the second sub-branch so that the glitch attack output interface outputs a voltage Vn. The second energy storage array inputs a voltage to the third sub-branch to remove the spurious parameters of the high-side power network and the low-side power network.

[0013] As a preference of the above technical solution, preferably, at the first moment, the second sub-branch and the third sub-branch are in a silent state.

[0014] Preferably, as an above technical solution, at the second moment, the pulse stretching circuit and the buffering and driving circuit of the second sub-branch stretch and activate the delayed control signal to output the second voltage signal, and the second voltage signal persists from the second moment to the fifth moment; at this time, the inversion and delay circuit of the third sub-branch applies a delay to the delayed control signal; wherein at the second moment, the high-side voltage-controlled electronic switch is disconnected from the first energy storage array.

[0015] Preferably, as an above technical solution, at the third moment, the inversion and delay circuit of the third sub-branch inverts and delays the input delayed control signal to output a pulse signal with a pulse width of PWi. After receiving the above pulse signal, the buffering and driving circuit of the third sub-branch continuously outputs the third voltage signal from the third moment to the fourth moment.

[0016] Preferably, as an above technical solution, at the third moment, the low-side voltage-controlled electronic switch of the third sub-branch is connected, and the second energy storage array outputs a voltage signal Vg to the glitch attack output interface.

[0017] Preferably, as an above technical solution, at the fourth moment, the low-side voltage-controlled electronic switch is turned off, and the voltage signal Vg output by the glitch attack output interface remains unchanged after the low-side voltage-controlled electronic switch is turned off.

[0018] Preferably, as an above technical solution, at the fifth moment, the high-side voltage-controlled electronic switch of the second sub-branch is connected, the pulse stretching circuit and the buffering and driving circuit are silenced, and the voltage Vg output by the glitch attack output interface changes to Vn.

[0019] Preferably, as an above technical solution, during the period from the first moment to the second moment and from the fifth moment to the sixth moment, the voltage-controlled electronic switches of the first sub-branch and the fourth sub-branch are turned off, and both the first energy storage array and the second energy storage array output voltages to the glitch attack output interface to remove the stray parameters of the high-side power network and the low-side power network.

[0020] The technical solution of the present invention provides a voltage glitch fault injector with low stray parameters, including: a pulse broadening circuit and a pulse delay network synchronously receive a control signal and input it into four sub-branches. After each sub-branch processes the broadened / delayed control signal, the broadened control signal is output as U1 and U4 through the first and fourth sub-branches, and the delayed control signal is output as U2 and U3 through the second and third sub-branches. When the high-side voltage-controlled electronic switch receives the signals from U2 and the first energy storage array, it outputs a voltage signal to the glitch attack output interface; when the low-side voltage-controlled electronic switch receives the signals from U3 and the second energy storage array, it outputs another voltage signal to the glitch attack output interface. After receiving the two voltage signals, the glitch attack output interface outputs a voltage glitch attack signal.

[0021] The advantages of the present invention are as follows:

[0022] First, the present invention only requires one pulse signal as the sole input control signal and does not require other additional control signals. It generates a precisely coordinated control signal group from a single pulse control signal. Therefore, the control method of the present invention is simple and efficient.

[0023] Second, the width of the voltage glitch generated by the present invention is exactly equal to the pulse width of the input pulse control signal. Therefore, the voltage glitch attack can be adapted to the target integrated circuit as needed.

[0024] Third, the energy storage array of the present invention has a high response bandwidth and sufficient DC power supply capacity to ensure that the voltage glitch reaches the expected depth.

[0025] Fourth, by removing and reducing the stray parameters of the circuit system, the present invention makes the slope, width, and depth of the voltage glitch injected into the integrated circuit nearly unaffected, improving the quality and effect of injecting the voltage glitch into the integrated circuit. Description of the Drawings

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0027] Figure 1 It is a schematic circuit diagram of a voltage glitch fault injector with low stray parameters provided by an embodiment of the present invention.

[0028] Figure 2 It is a waveform diagram of a voltage glitch fault injector with low stray parameters provided by an embodiment of the present invention.

[0029] Figure 3An application example diagram of the voltage glitch fault injector with low spurious parameters provided by the present invention.

[0030] Figure 4 Another application example diagram of the voltage glitch fault injector with low spurious parameters provided by the present invention.

[0031] Figure 5 For Figure 3 waveform diagram.

[0032] Figure 6 For Figure 4 waveform diagram. Detailed implementation manners

[0033] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0034] To better illustrate the voltage glitch fault injector with low spurious parameters provided by the present invention, the circuit structure of the present invention will be described first.

[0035] The circuit components include: a pulse source access circuit 0001, a pulse broadening circuit 1401, a pulse delay network 2301, a first sub-branch, a second sub-branch, a third sub-branch, a fourth sub-branch, and a glitch attack output interface 6001. The first sub-branch consists of a first buffer and driver circuit 1001, a first voltage-controlled electronic switch 1002, a first energy storage array 1003, and a high-side power supply network 5001. The second sub-branch consists of a pulse broadening circuit 2001, a buffer and driver circuit 2002, and a high-side voltage-controlled electronic switch 2003. The third sub-branch consists of an inverting and delay circuit 3001, a buffer and driver circuit 3002, and a low-side voltage-controlled electronic switch 3003. The fourth sub-branch consists of a second buffer and driver circuit 4001, a second voltage-controlled electronic switch 4002, a second energy storage array 4003, and a low-side power supply network 5002.

[0036] Two output terminals of the pulse source access circuit 0001 are respectively connected to the pulse broadening circuit 1401 and the pulse delay network 2301.

[0037] The two output terminals of the pulse broadening circuit 1401 are respectively connected to the first buffer and drive circuit 1001 and the second buffer and drive circuit 4001. The first buffer and drive circuit 1001 is connected to the first voltage-controlled electronic switch 1002. One end of this electronic switch is connected to the high-side power supply network 5001, and the other end is connected to the first energy storage array 1003. The second buffer and drive circuit 4001 is connected to the second voltage-controlled electronic switch 4002. One end of the second voltage-controlled electronic switch 4002 is connected to the low-side power supply network 5002, and the other end is connected to the second energy storage array 4003.

[0038] The two output terminals of the pulse delay network 2301 are respectively connected to the pulse broadening circuit 2001 and the inverting and delay circuit 3001. The pulse broadening circuit 2001 is connected to the buffer and drive circuit 2002. One end of the high-side voltage-controlled electronic switch 2003 is connected to the buffer and drive circuit 2002, the other end is connected to the first energy storage array 1003, and the output terminal is connected to the glitch attack output interface 6001. The inverting and delay circuit 3001 is connected to the buffer and drive circuit 3002. One end of the low-side voltage-controlled electronic switch 3003 is connected to the buffer and drive circuit 3002, the other end is connected to the second energy storage array 4003, and the output terminal is connected to the glitch attack output interface 6001.

[0039] Now, the principle of the present invention will be described, and its waveform diagram is as Figure 2 shown:

[0040] The waveform description is as follows:

[0041] Ui(t): Pulse control signal, which is the only control signal required to input this injector, without other additional control signals; Uo(t): Output waveform of the technical solution of the present invention; U1(t): Gate control signal of the first voltage-controlled electronic switch 1002; U2(t): Gate control signal of the high-side voltage-controlled electronic switch 2003; U3(t): Gate control signal of the low-side voltage-controlled electronic switch 3003; U4(t): Gate control signal of the second voltage-controlled electronic switch 4002.

[0042] The parameter description in the waveform diagram is as follows:

[0043] PWi: Pulse width of the pulse control signal, activation time period of U3(t); PWo: Pulse width of the voltage glitch; Td: Delay of the voltage glitch; Taux1, Taux2: Stray parameter removal buffer time period; DT1, DT2: Dead time; PW1: Stray parameter removal time period, that is, activation time period of U1(t) and U4(t); PW2: Activation time period of U2(t). Among them, it should be noted that the high level of U3(t) is the active state and the low level is the silent state.

[0044] First of all, it should be noted that:

[0045] The pulse control signal Ui(t) is the only control signal required for input to the present invention, without the need for other additional control signals. The pulse control signal Ui(t) can be generated by signal sources such as microwave signal sources, signal generators, or digital circuits, and is mainly characterized by two parameters: amplitude and pulse width. Due to the level adaptation effect of the pulse source connected to circuit 0001, the voltage glitch fault injector of the present invention is only sensitive to the pulse width parameter (PWi) of Ui(t), and there is no need to pay attention to its amplitude parameter anymore. The advantage of this design is that it further simplifies the requirements for the control signal.

[0046] 1. Before time t0:

[0047] In this state, the injector provided by the present invention is in a silent state.

[0048] The pulse source connected to circuit 0001 receives the pulse control signal Ui(t) from the outside, but at this time, there is no effective control pulse in Ui(t), so no voltage pulse is generated in Uo(t), and no voltage glitch attack is launched. In the silent state, the output Uo(t) of the glitch attack output interface 6001 = Vn, and the present invention provides the normal working power supply Vn for the integrated circuit through the glitch attack output interface 6001.

[0049] In the silent state, U1(t), U2(t), U3(t), and U4(t) are in their respective invalid states.

[0050] In the silent state, the first voltage-controlled electronic switch 1002 is connected, presenting a very low resistance, and its output terminal is connected to the high-side power network 5001. The first energy storage array 1003 plays a role in voltage stabilization and filtering.

[0051] In the silent state, the second voltage-controlled electronic switch 4002 is connected, presenting a very low resistance, and its output terminal is connected to the low-side power network 5002. The second energy storage array 4003 plays a role in voltage stabilization and filtering.

[0052] 2. The first moment: t0

[0053] At time t0, an effective control pulse occurs in Ui(t) with a pulse width of PWi.

[0054] From this moment on, this voltage glitch fault injector enters the active state, and each component of the voltage glitch fault injector enters its respective timing sequence in turn to generate voltage glitches.

[0055] At this time, the pulse source connected to circuit 0001 receives the pulse control signal Ui(t) from the outside, performs impedance matching, level adaptation, and inversion, and then generates two completely synchronized pulse signals through the buffer circuit, which are respectively output to the pulse broadening circuit 1401 and the pulse delay network 2301.

[0056] At time t0, the pulse broadening circuit 1401 immediately broadens the input pulse signal, and the width of the output pulse signal is PW1. That is, the output of the pulse broadening circuit 1401 enters the active state at time t0 and lasts until time t0 + PW1. Since the pulse broadening circuit 1401 broadens the input pulse signal from PWi to PW1 and outputs two completely synchronized pulse signals with a pulse width of PW1, the first buffer and drive circuit 1001 and the second buffer and drive circuit 4001 have exactly the same input. With the same design, the first buffer and drive circuit 1001 and the second buffer and drive circuit 4001 have exactly the same structure. At this time, the output pulse signals U1(t) and U4(t) of the two are also exactly the same, both entering the active state at time t0 and lasting until t0 + PW1.

[0057] Among them, the last output terminal of this voltage glitch injector will be connected to the integrated circuit, and the loads of the integrated circuits are different. Therefore, when injecting voltage glitches into them, a great electrical impact may be generated. The first buffer and drive circuit 1001 and the second buffer and drive circuit 4001 will isolate the electrical impact between the front and rear stage circuits respectively, avoiding the influence of the electrical impact occurring in the rear stage circuit on the operation of the front stage circuit.

[0058] The driving function plays a role in controlling the on / off of the second voltage-controlled electronic switch 4002. The driving function controls the strong with the weak, that is, uses a pulse signal with a pulse width of PW1 as the control signal and converts it into a gating signal U4(t) with strong driving ability.

[0059] At time t0, the first voltage-controlled electronic switch 1002 is turned off, and the first voltage-controlled electronic switch 1002 presents an extremely high resistance. Its output terminal (i.e., the input terminal of the first energy storage array 1003) is disconnected from the high-side power network 5001. At this time, the first energy storage array 1003 provides the working power supply Vn for the integrated circuit.

[0060] At time t0, the second voltage-controlled electronic switch 4002 is turned off, and the second voltage-controlled electronic switch 4002 presents an extremely high resistance. Its output terminal (i.e., the input terminal of the second energy storage array 4003) is disconnected from the low-side power network 5002. At this time, the second energy storage array 4003 provides the DC power supply Vg for the voltage glitch.

[0061] At time t0, the pulse delay network 2301 starts to apply a delay Taux1 to the input pulse signal, and the pulse width of the pulse signal remains unchanged. At this time, since its output has not entered the active state, the pulse broadening circuit 2001, the buffer and drive circuit 2002, the high-side voltage-controlled electronic switch 2003, the inverter and delay circuit 3001, the buffer and drive circuit 3002, the low-side voltage-controlled electronic switch 3003, and the glitch attack output interface 6001 are still temporarily in a silent state, and Uo(t) = Vn. The present invention provides the normal working power supply Vn for the integrated circuit through the glitch attack output interface 6001.

[0062] The buffering functions in the buffer and drive circuit 2002 and the buffer and drive circuit 3002 play an isolation role. The subsequent circuits of this voltage glitch fault injector, especially the final output terminal, will be connected to the integrated circuit, and the loads of the integrated circuits are different. Therefore, when injecting voltage glitches into it, a great electrical impact may be generated. The buffering function of the present invention will isolate the electrical impact between the front and rear circuits and prevent the electrical impact occurring in the subsequent circuit from affecting the operation of the front circuit. The driving function plays a role in controlling the on / off of the high-side voltage-controlled electronic switch 2003 and the low-side voltage-controlled electronic switch 3003.

[0063] The driving functions in the buffer and drive circuit 2002 and the buffer and drive circuit 3002 control the strong with the weak. For the buffer and drive circuit 2002, a pulse signal with a pulse width of PW2 is used as the control signal, which is converted into a gating signal U2(t) with strong driving ability and output to the high-side voltage-controlled electronic switch 2003; for the buffer and drive circuit 3002, a pulse signal with a pulse width of PWi is used as the control signal, which is converted into a gating signal U3(t) with strong driving ability and output to the low-side voltage-controlled electronic switch 3003.

[0064] 3. From the first moment t0 to the second moment t0 + Taux1:

[0065] During the time period from t0 to t0 + Taux1, the pulse delay network 2301 applies a delay to its input pulse, and the rest of the components maintain the state at time t0.

[0066] The time period from t0 to t0 + Taux1 is the stray parameter removal buffer time period. The power supply of the power supply Vn is switched from the high-side power network 5001 to the first energy storage array 1003, and the power supply of the power supply Vg is switched from the low-side power network 5002 to the second energy storage array 4003. Thereby, the present invention removes the adverse effects of the stray parameters of the high-side power network 5001 and the low-side power network 5002 on the voltage glitch injection.

[0067] 4. The second moment: t0 + Taux1

[0068] At the moment of t0+Taux1, the pulse delay network 2301 completes the delay of its input pulse signal and outputs two completely synchronized pulse signals with a pulse width of PWi, which are respectively input into the pulse broadening circuit 2001 and the inverting and delaying circuit 3001.

[0069] At the moment of t0+Taux1, the pulse broadening circuit 2001 immediately broadens the input pulse signal, and the width of the output pulse signal is PW2, that is, the output of the pulse broadening circuit 2001 enters the active state from the moment of t0+Taux1 and lasts until the moment of t0+Taux1+PW2 ends.

[0070] At the moment of t0+Taux1, considering the front and rear stage relationship between the buffer and drive circuit 2002 and the pulse broadening circuit 2001, the output U2(t) of the buffer and drive circuit 2002 enters the active state from the moment of t0+Taux1 and lasts until the moment of t0+Taux1+PW2 ends.

[0071] At the moment of t0+Taux1, the high-side voltage-controlled electronic switch 2003 is turned off, and the high-side voltage-controlled electronic switch 2003 presents an extremely high resistance, and its output terminal (i.e., the input terminal of the glitch attack output interface 6001) is disconnected from the first energy storage array 1003. The high-side voltage-controlled electronic switch 2003 generates a large instantaneous current at the moment of turning on and off, which can have an adverse effect on the voltage glitch injection through the stray resistance, capacitance and inductance parameters of the circuit system.

[0072] At the moment of t0+Taux1, there is no power supply at the input terminal of the glitch attack output interface 6001. Therefore, the present invention will briefly cut off the working power supply Vn of the integrated circuit at this moment. Due to the continuity of physical quantities, Vo(t)=Vn at this moment.

[0073] At the moment of t0+Taux1, the inverting and delaying circuit 3001 starts to apply a delay to its input pulse signal.

[0074] At the moment of t0+Taux1, the remaining components of the present invention maintain the state at the moment of t0.

[0075] 5. From the second moment t0+Taux1 to the third moment t0+Taux1+DT1:

[0076] In the time period from t0+Taux1 to t0+Taux1+DT1, the inverting and delaying circuit 3001 inverts and applies a delay to its input pulse signal. The inverting and delaying circuit 3001 applies an additional delay of DT1 to the pulse signal with a pulse width of PWi and outputs it to the buffer and drive circuit 3002.

[0077] The time period from t0+Taux1 to t0+Taux1+DT1 is the dead time, and there is no power supply at the input end of the glitch attack output interface 6001. Since the load at the output end of the present invention (i.e., the integrated circuit) continuously consumes energy, Uo(t) will decrease slightly.

[0078] During the time period from t0+Taux1 to t0+Taux1+DT1, the remaining components of the present invention maintain the state at the moment of t0+Taux1.

[0079] 6. The third moment: t0+Taux1+DT1

[0080] At the moment of t0+Taux1+DT1, the inverting and delaying circuit 3001 completes the inversion and delay of its input pulse signal and outputs a pulse signal with a pulse width of PWi.

[0081] At the moment of t0+Taux1+DT1, in view of the front and rear stage relationship between the buffer and drive circuit 3002 and the inverting and delaying circuit 3001, the output U3(t) of the buffer and drive circuit 3002 enters the active state from the moment of t0+Taux1+DT1 and lasts until the moment of t0+Taux1+DT1+PWi.

[0082] At the moment of t0+Taux1+DT1, the low-side voltage-controlled electronic switch 3003 is connected, and the low-side voltage-controlled electronic switch 3003 presents an extremely low resistance, and its output end is connected to the second energy storage array 4003, and the second energy storage array 4003 provides the Vg power supply.

[0083] At the moment of t0+Taux1+DT1, the input end of the glitch attack output interface 6001 is connected to the DC power supply Vg. Due to the continuity of physical quantities, at this moment, Uo(t) is lower than Vn and is at the starting point of changing to Vg.

[0084] At the moment of t0+Taux1+DT1, the remaining components of the present invention maintain the state at the moment of t0+Taux1.

[0085] 7. From the third moment t0+Taux1+DT1 to the fourth moment t0+Taux1+DT1+PWi:

[0086] During the time period from t0+Taux1+DT1 to t0+Taux1+DT1+PWi, the present invention supplies power to the integrated circuit through Vg of the second energy storage array 4003, and Uo(t) quickly changes to Vg. The low-side voltage-controlled electronic switch 3003 generates a large instantaneous current at the moment of connection, and the stray resistance, capacitance, and inductance parameters of the circuit system can have an adverse impact on the voltage glitch injection.

[0087] During the time period from t0 + Taux1 + DT1 to t0 + Taux1 + DT1 + PWi, at the moment of t0 + Td, it is the starting point of the voltage pulse width of Uo(t). Specifically, the waveform at the output end of the glitch attack output interface 6001 is Uo(t), and a voltage pulse with a pulse width of PWo is generated at t = t0 + Td. This voltage pulse is used as a voltage glitch to inject into the integrated circuit for attack.

[0088] The relationship between PWo and PWi is: PWo = k * PWi (k ≈ 1).

[0089] During the time period from t0 + Taux1 + DT1 to t0 + Taux1 + DT1 + PWi, the remaining components of the present invention maintain the state at the moment of t0 + Taux1 + DT1.

[0090] 8. The fourth moment t0 + Taux1 + DT1 + PWi:

[0091] At the moment of t0 + Taux1 + DT1 + PWi, the inverter and delay circuit 3001 and the buffer and driver circuit 3002 resume the silent state.

[0092] At the moment of t0 + Taux1 + DT1 + PWi, the low-side voltage-controlled electronic switch 3003 is turned off and resumes the silent state. At this time, the low-side voltage-controlled electronic switch 3003 presents a very high resistance, and its output end disconnects from the second energy storage array 4003. Therefore, the input end of the glitch attack output interface 6001 has neither Vg power supply nor Vn power supply. The low-side voltage-controlled electronic switch 3003 generates a very large instantaneous current at the moment of turning on and off, which can have an adverse effect on the voltage glitch injection through the stray resistance, capacitance, and inductance parameters of the circuit system.

[0093] At the moment of t0 + Taux1 + DT1 + PWi, due to the continuity of physical quantities, Uo(t) = Vg.

[0094] At the moment of t0 + Taux1 + DT1 + PWi, the remaining components of the present invention maintain the state at the moment of t0 + Taux1 + DT1.

[0095] 9. From the fourth moment t0 + Taux1 + DT1 + PWi to the fifth moment t0 + Taux1 + PW2:

[0096] During the time period from t0 + Taux1 + DT1 + PWi to t0 + Taux1 + PW2, since the load (i.e., the integrated circuit) at the output end of the present invention has consumed all the energy and cannot obtain power supply replenishment, therefore Uo(t) = Vg.

[0097] During the time period from t0 + Taux1 + DT1 + PWi to t0 + Taux1 + PW2, the remaining components of the present invention maintain the state at the moment of t0 + Taux1 + DT1 + PWi.

[0098] 10. The fifth moment t0 + Taux1 + PW2:

[0099] At the moment of t0 + Taux1 + PW2, the pulse-width broadening circuit 2001 and the buffer and drive circuit 2002 resume the silent state.

[0100] At the moment of t0 + Taux1 + PW2, the high-side voltage-controlled electronic switch 2003 is connected and resumes the silent state. At this time, the high-side voltage-controlled electronic switch 2003 presents an extremely low resistance, and its output terminal is connected to the first energy storage array 1003. Therefore, the input terminal of the glitch attack output interface 6001 is powered by Vn.

[0101] At the moment of t0 + Taux1 + PW2, due to the continuity of the physical quantity, at this time Uo(t) = Vg and is at the starting point of changing to Vn.

[0102] At the moment of t0 + Taux1 + PW2, the remaining components of the present invention maintain the state at the moment of t0 + Taux1 + DT1 + PWi.

[0103] 11. From the fifth moment t0 + Taux1 + PW2 to the sixth moment t0 + PW1:

[0104] In the time period from t0 + Taux1 + PW2 to t0 + PW1, the present invention supplies power to the integrated circuit through Vn of the first energy storage array 1003, and Uo(t) rapidly changes to Vn. The high-side voltage-controlled electronic switch 2003 generates a large instantaneous current at the moment of connection, and the stray resistance, capacitance, and inductance parameters of the circuit system can have an adverse effect on the voltage glitch injection. Uo(t) resumes to Vn at the moment of t2.

[0105] The time period from t0 + Taux1 + PW2 to t0 + PW1 is the stray parameter removal buffer time period. Vn is supplied with electric energy by the first energy storage array 1003, and Vg is supplied with electric energy by the second energy storage array 4003. Thereby, the present invention removes the adverse effects of the stray parameters of the high-side power supply network 5001 and the low-side power supply network 5002 on the voltage glitch injection.

[0106] In the time period from t0 + Taux1 + PW2 to t0 + PW1, the remaining components of the present invention maintain the state at the moment of t0 + Taux1 + PW2.

[0107] 12. After the sixth moment t0 + PW1:

[0108] At the moment of t0 + PW1 and afterwards, all components of the present invention resume the silent state, Vn resumes to be supplied with electric energy by the high-side power supply network 5001, and Vg resumes to be supplied with electric energy by the low-side power supply network 5002.

[0109] At the moment of t0+PW1 and afterwards, Uo(t) = Vn. In the present invention, the burr attack output interface 6001 provides the normal operating power supply Vn for the integrated circuit.

[0110] Furthermore, in actual implementation, the stray parameters of the high-side power network 5001 and the low-side power network 5002 respectively come from their respective power supply lines and power filter networks. Due to its mechanical structure and cable length, the power supply line has large and time-varying stray parameters, mainly manifested as parasitic inductance and cable resistance. The power filter network is composed of inductors and capacitors, and its main stray parameters are manifested as parasitic inductance, parasitic capacitance and equivalent series resistance.

[0111] The adverse effect of the parasitic inductance on the voltage burr of Uo(t) is to generate overshoot and oscillation at the moment of t = t1. The main adverse effect of the parasitic capacitance on the voltage burr of Uo(t) is to smooth (reduce) the change slope of the voltage burr, that is, to affect the voltage change slope between t = t0+Taux1+DT1 and t = t1, and between t = t0+Taux1+PW2 and t = t2. The main adverse effect of the cable resistance or equivalent series resistance on the voltage burr of Uo(t) is the line voltage drop, which makes Vn and Vg transmitted to the integrated circuit lower than the voltage supplied at the source end. The removal of the stray parameters of the power network is achieved through the control of U1(t) and U4(t).

[0112] The reduction of the stray parameters of the burr attack output interface is achieved by two methods: one is to connect the output terminals of the high-side voltage-controlled electronic switch 2003 and the low-side voltage-controlled electronic switch 3003 through a large-area low-resistance short wire; the other is to provide a physical connection between the present invention and the integrated circuit through a probe, and the small-size probe is beneficial to reducing the stray parameters.

[0113] The first energy storage array 1003 and the second energy storage array 4003 are respectively composed of a plurality of energy storage units with low internal resistance connected in parallel through large-area short wires. The use of a plurality of energy storage units with low internal resistance connected in parallel can improve the response bandwidth of the energy storage array and provide sufficient DC power supply.

[0114] The first buffer and drive circuit 1001, the buffer and drive circuit 2002, the buffer and drive circuit 3002, and the second buffer and drive circuit 4001 all have similar designs, including a pulse signal buffering function and a driving function. The buffering function of the present invention will isolate the electrical impact between the front-stage and rear-stage circuits and prevent the electrical impact occurring in the rear-stage circuit from affecting the operation of the front-stage circuit; the driving function controls the strong with the weak, that is, uses the pulse signal as the control signal and converts it into a gating signal with strong driving ability.

[0115] Figure 3The figure shows an application example diagram of an embodiment of the present invention. In this embodiment, the present invention performs a voltage glitch attack on an embedded processor to evaluate the security of the embedded processor. The present invention supplies a normal operating power supply Vn = 5V to the embedded processor and a glitch attack power supply Vg = 1V. The voltage glitch pulse width PWo = 150ns. Therefore, the pulse control signal pulse width PWi = 150ns and amplitude = 3.3Vpp of the signal generator are set. The output voltage glitch waveform is as Figure 5 shown. Before the second time, Uo(t) = 5V; between the second time t0 + Taux1 and the third time t0 + Taux1 + DT1, there is no power supply to the input end of the glitch attack output interface 6001, and the embedded processor continuously consumes energy. Therefore, Uo(t) will decrease slightly; between the third time and t1, Vg of the second energy storage array 4003 supplies power to the embedded processor, and Uo(t) quickly changes to 1V. During this process, a very large instantaneous current is generated at the moment when the low-side voltage-controlled electronic switch 3003 is connected, and the stray resistance, capacitance, and inductance parameters of the circuit system can have an adverse effect on the voltage glitch injection; at the fifth time, due to the continuity of physical quantities, the embedded processor has consumed all its energy and cannot obtain electrical energy replenishment. Therefore, Uo(t) = 1V; between the fifth time and t2, Vn of the first energy storage array 1003 supplies power to the integrated circuit, and Uo(t) quickly changes to 5V. During this period, a very large instantaneous current is generated at the moment when the high-side voltage-controlled electronic switch 2003 is connected, and the stray resistance, capacitance, and inductance parameters of the circuit system can have an adverse effect on the voltage glitch injection. Uo(t) returns to 5V at time t2 until the sixth time. After the sixth time, Uo(t) = 5V.

[0116] Figure 4 The figure shows another application example diagram of an embodiment of the present invention. In this embodiment, the present invention performs a voltage glitch attack on a CPU to evaluate the security of the CPU. The present invention supplies a normal operating power supply Vn = 0.95V to the embedded processor and a glitch attack power supply Vg = -1.5V. The voltage glitch pulse width PWo = 0.5ns. Therefore, the pulse control signal pulse width PWi = 0.5ns and power = 5dBm of the microwave signal source are set. The output voltage glitch waveform is as Figure 6 shown. The principle is the same as that of the previous embodiment and will not be elaborated here.

[0117] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A voltage glitch fault injector with low spurious parameters, characterized in that, Including: The pulse broadening circuit and the pulse delay network synchronously receive the control signal; After receiving the control signal, the pulse broadening circuit broadens it and inputs it into the first sub-branch and the fourth sub-branch. The first sub-branch and the fourth sub-branch output a first voltage signal and a fourth voltage signal respectively. The first voltage signal and the fourth voltage signal respectively control the voltage-controlled electronic switches of the first sub-branch and the fourth sub-branch, so that the first sub-branch and the fourth sub-branch supply power to the second sub-branch and the third sub-branch in the pulse delay network through their respective energy storage arrays; After receiving the control signal, the pulse delay network applies a delay to it to obtain a delayed control signal. The delayed control signal is synchronously input into the second sub-branch and the third sub-branch. The second sub-branch broadens and buffers the delayed control signal to obtain a second voltage signal. The third sub-branch reverses and delays the delayed control signal and buffers it to obtain a third voltage signal; When the high-side voltage-controlled electronic switch of the second sub-branch receives the second voltage and the signal sent by the first energy storage array of the first sub-branch, it outputs a voltage signal to the glitch attack output interface; When the low-side voltage-controlled electronic switch of the third sub-branch receives the third voltage and the signal sent by the second energy storage array of the fourth sub-branch, it outputs another voltage signal to the glitch attack output interface; After receiving the two voltage signals, the glitch attack output interface outputs a voltage glitch attack signal.

2. The voltage glitch fault injector with low spurious parameters according to claim 1, characterized in that, The first sub-branch and the fourth sub-branch obtain the first voltage signal and the fourth voltage signal after broadening the control signal, including: At the first moment, the pulse broadening circuit of the pulse broadening circuit broadens the control signal to obtain an activation control signal. The buffer and drive circuits of the first sub-branch and the fourth sub-branch synchronously buffer and drive the activation control signal, and output the first voltage signal and the fourth voltage signal respectively. At this time, the first voltage-controlled electronic switch and the second voltage-controlled electronic switch are turned off. The first energy storage array inputs a voltage to the second sub-branch so that the glitch attack output interface outputs a voltage Vn. The second energy storage array inputs a voltage to the third sub-branch, thereby removing the stray parameters of the high-side power network and the low-side power network; at the first moment, the second sub-branch and the third sub-branch are in a silent state.

3. The voltage glitch fault injector with low spurious parameters according to claim 2, characterized in that, At the second moment, the pulse broadening circuit and the buffer and drive circuit of the second sub-branch broaden and activate the delayed control signal, and output the second voltage signal. The second voltage signal persists from the second moment to the fifth moment; At this time, the reverse and delay circuit of the third sub-branch applies a delay to the delayed control signal; wherein at the second moment, the high-side voltage-controlled electronic switch is disconnected from the first energy storage array.

4. The voltage glitch fault injector with low spurious parameters according to claim 2, characterized in that, At the third moment, the inverting and delaying circuit of the third sub-branch inverts and delays the input delayed control signal, and outputs a pulse signal with a pulse width of PWi; After receiving the above pulse signal, the buffer and drive circuit of the third sub-branch continuously outputs a third voltage signal from the third moment to the fourth moment.

5. The voltage glitch fault injector with low spurious parameters according to claim 4, characterized in that, At the third moment, the low-side voltage-controlled electronic switch of the third sub-branch is connected, and the second energy storage array outputs a voltage signal Vg to the glitch attack output interface.

6. The voltage glitch fault injector with low spurious parameters according to claim 5, characterized in that, At the fourth moment, the low-side voltage-controlled electronic switch is turned off, and the voltage signal Vg output by the glitch attack output interface remains unchanged after the low-side voltage-controlled electronic switch is turned off.

7. The voltage glitch fault injector with low spurious parameters according to claim 5, characterized in that At the fifth moment, the high-side voltage-controlled electronic switch of the second sub-branch is connected, the pulse stretching circuit and the buffer and drive circuit are silent, and the voltage Vg output by the glitch attack output interface changes to Vn.

8. The voltage glitch fault injector with low spurious parameters according to claim 7, characterized in that, From the first moment to the second moment and from the fifth moment to the sixth moment, the voltage-controlled electronic switches of the first sub-branch and the fourth sub-branch are turned off, and both the first energy storage array and the second energy storage array output voltages to the glitch attack output interface to remove the stray parameters of the high-side power network and the low-side power network.

Images