Detection circuit, method and integrated circuit

Abstract

The embodiment of the present application provides a detection circuit, method and integrated circuit. The detection circuit includes: a configuration circuit, an abnormality detection circuit and an alarm circuit; the configuration circuit is used to configure a first clock signal for a detection signal line; the detection signal line is set in the area to be detected of the chip, and the electromagnetic signal outside the chip can be sensed by the detection signal line; the abnormality detection circuit is used to collect the signal output by the detection signal line, and use the collected signal and the second clock signal to determine whether the chip is injected with an external electromagnetic signal, obtain a first judgment result, and output it to the alarm circuit; the alarm circuit is used to receive the first judgment result sent by the abnormality detection circuit, and generate an alarm when the first judgment result indicates that the chip is injected with an external electromagnetic signal.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a detection circuit, method and integrated circuit. Background Art

[0002] During the application of security chips, attackers can interfere with the electrical characteristics of the internal circuits of security chips by creating clock faults. Among them, electromagnetic injection attacks are one of the common clock fault attacks. Taking the cryptographic chip in the security chip as an example, the attacker launches an electromagnetic injection attack by injecting electromagnetic signals into the cryptographic chip. The injected electromagnetic signals will interfere with the chip clock signal, affect the normal timing of the chip memory, and cause errors in the logical operation results in the chip, thereby affecting the normal operation of the cryptographic chip. In order to defend against electromagnetic injection attacks, in related technologies, active detection of electromagnetic injection attacks is achieved by integrating a glitch detector inside the security chip. The glitch detector uses a hand-wired coil as an antenna. The hand-wired coil is arranged in the area to be detected on the surface of the security chip. The glitch detector detects the induced voltage of the metal wiring of the hand-wired coil and generates an alarm when the induced voltage exceeds the detection threshold.

[0003] However, the glitch detector will increase the area of ​​the security chip, increase the production cost, and cannot provide comprehensive protection for the entire security chip. Summary of the invention

[0004] In order to solve the related technical problems, the embodiments of the present application mainly provide a detection circuit, method and integrated circuit.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The embodiment of the present application provides a detection circuit, including: a configuration circuit, an abnormality detection circuit and an alarm circuit; wherein,

[0007] A configuration circuit is used to configure a first clock signal for a detection signal line; the detection signal line is arranged in a to-be-detected area of ​​the chip, and an electromagnetic signal outside the chip can be sensed by the detection signal line;

[0008] an abnormal change detection circuit, used for collecting the signal output by the detection signal line, judging whether the chip is injected with an external electromagnetic signal by using the collected signal and the second clock signal, obtaining a first judgment result, and outputting it to the alarm circuit;

[0009] The alarm circuit is used to receive the first judgment result sent by the abnormal change detection circuit, and generate an alarm when the first judgment result indicates that the chip is injected with an external electromagnetic signal.

[0010] In the above solution, the detection circuit further includes:

[0011] A false alarm filtering circuit, used for verifying the first judgment result to obtain a second judgment result;

[0012] The alarm circuit is used to receive the second judgment result sent by the false alarm filtering circuit, and generate an alarm when the second judgment result indicates that the chip is injected with an external electromagnetic signal.

[0013] In the above scheme, the false alarm filtering circuit includes:

[0014] A delay circuit, used for performing delay processing on the level signal corresponding to the first judgment result to generate a delay result;

[0015] The second logic gate is used to compare the level signal corresponding to the first judgment result with the delay result to generate the second judgment result.

[0016] In the above solution, the delay time length of the delay circuit for delaying the first judgment result is adjustable.

[0017] In the above solution, the configuration circuit is specifically used to configure a first clock signal with variable strength for the detection signal line.

[0018] In the above solution, the configuration circuit is specifically used to configure a first clock signal with variable strength for the detection signal line according to a received enable signal.

[0019] In the above scheme, the alarm circuit is also used to generate an alarm and stop the alarm after receiving a reset request signal.

[0020] In the above solution, the abnormal change detection circuit includes:

[0021] The first logic gate is used to compare the level signal output by the detection signal line with the level signal of the second clock signal to generate the first judgment result.

[0022] In the above scheme, the alarm circuit includes:

[0023] The D flip-flop is used to generate an alarm and stop the alarm after receiving a reset request signal.

[0024] The present application also provides a detection method, including:

[0025] The configuration circuit of the detection circuit configures a first clock signal for a detection signal line; the detection signal line is arranged in a to-be-detected area of ​​the chip, and an electromagnetic signal outside the chip can be sensed by the detection signal line;

[0026] The abnormal change detection circuit of the detection circuit collects the signal output by the detection signal line, and uses the collected signal and the second clock signal to determine whether the chip is injected with an external electromagnetic signal, obtains a first judgment result, and outputs it to the alarm circuit of the detection circuit;

[0027] After receiving the first judgment result sent by the abnormal change detection circuit, when the first judgment result indicates that the chip is injected with an external electromagnetic signal, the alarm circuit generates an alarm message.

[0028] In the above scheme, the method further comprises:

[0029] The false alarm filtering circuit verifies the first judgment result to obtain a second judgment result;

[0030] After the alarm circuit receives the second judgment result sent by the false alarm filtering circuit, the alarm circuit generates an alarm when the second judgment result indicates that the chip is injected with an external electromagnetic signal.

[0031] An embodiment of the present application also provides an integrated circuit, comprising any detection circuit described in the above scheme.

[0032] The detection circuit, method and integrated circuit provided by the embodiment of the present application, the detection circuit includes: a configuration circuit, an abnormality detection circuit and an alarm circuit; wherein the configuration circuit of the detection circuit configures a first clock signal for the detection signal line; the detection signal line is set in the area to be detected of the chip, and the electromagnetic signal outside the chip can be sensed by the detection signal line; the abnormality detection circuit of the detection circuit collects the signal output by the detection signal line, and uses the collected signal and the second clock signal to judge whether the chip is injected with an external electromagnetic signal, obtains a first judgment result, and outputs it to the alarm circuit of the detection circuit; the alarm circuit receives the first judgment result sent by the abnormality detection circuit, and generates an alarm when the first judgment result indicates that the chip is injected with an external electromagnetic signal. The scheme of the embodiment of the present application is simple to implement and occupies a small chip area because it detects digital signals; at the same time, the detection signal line is used as an antenna, and the antenna is a simple wire structure, which can flexibly change its shape and is easy to install in a narrow space. In this way, the antenna can be flexibly set in all areas to be detected of the chip according to the internal layout of the chip, so that the detection range of the chip can be expanded. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a schematic diagram of the first detection circuit structure of the embodiment of the present application;

[0034] Figure 2 This is a schematic diagram of the structure of the second detection circuit in the embodiment of the present application;

[0035] Figure 3 A schematic diagram of the method flow for detecting an embodiment of the present application;

[0036] Figure 4 This is a schematic diagram of the detection circuit architecture of the application embodiment of the present application;

[0037] Figure 5 This is a schematic diagram of the detection end architecture of the application embodiment of the present application;

[0038] Figure 6 An optional schematic diagram of the architecture of an adjustable delay device according to an embodiment of the present application;

[0039] Figure 7 This is a working timing diagram of the detection circuit of the application embodiment of the present application;

[0040] Figure 8 This is a schematic diagram of the method flow for detecting an application example of the present application. DETAILED DESCRIPTION

[0041] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0042] Side channel attack (SCA) is an attack method that infers the internal state of a device by observing the information leaked during the operation of the device. Generally, the cryptographic operation module in the device can run the cryptographic algorithm to perform various correct cryptographic operations, but when the device is disturbed, the cryptographic operation module may fail and make calculation errors. The method in which the attacker uses the failure and calculation errors of the cryptographic operation module to recover the device key is called fault analysis. Analyzing the attack object by manufacturing clock failure is a side channel attack method. Taking the cryptographic chip in the security chip as an example, the attacker injects electromagnetic signals such as external laser pulses or electromagnetic pulses into the cryptographic chip to extract secret parameters such as the key in the cryptographic chip, thereby making the cryptographic chip lose its confidentiality function.

[0043] In view of the above problems, a glitch detector can be used to actively detect the electromagnetic signal injected into the security chip. In the related art, the glitch detector is integrated at the position of the key signal line of the chip. When the electromagnetic signal outside the security chip is injected into the security chip through the electric field, magnetic field, etc., the manual wiring coil arranged on the surface of the security chip will generate an induced voltage. When the glitch detector detects that the induced voltage of the manual wiring coil exceeds the preset detection threshold, the glitch detector is triggered to alarm, thereby realizing the protection of the key signal line fault injection attack. Among them, the glitch detector needs to use an analog circuit to realize the detection of the collected analog signal, so the circuit is relatively complex. Therefore, a single glitch detector occupies a large area. In order to balance the performance and power consumption of the glitch detector, the power consumption of a single glitch detector cannot be very high. The shape of the antenna causes the effective detection range of a single glitch detector to be limited. In order to achieve full coverage detection of the security chip, it is necessary to integrate multiple glitch detectors in a security chip, which will greatly increase the chip area, not only increase the production cost, but also reduce the chip performance. In addition, the space of some areas to be detected in the security chip is limited. For example, the memory unit structure built into the security chip is special and the unit density is very high, such as static random access memory (SRAM). It is difficult to integrate the glitch detector in the limited space of these areas, which will cause the security chip to have a detection blind spot and cannot achieve comprehensive clock fault attack protection.

[0044] Based on this, in various embodiments of the present application, the detection circuit actively detects the electromagnetic signal injected into the security chip by detecting changes in the digital signal. The detection circuit has a simple structure, occupies a small area and can be flexibly integrated into the security chip, thereby reducing production costs and improving the comprehensiveness of clock fault attack protection.

[0045] The present application embodiment provides a detection circuit, such as Figure 1 As shown, the detection circuit includes: a configuration circuit 101, an abnormality detection circuit 103 and an alarm circuit 104; wherein,

[0046] The configuration circuit 101 is used to configure a first clock signal for a detection signal line 102; the detection signal line 102 is arranged in a chip to be detected area, and an electromagnetic signal outside the chip can be sensed by the detection signal line;

[0047] The abnormal change detection circuit 103 is used to collect the signal output by the detection signal line 102, and use the collected signal and the second clock signal to determine whether the chip is injected with an external electromagnetic signal, obtain a first judgment result, and output it to the alarm circuit 104;

[0048] The alarm circuit 104 is used to receive the first judgment result sent by the abnormal change detection circuit 103, and generate an alarm when the first judgment result indicates that the chip is injected with an external electromagnetic signal.

[0049] As mentioned above, the burr detector triggers an alarm based on the induced voltage of the manual wiring coil. The manual wiring coil is set in the chip near the metal layer. When the electromagnetic signal is injected into the chip, an induced voltage is generated between the manual wiring coil and the metal layer of the chip. The metal layer of the chip is located on the front of the chip, which causes the burr detector to be unable to detect the attack on the back of the chip. The embodiment of the present application uses a detection signal line as an antenna, and determines whether an electromagnetic signal is injected by detecting the level change of the detection signal output signal. When the electromagnetic signal is injected into the front and back of the chip, it will cause the level change of the detection signal line output signal. Therefore, the embodiment of the present application can detect the electromagnetic signal received by the front and back of the chip at the same time. In addition, the detection circuit of the embodiment of the present application detects digital signals, the circuit is simple to implement, the occupied area is small, and the antenna only needs one detection signal line that can flexibly adjust the shape. In this way, it can be flexibly set in each area to be detected according to the reserved space in the chip; at the same time, the detection circuit of the embodiment of the present application can be concealed and integrated at any position in the logic unit area of ​​the chip, and there is no physical boundary between the logic unit of the chip. Compared with the burr detector, it has the advantage of being difficult to identify, and has higher resistance to physical attacks while reducing product costs.

[0050] In actual application, the detection circuit of the embodiment of the present application can be placed near multiple key clock lines in the chip, which can protect multiple key modules, multiple clock domains and multiple key clock nodes in the chip, thereby improving the protection range of the chip. At the same time, after the detection circuit of the embodiment of the present application is integrated into functional units such as storage units, computing units, and registers, the original functional units can increase the ability to detect electromagnetic injection attacks, and the original functional units include but are not limited to logic circuit units and analog circuit units.

[0051] In actual application, due to different parasitic parameters in the circuit, the time taken for the clock signal to reach different parts of the circuit is also different. Therefore, there may be an inherent clock edge deviation (Skew) between the first clock signal and the second clock signal output by the detection signal line 102. In actual application, Skew can be called clock deviation. Skew will affect the first judgment result, thereby causing the alarm circuit 104 to generate a false alarm. Therefore, it is necessary to filter out the Skew between the first clock signal and the second clock signal output by the detection signal line 102.

[0052] Based on this, in one embodiment, if Figure 2 As shown, the detection circuit may further include:

[0053] A false alarm filtering circuit 105, used for verifying the first judgment result to obtain a second judgment result;

[0054] The alarm circuit 104 is used to receive the second judgment result sent by the false alarm filtering circuit 105, and generate an alarm when the second judgment result indicates that the chip is injected with an external electromagnetic signal.

[0055] In actual application, Skew will cause a level change of a certain length of time in the first judgment result, i.e., a glitch signal. These level glitches can also be called inherent glitches of the chip. The width of the inherent burrs of the chip is relatively small. When the external electromagnetic signal is injected into the detection signal line 102, the width of the inherent burrs will be increased, so that a glitch signal with a larger width will be generated in the first judgment result. The first judgment result can be delayed to filter out the inherent glitches with a smaller width in the first judgment result.

[0056] Based on this, in one embodiment, the false alarm filtering circuit 105 may include:

[0057] A delay circuit, used for delaying the first judgment result to generate a delay result;

[0058] The second logic gate is used to perform a logic operation on the first judgment result and the delay result to generate the second judgment result.

[0059] The inherent delay time of the delay circuit itself determines the delay time of the first judgment result. For different chips, the width of the chip inherent burrs is different, and the required delay time is also different. Therefore, it is necessary to set the inherent delay time of the delay circuit to be adjustable.

[0060] Based on this, in one embodiment, the delay time of the delay circuit for delaying the first judgment result is adjustable.

[0061] In actual application, the strengths of different electromagnetic signals injected from the outside are often different. For example, the electromagnetic signal emitted by the attacker during the electromagnetic injection attack scanning phase is to find the parts of the chip surface that are easily attacked. Therefore, the frequency of the electromagnetic signal during the scanning phase is relatively low, while the electromagnetic signal emitted during the attack phase is to destroy the signal of the specific attack part. Therefore, the frequency of the electromagnetic signal during the attack phase is relatively high. In addition, the conventional frequency detection method is based on whether an electromagnetic attack occurs more than a preset number N times within a certain period of time. The preset number N is set according to the electromagnetic signal frequency during the attack phase. The value of N is mostly more than 5 times. The electromagnetic attack frequency during the scanning phase is relatively low (for example, 1 or 2 times), which will cause the conventional frequency detection method to be unable to effectively detect the electromagnetic signal during the scanning phase. Therefore, in order to detect electromagnetic signals of different strengths, it is necessary to set the response strength of the first clock signal to be variable.

[0062] Based on this, in one embodiment, the configuration circuit 101 is specifically used to configure a first clock signal with variable strength for the detection signal line 102. Specifically, the configuration circuit 101 is specifically used to configure a first clock signal with variable strength for the detection signal line 102 according to the received enable signal. In this way, the electromagnetic signal injected into the chip can be effectively detected, the response is rapid, and it can effectively respond in both the scanning stage and the attack stage of the electromagnetic injection attack.

[0063] Exemplarily, the configuration circuit 101 may include at least one positioner, and the output ends of different positioners are connected in parallel to output the first clock signal; the more positioners are connected in parallel, the smaller the on-resistance of the configuration circuit, and the stronger the ability of the first clock signal to maintain a high potential or a low potential in the detection signal line, so that the first clock signal has a stronger ability to adapt to current changes in the detection signal line; because the ability to adapt to current changes reflects the ability to adapt to changes in the external magnetic field, the higher the strength of the first clock signal, the stronger the ability of the first clock signal to respond to changes in the external magnetic field. Therefore, by adjusting the number of positioners connected in parallel, the strength of the first clock signal can be adjusted.

[0064] In one embodiment, the alarm circuit 104 is further configured to generate an alarm and stop the alarm after receiving a reset request signal.

[0065] In one embodiment, the abnormality detection circuit 103 includes:

[0066] The first logic gate is used to perform a logic operation on the signal output by the detection signal line 102 and the second clock signal to generate the first judgment result.

[0067] In one embodiment, the alarm circuit 104 includes:

[0068] The trigger circuit is triggered when the first judgment result indicates that the chip is injected with an external electromagnetic signal, and generates an alarm.

[0069] The detection circuit provided in the embodiment of the present application, the configuration circuit 101 configures the first clock signal for the detection signal line 102; the detection signal line 102 is set in the area to be detected of the chip, and the electromagnetic signal outside the chip can be sensed by the detection signal line 102; the abnormality detection circuit 103 collects the signal output by the detection signal line 102, and uses the collected signal and the second clock signal to judge whether the chip is injected with an external electromagnetic signal, obtains a first judgment result, and outputs it to the alarm circuit 104; the alarm circuit 104 receives the first judgment result sent by the abnormality detection circuit 103, and generates an alarm when the first judgment result indicates that the chip is injected with an external electromagnetic signal. The scheme of the embodiment of the present application, the scheme of the embodiment of the present application, because it detects digital signals, the circuit implementation is simple and occupies a small area in the chip; at the same time, the detection signal line is used as an antenna, and the detection signal line is used as an antenna. The antenna is a simple wire structure, which can flexibly change its shape and is easy to install in a narrow space. In this way, the antenna can be flexibly set in all areas to be detected of the chip according to the internal layout of the chip, so that the detection range of the chip can be expanded.

[0070] Based on the above detection circuit, an embodiment of the present application further provides an integrated circuit, including the detection circuit provided by the embodiment of the present application.

[0071] Based on the above detection circuit, the embodiment of the present application also provides a detection method, such as Figure 3 As shown, the detection method comprises the following steps:

[0072] Step 301: The configuration circuit of the detection circuit configures a first clock signal for a detection signal line; the detection signal line is set in a to-be-detected area of ​​the chip, and an electromagnetic signal outside the chip can be sensed by the detection signal line;

[0073] Step 302: The abnormal change detection circuit of the detection circuit collects the signal output by the detection signal line, and uses the collected signal and the second clock signal to determine whether the chip is injected with an external electromagnetic signal, obtains a first judgment result, and outputs it to the alarm circuit of the detection circuit;

[0074] Step 303: After receiving the first judgment result sent by the abnormal change detection circuit, when the first judgment result indicates that the chip is injected with an external electromagnetic signal, the alarm circuit generates an alarm message.

[0075] In one embodiment, the false alarm filtering circuit of the detection circuit can verify the first judgment result to obtain a second judgment result; accordingly, after the alarm circuit receives the second judgment result sent by the false alarm filtering circuit, it generates an alarm when the second judgment result indicates that the chip is injected with external electromagnetic signals.

[0076] The present application is further described in detail below in conjunction with application examples.

[0077] Figure 4 This is an optional schematic diagram of the structure of the detection circuit of the application embodiment of the present application. Figure 4 As shown, the detection circuit includes a configuration terminal 401 , a detection signal line 102 and a detection terminal 402 .

[0078] The configuration end 401 may include a configuration circuit 101 for configuring an initial detection signal, ie, a first clock signal, for the detection signal line.

[0079] The configuration circuit 101 may include n parallel-connected N-channel metal oxide semiconductor field effect transistors (NMOS); the G pole of the NMOS tube is the enable signal input terminal of the NMOS tube, the D pole of the NMOS tube is the output terminal of the NMOS tube, and the output terminals of different NMOS tubes are connected in parallel to form the output terminal of the configuration circuit 301. Exemplarily, the selected NMOS tube can be designed with an inverted width-to-length ratio, and the impedance is 20 kilo-ohms to 50 kilo-ohms. The D pole of the NMOS tube outputs a weakly pulled-up level signal "1", and the initial detection signal output by the parallel NMOS tube is a level signal "1"; the number of parallel NMOS tubes is different, and the response strength of the initial detection signal of the configuration is different. Therefore, by using the enable signal to control the parallel connection of different numbers of NMOS tubes, the response to electromagnetic signals of different strengths can be achieved.

[0080] The detection signal line 102 can be a metal line, which is used to receive the initial detection signal output by the configuration circuit 101; the metal line is set in the area to be detected of the chip and can sense the electromagnetic signal injected into the chip. The metal line can be selected from the commonly used wires in the semiconductor processing field. For example, copper wires and aluminum wires used for transmission or power supply in the semiconductor processing field can be used; the length of the metal line can be determined according to the minimum length and maximum length of the area to be detected. For example, when the area to be detected is a rectangle, the length of the metal line is greater than the short side of the rectangle and less than the long side of the rectangle; for example, the length of the metal line can be 200μm to 500μm. The metal line outputs a signal to be detected. When an external electromagnetic signal is injected into the chip, a low-level signal "0" of a certain width will be generated in the signal to be detected, that is, there is a burr signal in the signal to be detected.

[0081] The detection end 402 may include an abnormal change detection circuit 103 , a false alarm filtering circuit 105 and an alarm circuit 104 , which are used to detect abnormal level changes in the signal to be detected output by the detection signal line 102 .

[0082] Figure 5This is a schematic diagram of the structure of the detection terminal 402 in the detection circuit of the application embodiment of the present application. Figure 5 As shown, the abnormal change detection circuit 103 may include an exclusive NOR gate (XNOR); the false alarm filtering circuit 105 may include an adjustable delay and an OR gate (OR); and the alarm circuit 104 may include a D flip-flop (FF1).

[0083] In the abnormal change detection circuit 103, the first input end of the XNOR receives the signal to be detected output by the detection signal line 102, the second input end of the XNOR receives the reference signal, the reference signal can be a level signal "1", and the output end of the XNOR outputs a first judgment result. When there is no glitch signal in the signal to be detected output by the detection signal line 102, the XNOR outputs a level signal "1", and when there is a glitch signal in the signal to be detected output by the detection signal line 102, the XNOR outputs a signal with a width of t glitch The level signal is "0", that is, "0" glitch.

[0084] In the false alarm filtering circuit 105, the adjustable delay device transmits the first judgment result of the XNOR output in the abnormality detection circuit 103 according to the inherent delay time t delay Delay is performed and a delay result is generated. OR compares the delay result with the first judgment result. When the first judgment result is a high-level signal "1", the OR output result is a high-level signal "1". When there is a "0" burr in the first judgment result, if the width t of the "0" burr is glitch Less than the fixed delay time t delay , the OR output result is a high level "1", if the width of the "0" glitch is t glitch Greater than the fixed delay time t delay , the OR output result includes high level "1" and low level "0".

[0085] It should be pointed out that the XNOR and OR used in the above embodiments are only examples of corresponding functional circuits. In actual applications, one or more logic gates (such as: exclusive OR gate (XOR), exclusive NOR gate (XNOR), AND gate (AND), OR gate (OR), NOT gate (NOT), etc.) can be used to form the same functional circuit.

[0086] In actual application, when the detection circuit is set in different chip environments, the inherent burr width of the detection circuit is different, and the fixed delay time t delay Therefore, the fixed delay time t of the adjustable delay device can be delay The setting is adjustable.

[0087] Based on this, Figure 6In the adjustable delayer shown, the adjustable delayer can be composed of n delayers (Delayers) connected in series in sequence. The input end of the first-stage delayer D1 serves as the input end of the adjustable delayer, which is used to receive the first judgment result output by the abnormality detection circuit 102. The output end of the last-stage delayer Dn serves as the output end of the adjustable delayer, which is used to output the delay result. Each stage of the delayer is provided with a gate switch, and the output end of each stage of the delayer is connected to the output end of the adjustable delayer through the corresponding gate switch. The more the number of delayers connected in series, the longer the fixed delay time t of the adjustable delayer is. delay The longer it is, the more you can change the number of Delayers in series by closing different selection switches.

[0088] It should be noted that the Delayer used in the above embodiment is only an example of a corresponding functional circuit. In actual application, the adjustable delayer can be composed of logic gate circuits with different delay characteristics, such as an inverter, a buffer, etc.

[0089] In actual application, the inherent burr width of the detection circuit can be combined with the adjustment selection signal to select which gating switch is closed, thereby adjusting the number of delayers in series. Exemplarily, the detection circuit is first integrated into the chip, and the chip is placed in a normal environment, which can be understood as placing the chip in an environment without external electromagnetic signal interference; then, different gating switches are closed in sequence, so that the number of delayers in series increases in sequence until the trigger generates an alarm. The number of delayers in series corresponding to the alarm generated by the trigger is the number of delayers that need to be set for the adjustable delayer.

[0090] It should be noted that the inherent delay time t delay The configuration adjustment can be implemented at any stage of chip testing and application, and the stage selection of the configuration adjustment does not affect the functional implementation of the present invention; the configuration adjustment value can be stored in the chip memory or the chip memory, such as: one-time programmable chip (OTP, One Time Programmable), flash memory (Flash), programmable read-only memory (EEPROM, Electrically Erasable Programmable read only memory), etc., and the storage location selection of the configuration adjustment value does not affect the functional implementation of the present invention.

[0091] In the alarm circuit 104, the clock terminal CK of FF1 receives the level signal output by the OR in the false alarm filtering circuit 105; when the OR outputs a high level "1", FF1 remains in a dormant state, and when the level signal output by the OR changes from a high level "1" to a low level "0", a falling edge is generated at the clock terminal of FF1, FF1 is triggered, and the output terminal Q of FF1 generates a continuous alarm level "0". Correspondingly, after the reset terminal SB of FF1 receives a reset request signal, FF1 is reset, and the level of the output terminal Q of FF1 changes from "0" to "1", thereby clearing the fault alarm.

[0092] It should be pointed out that the FF1 used in the embodiment of the present application is only an example of the corresponding functional circuit. In actual application, a variety of functional circuits can be used to achieve the same trigger alarm function. For example: a functional circuit with a latch output function such as a latch. Exemplarily, when the latch input receives a high-level signal "1", the latch outputs a low-level signal "1", and when it receives a low-level signal "0", the latch outputs a low-level signal "0" and maintains it, generating an alarm; accordingly, after receiving a reset signal, the latch output is reset and the alarm stops.

[0093] Figure 7 This is a working timing diagram of the detection circuit of the application embodiment of this application. Figure 7 As shown in the figure, before the electromagnetic signal is injected into the chip, the signal to be detected in the detection signal line maintains a high level "1", and the timing of the protected clock signal in the area to be detected in the chip is normal; when the electromagnetic signal is injected into the chip, the high level "1" in the signal to be detected changes to a low level signal "0", and the protected clock signal in the area to be detected is disturbed and the level changes. The rising edge of the protected clock signal after the level change causes a clock edge lag, which will cause the protected clock signal to fail logically due to a setup time error, thereby causing the attacker to obtain key information of the protected clock signal. Figure 7 It can be seen that the application embodiment of the present application can detect the change of the clock edge in the signal to be detected, and detect the injection of external electromagnetic signals within one clock cycle of the protected clock, and naturally has high-speed response characteristics. After each attack, the signal to be detected will be pulled up from the low level "0" to the high level "1". The greater the strength of the first clock signal received by the detection signal line, the higher the pull-up level of the output signal to be detected, that is, the greater the slope of the signal to be detected when it recovers from the low level "0" to the high level "1".

[0094] In actual application, the detection circuit of the embodiment of the present application is in a dormant state when no electromagnetic interference is detected, and the static power consumption increase is close to zero, with low additional power consumption, and can be applied to ultra-low power circuits. In addition, the detection circuit of the embodiment of the present application can automatically detect and automatically alarm, and is in a dormant state when no electromagnetic signal is injected. Therefore, there is no need to control the on and off through an additional enable switch, which saves control timing and reduces control difficulty.

[0095] Based on the above architecture diagram, Figure 8 As shown, the detection method of the application embodiment of the present application comprises the following steps:

[0096] Step 801: The configuration circuit configures a high level signal “1” for the detection signal line.

[0097] Step 802: The detection signal line receives the high-level signal "1" configured by the configuration circuit and outputs a signal to be detected; the detection signal line is set in the chip's detection area, and when it senses that the chip is injected with an electromagnetic signal, an error signal of a certain width is generated in the high-level signal output by the detection signal line, that is, the width is t glitch A low level signal "0".

[0098] Step 803: The XNOR of the abnormality detection circuit compares the signal to be detected with the high-level signal "1" and outputs a first judgment result; when the signal to be detected is a high-level signal "1", the first judgment result output by the XNOR is a high-level signal "1"; when the signal to be detected includes a low-level signal "0", the first judgment result output by the XNOR gate includes a high-level signal "1" with a width of t glitch A low level signal "0".

[0099] Step 804: The adjustable delay device of the false alarm filtering circuit is set according to the inherent delay time t delay Delaying the first judgment result output by XNOR and outputting the delayed result;

[0100] Step 805: the false alarm filtering circuit compares the delay result with the first judgment result by an OR operation, and filters out the Skew in the first judgment result;

[0101] If the width t of the low level signal “0” in the first judgment result glitch is less than the inherent delay time t delay , the OR output result is a high level signal "1"; if the width t of the low level signal "0" in the first judgment result glitch Greater than the inherent delay time t delay , the OR output result includes a high-level signal "1" and a low-level signal "0", that is, there is a falling edge of the level.

[0102] Step 806: The clock end of FF1 receives the level signal output by the OR, and is triggered when there is a falling edge in the level signal output by the OR, generating an alarm.

[0103] The solution provided in the embodiment of the present application has the following advantages:

[0104] Advantage 1: The glitch detector needs to detect the level mutation of the manually wired coil to realize fault injection detection. The detection circuit needs to use a sampling voltage-dividing capacitor-resistor array, which occupies a large chip area. The detection circuit provided in the embodiment of the present application uses a signal phase change detection structure to replace the level detection structure. The circuit is simple to implement, occupies a small chip area, and reduces the chip cost.

[0105] Advantage 2: The embodiment of the present application adopts a signal phase change detection structure to replace the level detection structure, and adopts a detection signal line as an antenna, and uses a digital logic unit to realize the detection function. The circuit is simple to realize, and the shape of the antenna can be flexibly adjusted, which is convenient for integration into the digital unit of the chip, and the performance and economy are well balanced. The level detection structure adopted by the burr detector needs to adopt an analog comparator to achieve high-speed response, and needs to adopt a large-area capacitor sampler to achieve high sensitivity. It is difficult to achieve the goal of fault alarm within one clock cycle at a cost close to that of the phase detection principle.

[0106] Advantage 3: The detection circuit used in the embodiment of the present application can detect the change of the clock edge in the detection signal, and naturally has a high-speed response characteristic, and it is easy to complete the fault alarm within one clock cycle;

[0107] Advantage 4: The detection circuit in the embodiment of the present application uses a digital detection unit, which is in a dormant state when no electromagnetic signal is injected, and automatically triggers an alarm when an electromagnetic signal is injected. Compared with the glitch detector, the circuit has low power consumption and does not require an additional enable switch to control the on and off of the circuit, making the control simpler.

[0108] Advantage 5: The detection circuit in the embodiment of the present application uses a digital detection unit, which can be easily integrated into the digital control part inside other data storage units (such as random access memory (RAM), read-only memory (ROM), Flash), to enhance the clock security of these clock-related macro modules (Macro), and the cost is very low.

[0109] It should be noted that: "first", "second", etc. are suitable for distinguishing similar objects, and are not necessarily used to describe a specific order or sequence.

[0110] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0111] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A detection circuit, characterized in that: include: Configuration circuit, abnormal change detection circuit, alarm circuit and false alarm filtering circuit; wherein, A configuration circuit is used to configure a first clock signal for a detection signal line; the detection signal line is arranged in a to-be-detected area of ​​the chip, and an electromagnetic signal outside the chip can be sensed by the detection signal line; an abnormal change detection circuit, used for collecting the signal output by the detection signal line, judging whether the chip is injected with an external electromagnetic signal by using the collected signal and the second clock signal, obtaining a first judgment result, and outputting the result to the false alarm filtering circuit; a false alarm filtering circuit, configured to perform delay processing on the first judgment result to generate a delay result, and compare the first judgment result with the delay result to obtain a second judgment result; The alarm circuit is used to receive the second judgment result sent by the false alarm filtering circuit, and generate an alarm when the second judgment result indicates that the chip is injected with an external electromagnetic signal.

2. The detection circuit according to claim 1, characterized in that: The false alarm filtering circuit comprises: A delay circuit, used for performing delay processing on the level signal corresponding to the first judgment result to generate a delay result; The second logic gate is used to compare the level signal corresponding to the first judgment result with the delay result to generate the second judgment result.

3. The detection circuit according to claim 2, characterized in that: The delay time length of the delay circuit for delaying the first judgment result is adjustable.

4. The detection circuit according to claim 1, characterized in that: The configuration circuit is specifically used to configure a first clock signal with variable strength for the detection signal line.

5. The detection circuit according to claim 4, characterized in that: The configuration circuit is specifically used to configure a first clock signal with variable strength for the detection signal line according to a received enable signal.

6. The detection circuit according to claim 1, characterized in that: The alarm circuit is also used to generate an alarm and stop the alarm after receiving a reset request signal.

7. The detection circuit according to any one of claims 1 to 6, characterized in that: The abnormal change detection circuit comprises: The first logic gate is used to compare the level signal output by the detection signal line with the level signal of the second clock signal to generate the first judgment result.

8. The detection circuit according to any one of claims 1 to 6, characterized in that: The alarm circuit comprises: The D flip-flop is used to generate an alarm and stop the alarm after receiving a reset request signal.

9. A detection method, characterized in that: include: The configuration circuit of the detection circuit configures a first clock signal for the detection signal line; The detection signal line is arranged in the to-be-detected area of ​​the chip, and the electromagnetic signal outside the chip can be sensed by the detection signal line; The abnormal change detection circuit of the detection circuit collects the signal output by the detection signal line, and uses the collected signal and the second clock signal to determine whether the chip is injected with an external electromagnetic signal, obtains a first judgment result, and outputs it to the false alarm filtering circuit of the detection circuit; The false alarm filtering circuit performs delay processing on the first judgment result to generate a delay result, and compares the first judgment result with the delay result to obtain a second judgment result; After receiving the second judgment result sent by the false alarm filtering circuit, when the second judgment result indicates that the chip is injected with an external electromagnetic signal, the alarm circuit of the detection circuit generates an alarm.

10. An integrated circuit, characterized in that: The detection circuit comprises the detection circuit according to any one of claims 1 to 8.

Images