Impedance monitoring system
Through the fully digital broadband calibration impedance monitor, the combination of perturbation current and voltage sensing ring oscillator is used to solve the problem of difficulty in detecting power analysis attacks in the prior art, and efficient detection and sensitivity monitoring of attacks in security systems are achieved.
Patent Information
- Application Number
- CN202380052761.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2022-06-09
- Filing Date
- 2023-06-09
- Publication Date
- 2025-02-25
AI Technical Summary
The prior art is difficult to effectively detect power analysis attacks in security systems, especially in power environments. Traditional monitoring methods cannot be applied to power environments above DC and cannot continuously detect runtime attacks.
The full digital broadband calibration-free impedance monitor is used to detect the presence of attacks through a perturbation current generator and a voltage sensing ring oscillator, combined with the controller's counting technology. The system is capable of integrating with zero area overhead and is suitable for a wide frequency range from DC to 2GHz.
Achieving attack detection of different detection devices and packaging/printed circuit board modifications enables mitigation of environmental changes without calibration costs, maximizes sensitivity to reactance, and eliminates the need for calibration or software support.
Smart Images
Figure CN119522430A_ABST
Abstract
Description
Technical Field
[0001] The present invention generally relates to an impedance monitoring system for detecting attacks on security systems. More specifically, but not limited to, the present invention relates to an all-digital broadband calibration-free impedance monitor for probe insertion detection to prevent power analysis attacks. Background Art
[0002] In physical layer attacks, power analysis is a fundamental threat to data security because it exploits on-chip information leakage through data-dependent chip consumption to retrieve confidential information (e.g., encryption keys) in a non-invasive manner. State-of-the-art adversarial techniques withstand attacks based on billions of power traces, and the complexity of state-of-the-art adversarial techniques can be effectively reduced via periodic encryption key updates in cost-sensitive devices. This approach a priori neutralizes the attack but cannot detect the attack execution. Unfortunately, the attack execution often indicates an escalation to a more dangerous threat.
[0003] In general, power analysis monitors the power supply current using the serial insertion of a probing device, thereby destroying the integrity of the off-chip power supply network and modifying the power supply impedance. Detection methods involving monitoring the power supply resistance are limited to the real part of the power supply impedance in direct current (DC), which limits the applicability of attack settings based on simple probing resistors and prohibits the perception of power supply environments above DC. Other attack detection schemes focus on detecting the inductive component caused by changes in the chip's surrounding environment through a dedicated port. Given the oscillatory nature of these methods, these methods are not suitable for power monitoring. On-chip digital sampling oscilloscopes have been considered, but it is not easy to support continuous runtime attack detection because on-chip digital sampling oscilloscopes require dedicated software support (often unavailable because dedicated software support interferes with workload execution) and require continuous field recalibration for temperature fluctuations.
[0004] It would be desirable to overcome or ameliorate at least one of the problems discussed above, or at least provide a useful alternative. Summary of the invention
[0005] The present invention discloses a novel power supply impedance monitor for detecting the insertion and package / printed circuit board (PCB) modification of a probing device in a security system, wherein the probing device attempts to perform a power analysis attack. An embodiment of the impedance monitoring system is an all-digital architecture, which allows an automated and portable design for detecting attacks on security systems.
[0006] An impedance monitoring system for detecting attacks on a security system is disclosed, comprising:
[0007] Perturbation Current Generator (PCG);
[0008] Voltage Sensing Ring Oscillator (VSRO); and
[0009] Controller,
[0010] Wherein the PCG generates a disturbance current to excite the source impedance of the safety system, and the controller counts the oscillations in VSRO generated by the voltage change of the safety system, and the controller is configured to detect the attack by:
[0011] Capture reference VSRO count;
[0012] capturing subsequent VSRO counts for a non-zero disturbance current; and
[0013] Subsequent VSRO counts were normalized based on the reference VSRO count.
[0014] The reference VSRO counts can be captured for zero disturbance current.
[0015] The controller may count oscillations in the VSRO only in true fractions of the disturbance period. The true fraction may include the resonant peak of the VSRO. The controller may be configured to analyze specific resonant peaks.
[0016] The disturbance current generated by the PCG may excite the source impedance at a predetermined frequency and current amplitude.
[0017] The controller may be configured to count the oscillations in the VSRO by normalizing the count of oscillations in the VSRO. The controller may detect an attack by identifying at least one of the following:
[0018] Change in height of peak-normalized counts;
[0019] a change in the excitation frequency of the disturbance current at which the peak normalized counts occur;
[0020] the presence of new peaks; and
[0021] The resonance shape changes.
[0022] The system can be integrated below the power pad.
[0023] The frequency of the disturbance current may be generated using a ring oscillator and a frequency divider circuit.
[0024] Advantageously, the impedance monitoring system has a wideband application. This enables detection of different attack scenarios from different probing devices to PCB / package modification or tampering. In some embodiments, the wide frequency range is from DC to 2 GHz (or higher), enabling excitation of different source impedances from insertion of a probing device and PCB / package modification.
[0025] Advantageously, the measurement technique is established to enhance sensitivity, resilience, and calibration-free operation. In some embodiments, counting sensitivity is enhanced by time scaling.
[0026] Advantageously, the impedance monitoring system can be implemented in a compact area - for example, under the power pads in some embodiments. The area of the proposed invention fits the area of a pair of power pads (ie, zero area overhead), allowing under-pad placement for inexpensive adoption.
[0027] Advantageously, some embodiments have fully automated standard cell based design. All submodules of these embodiments can still retain fully automated standard cell based design for easy and widespread adoption, system integration and in-situ testing. Automated Placement and Routing (PNR) in a single design iteration avoids manual optimization and iterative PNR.
[0028] As used herein, "fully automated" includes inserting the detection circuitry onto the system-on-chip design being performed via a common automated digital design flow.
[0029] As used herein, the term "standard cell" includes basic cells used to automatically generate digital designs. These cells are placed and then wired to implement the intended functions. The intention is that the proposed detection technology can be designed by reusing common standard cells and automated digital design flows. Therefore, no specific cells need to be specified.
[0030] As used herein, the term “submodule” and the like refers to the building blocks of the proposed detector architecture, which are Figure 2 The building blocks or chips or architecture shown in FIG. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] Embodiments of the invention will now be described by way of non-limiting examples with reference to the accompanying drawings, in which:
[0032] Figure 1 shows both a schematic diagram of a chip under a power analysis attack and the effect of the probing device on the power supply impedance;
[0033] Figure 2is a schematic illustration of a power supply impedance monitoring architecture of a system according to the present teachings, the power supply impedance monitoring architecture being used to detect attacks on a security system;
[0034] Figure 3 The temporal scaling of the maximum counting sensitivity around the resonance peak is shown;
[0035] Figure 4 The reduction of the effects of inherent process, voltage, temperature variations and noise (Process, Voltage and Temperature (PVT)) and noise using ratiometric measurements is shown;
[0036] Figure 5 The VSRO count is shown to describe the frequency response of the resistor, inductor and capacitor (RLC) impedance resulting from the addition of various PCT parasitics.
[0037] Figure 6 The robustness of the normalized VSRO counts with respect to voltage changes is shown;
[0038] Figure 7 The robustness of normalized VSRO counts with respect to temperature changes is shown;
[0039] Figure 8 shows the ability to detect resistance changes at a 1-Ω probe resistor and use Figure 2 Measurement of the system and the error distribution with and without the probe inserted;
[0040] Fig. 9 shows the ability to detect capacitance changes with a 1-Ω probe resistor and use Figure 2 Measurement of the system and the error distribution with and without the probe inserted;
[0041] Fig.10 shows that it is possible to detect inductance changes with a 1-Ω probe resistor and use Figure 2 Measurement of the system and the error distribution with and without the probe inserted;
[0042] Fig.11 shows that it is possible to detect combined capacitance and inductance changes with a 1-Ω probe resistor and use Figure 2 Measurement of the system and the error distribution with and without the probe inserted;
[0043] Fig.12 It is shown that the system of the present teachings can detect state-of-the-art active current probes; and
[0044] Fig.13 The change in quality (Q) factor due to changes in inductance and capacitance, which results in a change in the resonant shape, is shown. DETAILED DESCRIPTION
[0045] A novel power supply impedance monitoring system is described below, which is used to detect the insertion of a probing device and package / printed circuit board (PCB) modification in a security system to prevent power analysis attacks. Some embodiments of the system are fully digital architectures, allowing monitoring automation. Moreover, the system is implemented in a highly compact area, allowing under-pad placement with zero area overhead. In addition, some examples of the system employ measurement techniques that ensure environmental changes are mitigated without calibration costs and maximize sensitivity to reactance.
[0046] refer to Figure 1 , the top diagram shows a power analysis attack. A probing device 100 probes a power network 102. The probe can be a simple resistance probe or a current probe, or involve a PCB modification or inductor capacitor attack, for example, where the capacitance is changed to mimic the original impedance given the impedance of the probe itself. The power supply current distribution is measured, thereby leaking information, such as an encrypted key 104.
[0047] exist Figure 1 The bottom image in Figure 1 shows a schematic model 106 of a power network with resonances across the source 108 caused by the power cables and PCB, and resonances across the load 110 caused by the bond wires or package and on-chip parasitics. These resonances produce peaks 112, 114 in the impedance at specific frequencies, respectively. The change in the source impedance profile with frequency is the result of an attack by inserting a probing device to tamper with the PCB / package parasitics.
[0048] Figure 2 An impedance monitoring system 200 is shown for detecting an attack on a security system, such as in Figure 1 . System 200 includes a perturbation current generator (PCG) 202, a voltage sensing ring oscillator (VSRO) 204, and a controller 206. PCG 202 generates a perturbation current to excite the source impedance of the safety system 210. This causes the voltage of the safety system to change. Controller 206 counts the oscillations in VSRO 204 that are generated by these voltage changes.
[0049] The controller 206 captures the reference VSRO count—that is, the value of the reference VSRO count in the absence of a disturbance current I PERT . Then, the controller 206 captures subsequent VSRO counts for non-zero disturbance currents. The controller 206 detects the attack by normalizing subsequent VSRO counts based on the reference VSRO count. Therefore, the controller 206 of the proposed impedance monitor architecture enables the following techniques to enhance resilience / sensitivity.
[0050] Disturbance current I PERT The power source may be generated by any suitable means or received from an external power source. Figure 2 In the embodiment, I PERT The analog current generated in the power DAC 212 is generated by a power digital-to-analog converter (DAC) 212 to excite the source impedance at a desired or predetermined frequency and current amplitude. The frequency on the analog current generated in the power DAC 212 is managed by a clock generator 214. The clock generator 214 currently includes a ring oscillator 216 and a frequency selector 218.
[0051] VSRO 204 performs an approximately linear conversion of voltage deviation to frequency—that is, VSRO 204 generates counts of deviations. Impedance monitoring system 200 uses a controlled current I PERT The source impedance of the safety system 210 is stimulated and the subsequent voltage change is measured by counting the oscillations in the Voltage Sensing Ring Oscillator (VSRO) 204 to achieve fully digital automated monitoring of the source side impedance.
[0052] As reflected at 218 , the system 200 occupies an area that is approximately equal to or possibly less than the size of a bond pad of a source side impedance meter or other device, thereby enabling integration below the pad for zero or near zero area overhead.
[0053] System 200 covers a wide range of attack scenarios from probing resistors (Direct Current (DC)) to package modification attacks at frequencies ranging from DC to 2 GHz at run time. Compared to hitherto known systems in source impedance or environmental monitoring, the normalized area of the proposed invention is 21 times smaller than sampling oscilloscope detection systems and 67 times smaller than systems that monitor inductance through dedicated ports - and such systems are not suitable for source side monitoring. Wideband operation up to 2 GHz is experimentally demonstrated, eliminating the limitations on resistance and inductance in previous systems while achieving a bandwidth 2.5 times wider than known systems. The all-digital design and small size of system 200 simplify integration and portability, and is resilient against variations and noise, as shown in reference Figures 5 to 12 displayed, eliminating the need for calibration or software support.
[0054] A disturbance frequency f in the range of DC to 2 GHz is generated on chip using clock 212 PERT The clock 212 uses a ring oscillator (RO) 214 and a frequency divider circuit 216 for frequency selection. PERT The scope enables detection of different probing devices such as resistors, inductors, capacitors, combined capacitors and inductors, smart attacks and state-of-the-art current probes, as well as PCB / package modifications. The VSRO 204 is used to sense changes in the supply voltage due to the insertion of a probing device.
[0055] The controller 206 enables the use of measurement techniques such as time scaling. Time scaling maximizes the counting sensitivity to changes in reactance or impedance. This is achieved by modifying the time resolution of the counts (expanding or shrinking the time frame over which peaks are detectable) or the time resolution of the observation window over which peaks in current, resistance, inductance, or a combination thereof are identified to expose changes that are more difficult to discern at other time resolutions. The VSRO 204 is only measured at the disturbance period time T. PERT True fractional counting and uses ratiometric acquisition (i.e., output is proportional to input) to suppress global process, voltage, and temperature variations.
[0056] When the disturbance frequency 1 / T PERT Close to the resonance peak f 谐振 When the voltage oscillation is continuous, it has an average value close to zero. Therefore, continuous counting cannot measure the corresponding impedance. Therefore, T is determined by referring to the resonant peak of VSRO. PERT In particular, the controller is configured to analyze a specific window of the disturbance period. In some embodiments, the specific window includes 37.5% of the time points of each disturbance period - that is, to 37.5% of the time points in the disturbance period, so that it is necessary to analyze the disturbance period at 0.375·T PERT VSRO counting is activated in a window of . This maximizes the VSRO count, and therefore maximizes the reactance discrimination. For simplicity, the specific window can be adjusted without significant loss of accuracy. For example, the specific window can include a time point halfway through each perturbation cycle - that is, approximately 0.5·T PERT time point - for simple implementation. The active high counter allows the count to be driven directly by the disturbance signal at 0.5·T PERT Only 15.2% of the VSRO count is sacrificed. Figure 3 As shown, the power supply voltage deviation from the initial value at a frequency close to resonance is equal to 0.375*T PERTThe VSRO pulse is most obvious at the time of t = 0.375*T (see the minimum value of the voltage waveform in the same graph). Therefore, the corresponding count of the VSRO pulse is the largest. This means that when t = 0.375*T PERT The maximum detection sensitivity to power supply deviations is achieved when evaluating the count at t = 0.5*T. PERT Keep the counts almost the same with minimal sensitivity loss. At the same time, at t = 0.5*T PERT The evaluation count at t = 0.375*T is usually higher than that at t = 0.375*T PERT is simpler because the previous value only needs to be in T PERT The count reading in the middle of the cycle (for example, by PERT The count is read at the middle edge of the periodic waveform, which can be freely implemented). Of course, this leads to a simpler implementation, but in principle one can still use t=0.375*T PERT as a count-reading point, albeit at the expense of more complicated timing.
[0057] Time scaling as described herein allows for the selective analysis of specific resonant peaks. Peaks at higher frequencies are essentially masked from the counts. In fact, such peaks have a higher frequency than T PERT The T2 has a faster response and therefore has enough time to reach steady state (to cause voltage and count deviations). Similarly, the peak at lower frequencies is essentially masked from the counts. In fact, this peak has a higher frequency than T3. PERT Slower response, and therefore not enough time to reach steady state. In each case, this results in a zero mean value across the ringing period.
[0058] Figure 4 The global process variations, moderately fast voltage fluctuations, and temperature variations are shown to be suppressed by ratiometric acquisition. For ratiometric reading, first the I PERT =0 (zero disturbance current) to obtain a reference VSRO count of 400. PERT = 0 to capture the environmental changes in the baseline count. Immediately thereafter, the expected I PERT The counts are normalized to the former and can be used to quantify the relative change. PERTThe current-induced (induced by supply voltage changes) VSRO count is simply divided by the count in the absence of the perturbing current (as a baseline). Both counts are equally affected by process, voltage, temperature variations, and time-averaged noise throughout the counting process. Therefore, the ratio of the two counts is almost independent of these non-idealities and becomes robust to variations and noise. This relative change is independent of voltage and temperature. Rapid voltage fluctuations (e.g., due to current drawn by other circuits) are treated as noise and mitigated by averaging, which is achieved by repeating the same (ratiometric) measurement and accumulating the counts without resetting in between.
[0059] Measurements performed on a 28-nm test chip show that the VSRO count describes the frequency response of the RLC impedance, as Figure 5 The ratiometric counting employed is inherently robust to supply voltage and temperature fluctuations, as shown in Figure 6 and Figure 7 This reduces the VSRO counting sensitivity by 6.8 and 7.2 times compared to absolute counting.
[0060] Figure 8 The detection of a 1-Ω probing resistor and the error distribution without and with insertion are shown. Figure 8 The normalized count distribution in , the distinction between attack and non-attack cases is simple and robust when the distance exceeds 30σ and the minimum detectable resistance is 190mΩ at 6-σ reliability. In all attacks below, a decision boundary of 6σ is nominally considered to distinguish from non-attack. The ability to distinguish between two counts under attack and no-attack (i.e., under power network changes and no changes) is usually quantified by the statistical distribution of the counts under these two conditions. In particular, the robustness is quantified by the distance of the mean μ of the counts under attack and no-attack, and then dividing the distance by the sum of the standard deviations σ of the two distributions.
[0061] The same considerations apply, and apply to even higher σ distances, to capacitance changes, inductance changes, and combined capacitance and inductance changes, as in Figures 9 to 11 Reflected in. Fig.10 and Fig.11 , the controller detects the attack by identifying a change in the excitation frequency of the disturbance current at which the peak normalized count occurs. Fig.11 , the controller detects the attack by identifying the presence of new peaks as reflected in the explosion portion of the trajectory. Fig.12Detection of a state-of-the-art active current probe is shown in FIG, where a resonant frequency shift due to the added inductance of the state-of-the-art active current probe is detected. The controller can detect an attack by identifying changes in the height of the peak normalized counts, the frequency at which the peak occurs, and various other measures. The peak itself is clearly distinguished from the peak at which no attack occurs - the baseline trace.
[0062] Therefore, the controller can similarly detect an attack by identifying a change in the resonance shape. Even if the attacker manipulates the passive impedance (e.g., capacitor) to mimic the same resonant frequency ∝1 / (LC) after inserting the inductive probing device 0.5 , Q factor ∝(L / C) 0.5 Still due to the change of L and C, the resonance shape changes, such as in Fig.13 For example, a smart attack may restore the resonant frequency to the original resonant frequency, but the normalized count will identify the manipulation via the change in the shape of the resonance, because the change in inductance or capacitance at the same resonant frequency modifies the shape of the frequency peak. Therefore, the manipulation is still detected by the system 200. This is reflected at numeral 1300, which can be compared to the peak at 1302, where the integrity of the bond or package (i.e., no attack has occurred) is confirmed by the comparable peak shape.
[0063] When compared to previous power monitoring systems, for impedance monitoring or environmental monitoring, the normalized area of system 200 is comparable to previous power supply resistance monitoring techniques. Moreover, system 200 is much smaller than on-chip digital sampling oscilloscope techniques and techniques that use dedicated ports to detect changes in inductive components. In some embodiments, system 200 can fit within a pair of power pads, enabling integration beneath the pads with zero area overhead. Wideband operation up to 2 GHz has been demonstrated, eliminating the limitations on resistance and inductance in previous techniques while achieving a bandwidth that is 2.5 times wider than on-chip digital oscilloscope techniques. Resilience to variations and noise eliminates the need for calibration or software support compared to known techniques. Additionally, proper measurement techniques ensure that environmental variations are mitigated with no calibration cost and maximize sensitivity to reactance, the results of proper measurement techniques are shown in Figures 5 to 12 Displayed in.
[0064] It will be apparent that many further modifications and permutations of various aspects of the described embodiments are possible. Accordingly, the described aspects are intended to embrace all such alterations, modifications and variations that fall within the spirit and scope of the appended claims.
[0065] In this specification and the claims that follow, unless the context requires otherwise, the word "comprise" and variations such as "comprises" and "comprising", will be understood to imply the inclusion of stated integers or steps or groups of integers or steps but not the exclusion of any other integers or steps or groups of integers or steps.
[0066] Reference in this specification to any prior publication (or information derived from any prior publication), or reference to any known matter, is not and should not be taken as an acknowledgement or acknowledgment or any form of suggestion that the prior publication (or information derived from any prior publication) or known matter forms part of the common general knowledge in the field to which this specification is intended to relate.
Claims
1. An impedance monitoring system for detecting an attack on a security system, comprising: Perturbation current generator PCG; Voltage sensing ring oscillator VSRO; as well as Controller, wherein the PCG generates a disturbance current to excite the power supply impedance of the safety system, and the controller counts the oscillations in the VSRO generated by the voltage change of the safety system, and the controller is configured to detect the attack by: Capture reference VSRO count; capturing subsequent VSRO counts for a non-zero disturbance current; and The subsequent VSRO counts are normalized based on the reference VSRO count.
2. The system according to claim 1, wherein: The reference VSRO counts are captured for zero disturbance current.
3. The system according to claim 1 or 2, wherein: The controller counts oscillations in the VSRO only in true fractions of the disturbance period.
4. The system according to claim 3, wherein: The true fraction is determined with reference to the resonant peak of the VSRO.
5. The system according to claim 3 or 4, wherein: The controller is configured to analyze a specific window of the disturbance period.
6. The system according to claim 5, wherein: The specific window includes 37.5% of the time points of each disturbance period.
7. The system according to claim 5, wherein: The specific window includes a time point midway through each disturbance cycle.
8. The system according to any one of claims 1 to 7, wherein: The disturbance current generated by the PCG excites the source impedance at a predetermined frequency and current amplitude.
9. The system according to any one of claims 1 to 8, wherein: The controller is configured to count the oscillations in the VSRO by normalizing the count of oscillations in the VSRO.
10. The system according to claim 9, wherein: The controller detects the attack by identifying changes in the height of the peak normalized counts.
11. The system according to claim 9 or 10, wherein: The controller detects the attack by identifying a change in the excitation frequency of the disturbance current at which the peak normalized count occurs.
12. A system according to any one of claims 9 to 11, wherein: The controller detects the attack by identifying the presence of new peaks.
13. A system according to any one of claims 9 to 12, wherein: The controller detects the attack by identifying a change in the resonant shape.
14. A system according to any one of claims 9 to 12, wherein: The controller detects the attack by identifying a resonant frequency shift.
15. The system of any one of claims 1 to 14, integrated below a power pad.
16. The system according to any one of claims 1 to 15, wherein: The frequency of the perturbation current is generated using a ring oscillator and a frequency divider circuit.