Probe scheme for detecting laser voltage detection attacks

Abstract

A sensor structure for detecting an attack on a transistor is disclosed. The structure includes a plurality of sensor clusters. Each sensor cluster comprises a plurality of photoelectric detectors and a plurality of transistors, and each photoelectric detector is arranged adjacent to the corresponding transistor; a standard unit; and an aggregator. The standard cell comprises a threshold comparator for: comparing a first input from a first group of photodetectors of a respective cluster and a second input from a second group of photodetectors of a respective cluster, the first and second inputs being proportional to incident light sensed by the respective photodetectors; and flipping the output of the standard cell if the difference between the first input and the second input exceeds a predetermined threshold. An aggregator aggregates the outputs from the clusters to produce an aggregated output and triggers an alert in the event that an attack is detected based on the aggregated output.

Description

Technical Field

[0001] In general, the present invention relates to a detector scheme for detecting Laser Voltage Probing (LVP) attacks on transistor arrays. More specifically, the present invention relates to, but is not limited to, a sensor structure for design-independent LVP attack detection that provides full-area coverage. Background Art

[0002] Recently, on-chip data security has been threatened by a range of physical attacks ranging from non-invasive to (semi-)invasive. Although more laborious, the latter is generally more effective in retrieving on-chip secrets. Among them, Laser Voltage Probing (LVP) has recently gained strong attention due to its high success rate. The LVP attack basically establishes a physical side channel by irradiating a laser beam on a specific network from the back of the die and recovering its voltage by time-averaged observation of the backscattered signal. In laboratories that provide reliability and fault analysis services to silicon debugging, the cost and workload of LVP attacks have dropped to minutes (up to a few hours), charging about $1,000 per hour. This has made such attacks easy to access, deploy, and much cheaper than the potential value stored on the chip (e.g., cold storage wallets for blockchains of cryptocurrencies and non-fungible tokens (NFTs)). LVP attacks are systematic and circumvent most countermeasures because the latter mainly protect the front of the die.

[0003] Because LVP attacks target the backside of the die and have excellent spatial resolution down to a single net (the shape of electrical connections on conductive layers such as polysilicon and metal layers), on-chip countermeasures are challenging and require expensive customization in the manufacturing process (e.g., via optical scrambling) or the packaging process (e.g., via optical coatings that participate in encryption). Process customization is also explored to detect volumetric thickness changes determined by die preparation for LVP, although this does not allow attack detection at above-bandgap wavelengths (>1.1μm) without silicon removal and conventional wafer / die post-processing (e.g., backside grinding for system-in-package integration). Backside customized coatings are also explored to detect intrusions, although backside customized coatings require impractical and power-hungry on-chip light-emitting diodes.

[0004] On-chip LVP attack detection has also been studied. Although easier than adversarial, LVP is still more challenging than other laser-based attacks, such as Laser Fault Injection (LFI). Other schemes for LVP attack detection have been considered. Self-timing sensors have recently been demonstrated for static signals. Ring oscillators are used to monitor standard cells in the vicinity of the ring oscillator, but full area coverage is not feasible under practical power / area budgets. Hidden gates are explored, but are easily circumvented by sub-cell spatial resolution. And cell-based detection cannot sense wavelengths above the bandgap used in LVP attacks.

[0005] Compared to LFI attacks, LVP attacks aim to leave the circuit largely undisturbed when exposed to a laser beam. This requires using weaker laser power, wavelengths above the bandgap, and precise laser spots down to a single transistor. This makes detection more difficult.

[0006] In general, no LVP detection with full area coverage, unchanged manufacturing / packaging processes, sufficient sensitivity for both above-bandgap and below-bandgap wavelengths, and fully automated design is available.

[0007] It would be desirable to overcome or ameliorate at least one of the problems described above with current approaches for detecting LVP attacks, or to at least provide a useful alternative. Summary of the invention

[0008] Embodiments of the sensor structure proposed herein (a collection of regularly placed photosensors on a chip, where the chip may have other components such as transistors) provide a design-independent LVP attack detection scheme with always-on and full-area coverage. The embedding of photosensors within standard cells allows for full-area coverage and automated design while preserving the geometry of transistor gate polygons on the grid for unrestricted adoption in physical design flows and preserving process scalability. The decision margin and sensitivity are shown to be more than sufficient for any practical level of incident laser power necessary to launch such attacks.

[0009] The present invention provides a sensor structure for detecting an attack on a transistor. The structure includes a plurality of sensor clusters. Each sensor cluster includes a plurality of photodetectors and a plurality of transistors, a standard cell and an aggregator, each photodetector being arranged adjacent to a corresponding transistor. The standard cell includes a threshold comparator, which is used to: compare a first input from a first photodetector group of a corresponding cluster and a second input from a second photodetector group of a corresponding cluster, the first input and the second input being proportional to the incident light sensed by the corresponding photodetector; and, in the case where the difference between the first input and the second input exceeds a predetermined threshold, flip the output of the standard cell. The aggregator aggregates the outputs from the cluster to generate an aggregated output, and triggers an alarm if an attack is detected based on the aggregated output.

[0010] Therefore, the embodiments described herein introduce an on-chip detection scheme for LVP attacks. By inserting a photodetector (pn junction) into each standard cell adjacent to each transistor, the photodetector spacing achieves 100% area coverage. As used herein, when the term "adjacent" is used with reference to a photodetector adjacent to a transistor, the term "adjacent" refers to a photodetector adjacent to a transistor, or a photodetector close enough to a transistor without a circuit between them, or a photodetector close enough to detect an incident laser spot of a predetermined size. Similarly, the terms "nearby" or "adjacent" can refer to the closest component - for example, a nearby photodetector is the closest photodetector.

[0011] Advantageously, embodiments provide on-chip LVP attack detection with 100% area coverage.The LVP attack using an optimal laser spot size of 220 nm on a protected Advanced Encryption Scheme / Standard (AES) on-chip core is very powerful.

[0012] Advantageously, embodiments of the sensor structure cover both above-bandgap laser detection and below-bandgap laser detection. In such embodiments, detection of LVP attacks is achieved with laser wavelengths up to 1319 nm, which is above the silicon bandgap (~1.1 eV), and the present silicon-based photodetector scheme inherently achieves below-bandgap detection.

[0013] Advantageously, the design permits fully automated standard cell-based design. This facilitates wafer adoption and system integration because there is little or no modification to the production process and, in some embodiments, the form factor is changed in only one direction - along the V sense line or channel. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Embodiments of the invention will now be described by way of non-limiting examples with reference to the accompanying drawings, in which:

[0015] Figure 1 is an embodiment of the proposed on-chip LVP detection scheme, the proposed on-chip LVP detection scheme includes a laser photodetector structure based on a standard cell;

[0016] Figure 2 is used to combine with Figure 1 An example of a standard photosensitive standard cell in a detection scheme;

[0017] Figure 3 The Gaussian laser intensity spatial distribution of the optimal LVP laser spot size (1319 nm wavelength, full width at half maximum FWHM < 220 nm) is shown;

[0018] Figure 4 shows geometric considerations regarding photodetector placement in a photosensitive standard cell; and

[0019] Figure 5 a to Figure 5 h shows experimental measurements performed on process variations across an array of 128 photodetector clusters, and on V with and without the LVP attack and AES running in ambient light. sense Histogram readings of the sense voltage on Figure 5 a to Figure 5 d is N cluster = 17 array results on laser power, supply voltage and wavelength, and Figure 5 e to Figure 5 h is N cluster =102 array results on laser power, supply voltage and wavelength. DETAILED DESCRIPTION

[0020] With an LVP detection scheme as described herein, a substantial reduction in LVP laser power is required for attacks to be unsuccessfully detected. In many or all cases, the laser power is necessarily below the sensitivity required for the attack, thereby hindering success. Moreover, reducing the laser power quadratically increases the LVP attack time. The increase in LVP attack time is capped at a value of around a few hours, after which the attack is unsuccessful. The effects of long exposure are understood from common practice in laser voltage probing for reliability and failure analysis. In fact, longer attacks (e.g., most of a day) are recognized to be infeasible due to drift of the equipment (e.g., focus, stage instability) and slow thermal expansion in the die and optics (e.g., solid immersion lenses).

[0021] refer to Figure 1 The sensor structure 100 is used to detect attacks on transistors, especially LVP attacks. The sensor structure 100 includes a plurality of clusters 102 of photodetectors and transistors, a detector standard unit 104, and an aggregator 106. Figure 1 In the embodiment shown in , a plurality of detector standard cells 104 are provided, one detector standard cell 104 per cluster 102, all of which are fed into a single aggregator 106. It is noted that the aggregator 106 may be of any design and may include a single circuit as shown or other circuits that feed the output to the aggregation circuit to implement the aggregation functions described below. All such embodiments will be apparent to those of ordinary skill in the art in light of this disclosure.

[0022] Each cluster 102 is formed by a plurality of photosensitive standard cells 200. Figure 2 1 shows one of a plurality of light-sensitive standard cells 200. Each light-sensitive standard cell 200 includes one or more photodetectors, the one or more photodetectors being adjacent to corresponding transistors. Figure 2 The light-sensitive standard cell 200 comprises two photodetectors 202, which are alternately connected with transistor fingers 204. Each transistor finger comprises one or more transistors, which are used to record data.

[0023] There may be a one-to-one relationship between photodetectors 202 and transistor fingers 204. However, the spacing between photodetectors 202 may be determined in other ways based on an expected or predetermined spot size of the laser used in an LVP attack, as discussed below.

[0024] Each cluster 102 may include a first photodetector group and a second photodetector group - the groups may have the same number of sensor standard cells, or may have different numbers of sensor standard cells. Figure 1 In the embodiment shown in FIG. 1 , each group (first group 108, second group 110) includes one or more light-sensitive standard cells, and currently includes many light-sensitive standard cells. No photodetector is in more than one group. The photodetector is connected to the V associated with the first group 108 through the sensing line. sense1 (112) and V associated with the second group 110 sense2 (114), electrical communication. The first group 108 and the second group 110 are connected along V sense1 (112) and V sense2 ( 114 ) provides a corresponding input to the threshold comparator 116 of the detector standard unit 104 .

[0025] Comparator 104 compares along V sense1(112) receives the first input and along V sense2 (114) A second input is received to identify the difference between the first input and the second input. Prior to comparison, the detector standard cell 104 may amplify the first input and / or the second input at an amplifier stage 116, which currently includes an operational amplifier (OpAmp) for each sense line. The comparison is performed by any suitable circuit, currently an exclusive-OR (XOR) gate 118. If the outputs are the same, the XOR gate 118 will output a zero (low), otherwise it will output a one (high). Thus, if the difference between the first input and the second input exceeds a predetermined threshold, such as a threshold sufficient to cause one of the inputs to be considered low and the other input to be considered high, the output of the detector standard cell 104 is flipped, such as from low to high.

[0026] In other words, the detector standard cell 104 compares Vsense on the Ncluster photodetectors (first group 108) connected to the detector standard cell 104 on the left side of the detector standard cell 104 and the Ncluster photodetectors (second group 110) on the right side of the detector standard cell 104. Figure 1 As shown, the detector standard unit 104 is a pair of two-stage comparators - the first stage (116) converts the associated V sense The lines are compared to ground (or a reference value) and any differences are amplified, and the second stage (118) compares the now amplified differences to each other - when the difference between the left / right half clusters is above a decision threshold or a predetermined threshold, the pair of two-stage comparators flips their outputs. The same decision threshold can be used throughout the detector standard unit regardless of the sensor cluster size. This means that the parameters that define the architecture (e.g., Ngate pitch, Ncluster) can be set or fixed at design time. Therefore, no calibration is required.

[0027] After each detector standard cell confirms or otherwise confirms the incident laser spot detection, the aggregator 106 then aggregates the outputs from the clusters - these outputs are output from the corresponding detector standard cells as low or high comparison results - to produce an aggregated output. The aggregated output triggers an alarm when an attack is detected based on the aggregated output. The detection can be that the number of detector standard cells with high output (or low output in some embodiments) exceeds a predetermined threshold, indicating that the cluster associated with the high (or low) detector standard cell output is receiving incident laser light.

[0028] Embodiments of the sensor structures presented herein, such as sensor structure 100, provide a design-independent LVP attack detection scheme. The detection scheme is always on - output is generated only when incident laser light is applied - and the detection scheme provides full-area coverage. The embedding of photodetectors (also referred to as photosensors) within standard cells allows for full-area coverage and automated design while retaining the geometry of transistor gate polygons on the grid for unrestricted adoption in the physical design flow and retaining process scalability. The outputs of the sensors are ultimately aggregated - which can be aggregated through an automatically synthesized logic tree that generates system-level attack detection flags from sensor-level flags or other mechanisms - by locally aggregating the sensor outputs through adjacency via automatically placed and routed detector standard cells.

[0029] In particular, after amplification at stage 116, the decision margin and sensitivity are shown to be more than adequate for any practical level of incident laser power necessary to launch such an attack. The ability to detect the laser beam on-chip and at run-time forces the adversary to reduce the laser power during the attack. This, in turn, forces the Signal-to-Noise Ratio (SNR) in the detected reflected beam to degrade below the sensitivity of the proposed detection scheme, and thus quadratically increases the attack time to a level where device drift and thermal expansion dominate. In this case, no SNR improvement is achieved when the attack time is further extended, and thus no knowledge of the on-chip target voltage can be gained from the attack.

[0030] Further with respect to the cluster 102, the photodetectors 202 are spaced at intervals sufficient to achieve full area coverage (i.e., visibility of LVP attacks on any transistor in the sensor structure). In practice, this means that the photodetectors 202 must be spaced based on an expected or predetermined laser spot size. The spot size may be the diameter of the incident laser. For full area coverage, the photodetectors must be spaced such that there is no space on the sensor structure that is the size of the predetermined laser spot or larger that does not include at least one photodetector 202.

[0031] In order to keep each LVP sensor within one laser spot size of the immediately adjacent LVP sensor under standard cell protocol, Figure 4 As can be seen in a, it is necessary to place a photodetector 202 in a regular pattern, where the distance between the photosensors is an appropriate number of gate spacings N gate pitch , so that under a common laser beam with Gaussian distribution power density, the laser spot can be detected at any position on the chip:

[0032] N gatepitch ≤w laser / CGP=1.7·FWHM / CGP(1)

[0033] where wlaser is the laser spot size and CGP is the contact gate spacing set by the layout design rules and the standard cell architecture. Since the laser is Gaussian in spatial distribution, the laser spot size in (1) is defined as the diameter at ±2 standard deviations, or equivalently as 1.7 ± FWHM, where FWHM is Figure 3 The full width at half maximum power in the full width at half maximum power shows the normalized intensity relative to the lateral distance from the center of the laser spot - the upper figure is a plan view, and the lower figure shows a Gaussian distribution over an area through the center of the laser spot. The placement of the photosensor or photodetector can be adjusted depending on the transistor layout to provide full area coverage, as will be apparent to those skilled in the art in view of the present teachings.

[0034] At wavelengths above the bandgap, the currently best available FWHM in (1) is 200-220 nm. Therefore, this diameter was used in the attack setup of the experiments described below.

[0035] At 28nm, the Ngate pitch in (1) is resolved to 2, as shown in Figure 3 As shown in the example in , that is, the photosensor needs to be placed next to each transistor, such as Figure 1 and Figure 2 As shown. The FWHM of the laser beam is 200-220nm, which is N gate_pitch The upper limit of the best case value. Therefore, the FWHM is 220nm. Therefore, W laser =220nm*1.7, 220nm*1.7 is 374nm. CGP at 28nm is 140nm (polysilicon gate pitch). So, 374nm / 140nm produces 2.67. So, N gate_pitch <2.67, so we take 2. This ensures full area coverage with possibly some overlap.

[0036] In summary, we need to have a photosensor every two gate spacings, which means we need to place a sensor right next to each transistor gate, e.g. Figure 2 This is shown in Figure 4 It is schematically shown in Figure 4The incident laser spot, the contacted gate pitch (CGP) 402, and the maximum distance of the photodetector on the metal-oxide-semiconductor (MOS) 400 are shown, and the maximum distance of the photodetector is 2×CGP. For more advanced technologies, the right side of (1) will increase because the CGP decreases with smaller transistor sizes. Therefore, the density of sensor placement is loose and sparse (i.e., Ngate pitch>2). This reduces the area overhead percentage. For a given laser spot size, the ratio of photodetectors to transistors becomes lower because the maximum distance of the photodetectors is fixed by the laser spot size, while in finer technologies, the gate pitch decreases. In turn, this means that more transistors can be placed between adjacent photosensors in finer technologies. These considerations apply to each P-channel Metal Oxide Semiconductor (PMOS) and N-type Metal-Oxide-Semiconductor (NMOS) pair that share the same gate, so that a pair of photodetectors is inserted in the same gate spacing groove adjacent to the pair of photodetectors, such as Figure 2 shown.

[0037] The placement of the photodetectors may vary between clusters, or may be consistent across a cluster—that is, the placement of the photodetectors may be the same for all cells in the LVP sensing sensor structure, e.g. Figure 1 and Figure 2 As shown. Digital circuits are conventionally designed with "cell libraries", which are simply collections of basic cells (generally, these basic cells are basically logic gates). An "LVP-aware cell library" means that a photosensor is embedded into each standard cell, making the entire library "LVP-aware". In other words, the sensor structure is built by placing standard cells, which in turn embed the photosensor within the standard cell itself (in other words, the sensor is part of the standard cell and can also be an additional / separate standard cell). The type of photodetector can depend on the type of transistor. For example, the photodetector can form a reverse biased pn junction. In this regard, the photodetector is a p+ / n well diffusion region for a PMOS transistor and an n+ / p body diffusion region for an NMOS transistor.

[0038] The placement of photodetectors in the scheme described above preserves sensor density and maximizes the distance of each transistor to the closest sensor when the cells are flipped vertically during physical design. Horizontal cell flipping is instead disabled during the placement phase to maintain regularity in sensor spacing on adjacent cells. Filler cells are also equipped with photodetectors to achieve sensor structure continuity. Since the photosensors are composed of the same manufacturing layers as the transistors, the sensor structure is manufactured simultaneously with the detectors and the logic circuits that aggregate the photosensor outputs.

[0039] exist Figure 2 The resulting standard cell architecture enables the design to remain fully automated and naturally incorporates restricted design rules to achieve a correct-by-construction layout. In connection with full automation, the standard cell architecture needs to be modified to incorporate optoelectronic sensors. However, standard cells are typically building blocks provided to designers by the foundry or third-party suppliers and therefore do not impose any design burden on the designer (the designer simply uses an existing standard cell library that has been intentionally enriched with optoelectronic sensors). Figure 2 The area overhead at the cell level at sensor densities in 100 to 240% ranges from 100% to 240%. The overhead varies across cells due to the different counts in the shared diffusion regions to be split. The area overhead depends on the specific cell into which the photosensor is incorporated, which is determined by the number of shared diffusion regions that need to be interrupted to insert the photosensor - i.e., if the diffusion regions need to be interrupted, the area overhead becomes higher. For example, in the smallest size inverter gate, the area is only doubled by placing the sensor next to its gate, while for larger cells, such as a D-type flip-flop, the shared diffusion region needs to be split to accommodate the sensor.

[0040] The sensor can be of any appropriate type. With respect to LVP attacks, detection with full area coverage requires sensors with better sensitivity than bulk built-in current sensors (BBICS), which are as low as the level of lasers with wavelengths above the bandgap and the minimum available power to launch attacks. Moreover, the design scheme described in this article can enable the detection of LVP attacks at laser power levels at which the number of acquisitions required for sufficient SNR is impractically high - which makes LVP detection (i.e., attack) infeasible. The photodetectors (i.e., sensors) should also be able to be integrated in situ so that the photodetectors are densely distributed within the laser spot distance of each single transistor in the sensor structure area. Moreover, the distribution of the photodetectors should be within the protected logic - i.e., on the chip - and therefore, ideally, the distribution of the photodetectors should be compatible with a design flow based on standard cells. For example, one or more dummy transistors can be inserted for each photodetector to maintain the geometry of the group including the photodetectors.

[0041] For the pn junction photodetectors described in this paper, Table I lists the cell area and current leakage overhead due to the positioning of the photodetector.

[0042] Table I

[0043]

[0044] Once the spacing is determined and all light-sensitive standard cells are equipped with photodetectors, as in Figure 2 As described in , the sensor structure is automatically constructed by synthesizing, placing and routing the above light-sensitive standard cells 200 rich in photosensors / photodetectors into a single circuit. The photosensor 202 outputs are hierarchically aggregated via adjacency based on spatial proximity to keep additional wiring to a minimum despite the high density of photosensor 202 outputs. In particular, cell adjacency automatically creates a common Vsense level in metal 2 that extends over neighboring cells because the common Vsense level is embedded in each cell and covers the full width of each cell, as shown in FIG. Figure 2 shown.

[0045] Connections made by uninterrupted adjacency, i.e. corresponding V sense Line, in Figure 1 Each cluster 102 in the same row is created in N cluster Each cluster includes a detector standard cell 104 that interrupts the Vsense wire (which can thus be described as two separate input lines V sense1 and Vsense2 ) to achieve the desired cluster size. Then, the detector standard unit 104 performs sense The detector unit compares the two inputs to convert Vsense into a digital attack occurrence flag. cluster Regular intervals of photodetectors are pre-placed at regular positions.

[0046] The automated digital design flow is almost unaffected by the above approach, as the only difference is the pre-placement of the detector cells and the restriction of cell flipping in the horizontal dimension during fabrication. TH The comparator is biased with the 2.7-nA drain current of the cut-off low-VTH transistor, eliminating any explicit bias voltage. The comparator can also be designed in other ways and incorporated into a standard cell. This current is sufficient to capture the multi-millisecond laser pulses often used in LVP attacks.

[0047] Inter-cluster aggregation of the digital outputs from the detector standard cells is performed via a simple logic tree. Figure 1 120) combines the pulse occurrences at any one point in time, and the counter 122 captures the pulse occurrences over time. Once the counter value exceeds a predetermined threshold, the alarm circuit 124 triggers an alarm. The counter can be reset after a specific time period so that an alarm is only flagged if there are a large number of (i.e., above the threshold) pulse occurrences within a predetermined or application-dependent time period. The logic tree 120 is automatically placed and routed based on the script-generated netlist.

[0048] In the experiment, a test chip was designed and manufactured in a 28nm complementary metal oxide semiconductor (CMOS) using a flip chip package. The test chip contains a test structure and a readout circuit (i.e., an analog buffer and a multiplexer) for the test structure to access each of the 128 instances individually, and the test structure includes a detector standard cell and a cluster array, where Ncluster=17, 34, 68, 102. Five 128-bit Advanced Encryption Standard (AES) cryptographic cores were designed, including an unprotected baseline design and four versions of protected AES cores, where Ncluster=17, 34, 68, and 102. All AES cores were designed using a conventional digital design flow via an additional detector cell pre-placement script.

[0049] After fabrication, the die is thinned to 100-μm thickness on the back side of the die by back grinding for optical coupling with the solid immersion lens (SIL) used in the LVP test equipment. The back surface roughness is kept at ±3 μm to minimize any gap between the die and the SIL and thus achieve a circular, distortion-free laser spot with a predefined FWHM (i.e., the spatial resolution when transmitting the beam to the die). Since the chip area of ​​the test chip under attack is blocked by the SIL, the impact of ambient light on the attack is expected to be insignificant.

[0050] Given their transistor-level spatial precision requirements, LVP devices are more complex than the simpler LFI attacks in most prior literature and require:

[0051] -The presence of SIL to preserve the laser beam focus throughout the entire optical path, rather than requiring only the objective lens;

[0052] - a continuous wave laser with long pulses (e.g., milliseconds) to detect reasonably long waveforms for later time alignment and signal recovery, rather than requiring a simple pulsed laser;

[0053] -Laboratory load-bearing structure to support vibration isolation table with weight in the range of 500kg (416kg / m);

[0054] - Lateral mechanical support of the silicon die on the board to withstand approximately 20-N forces for stable SIL attachment.

[0055] The test chip was extensively characterized by approximately 150 hours of LVP testing. The on-chip sensors were first measured at different sensor cluster sizes Ncluster, laser wavelengths above and below the bandgap (1319 nm and 1064 nm), and supply voltages. For each value of Ncluster, a sensor array with 128 instances was characterized to demonstrate the robustness of the sensing scheme down to a single sensor. Figure 5 a to Figure 5 The measurements in h show the effect of mismatch on V at 128 clusters under the same exposure conditions during AES execution. sense For the lowest Ncluster=17, Figure 5 a reveals that, at the lowest allowed laser power of 7 mW, the nominal supply voltage of 1.05 V, and a wavelength above the bandgap, Vsense can reliably identify the occurrence of an attack with a worst-case decision margin of 4.5 standard deviations (i.e., with a false positive / false negative probability of 3.4E-6). At doubled 14-mW laser power and wavelength below the bandgap, the decision margin increases as expected, as Figure 5 As shown in b. Figure 5 c and Figure 5 d, it is very similar at 0.9-V supply voltage, and although the voltage fluctuation (−15%) exceeds the actual voltage variation in the actual design, the decision margin is still robust and exceeds 5 standard deviations.

[0056] Higher Ncluster improves area overhead, sensitivity, and decision margin (attack / no attack) simultaneously. In fact, higher Ncluster leads to a sparser placement of detectors (detector standard cells) since each of the detectors serves 2Ncluster sensors. Regarding sensitivity, Figure 5 e to Figure 5 h Experimentally, it is shown that across supply voltage, laser power and wavelength, the average difference in Vsense under attack / no attack at Ncluster=102 increases by about 40mV compared to Ncluster=17. Regarding the decision margin, higher Ncluster also mitigates the effect of mismatch due to the average effect of mismatch over a large number of parallel connected sensors. This is confirmed by: Figure 5 a to Figure 5 h, the variability of Vsense under no attack is reduced by about 15%; and the decision margin is improved by about 1.5 times at Ncluster = 102 compared to Ncluster = 17. Overall, this suggests that reasonably high Ncluster values ​​should be adopted to achieve better area efficiency, mitigate mismatch, and thus improve decision margin.

[0057] Regardless of wavelength, the above ample decision margin is expected to enable correct detection at voltage scaling well below 0.9 V and down to 0.5 V. The missed detection at 0.4 V is due to the reduced detector noise margin at such low voltages. Overall, these considerations make it preferable to adopt a higher Ncluster=102 from various perspectives.

[0058] The effect of temporal noise on Vdetect was also investigated experimentally by performing measurements over 50,000 repetitions. The AES execution was maintained to correctly include the circuit activity and the associated possible noise contribution. The overall decision margin ranges from 11.5 standard deviations to 12.8 standard deviations, making false positives and false negatives negligible. This is achieved thanks to the robust margin in Vsense and the additional effect of CMOS logic-like nonlinearities in the detector circuit input-output characteristics, which further constrains Vdetect towards very low values ​​close to ground or high values ​​close to the supply voltage. Overall, this means that the decision margin is essentially limited by the mismatch, rather than by the noise.

[0059] Compared to the prior art, the present scheme uniquely enables consistent laser detection at the bandgap wavelength and full area coverage at state-of-the-art deep sub-micron laser spots. The scheme is incorporated in a fully automated digital design approach to enable design-independent and easy adoption. The area overhead to achieve such a high level of security is high (up to 150%) if applied indiscriminately to the entire chip, and is greatly reduced in practical cases where the information-sensitive subsystem is part of the entire system (e.g., <20% for a secure AES coupled to an ARM Cortex-M4 processor). The power and performance overheads are negligible. As another unique capability, the proposed scheme does not impose any significant limitations on voltage scaling as shown in the 0.5-1.05V range.

[0060] It will be apparent that many further modifications and permutations of various aspects of the described embodiments are possible. Accordingly, the described aspects are intended to embrace all such alterations, modifications and variations that fall within the spirit and scope of the appended claims.

[0061] In this specification and the claims that follow, unless the context requires otherwise, the word "comprise" and variations such as "comprises" and "comprising", will be understood to imply the inclusion of stated integers or steps or groups of integers or steps but not the exclusion of any other integers or steps or groups of integers or steps.

[0062] Reference in this specification to any prior publication (or information derived from any prior publication), or reference to any known matter, is not and should not be taken as an acknowledgement or acknowledgment or any form of suggestion that the prior publication (or information derived from any prior publication) or known matter forms part of the common general knowledge in the field to which this specification is intended to relate.

Claims

1. A sensor structure for detecting an attack on a transistor, comprising: Multiple sensor clusters, each sensor cluster includes: a plurality of photodetectors and a plurality of transistors, each photodetector being disposed adjacent to a corresponding transistor; A standard cell, comprising a threshold comparator, wherein the threshold comparator is used to: comparing a first input from a first photodetector group of a corresponding cluster and a second input from a second photodetector group of the corresponding cluster, the first input and the second input being proportional to incident light sensed by the corresponding photodetector; and In the event that a difference between the first input and the second input exceeds a predetermined threshold, flipping an output of the standard cell; and An aggregator for aggregating outputs from the clusters to generate an aggregated output, and triggering an alarm if an attack is detected based on the aggregated output.

2. The sensor structure according to claim 1, wherein: For each cluster, the first group of photodetectors and the second group of photodetectors each include half of the photodetectors in the cluster.

3. The sensor structure according to claim 2, wherein: Each photodetector is in exactly one of the first group and the second group.

4. The sensor structure according to any one of claims 1 to 3, wherein: The threshold comparator is biased with a current equal to or supplied from a cut-off low voltage threshold transistor.

5. The sensor structure according to any one of claims 1 to 4, wherein: Each photodetector includes a reverse biased pn junction.

6. The sensor structure according to any one of claims 1 to 5, wherein: The aggregator aggregates the output using a logic tree.

7. The sensor structure according to any one of claims 1 to 6, wherein: The aggregator: recording a count of each instance where the aggregated output indicates an attack; and In case the count exceeds a predetermined threshold, an alarm is triggered.

8. The sensor structure according to any one of claims 1 to 7, wherein: The aggregator aggregates the outputs based on the spatial proximity of the clusters.

9. A sensor structure according to any one of the preceding claims, wherein: A spacing between closest photodetectors among the plurality of photodetectors is defined based on a predetermined laser spot size.

10. The sensor structure according to claim 9, wherein: The spacing includes: starting from the center of the transistor footprint, every N gatepitch The gate spacing places the photodetector so that: N gatepitch ≤w laser / CGP=1.7·FWHM / CGP Among them, w laser is the laser spot width, CGP is the contact gate pitch, and FWHM is the full width at half maximum power.

11. The sensor structure according to any one of the preceding claims, further comprising: One or more dummy transistors are inserted for each photodetector to maintain the geometry of the individual photodetector groups.

Images