Chip bottom attack detection circuit and method of DIO-PUF based on photosensitive characteristic

Abstract

The invention relates to a photosensitive characteristic-based DIO-PUF chip bottom attack detection circuit and a photosensitive characteristic-based DIO-PUF chip bottom attack detection method, the photosensitive characteristic-based DIO-PUF chip bottom attack detection circuit comprises an input port C, a control logic CTL, a photodiode circuit, a latch sensitive amplifier LSSA, a register REG and an output port KEY.According to the photosensitive characteristic-based DIO-PUF chip bottom attack detection circuit and the photosensitive characteristic-based DIO-PUF chip bottom attack detection method, whether a chip package is removed or not is detected; whether the working environment of the chip is safe or not is judged in real time, so that an effective protection means is provided, a unique digital secret key can be integrated at the bottom of the chip through the photosensitive characteristic DIO-PUF technology, the authenticity of the chip can be effectively verified when the chip faces physical intervention, the invasion difficulty of an attacker can be greatly increased through the unique identity label, and the safety of the chip is improved. And the method can also be used for detecting whether the working environment of the chip is threatened or not, so that the chip is ensured to run in a safe environment, and the potential safety problem caused by environment change is avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of hardware security and anti-counterfeiting, and in particular to a chip bottom attack detection circuit and method based on a DIO-PUF with photosensitive characteristics. Background Art

[0002] With the rapid development of technology, many areas in modern society, such as the Internet of Things, cloud computing, mobile devices, and critical infrastructure, are increasingly dependent on the functions of chips. These chips are not only the core components of various advanced technologies, but also the focus of attackers due to their critical roles. Therefore, the protection of chip security is particularly important. In order to cope with the increasing security threats, physical unclonable function technology came into being. This technology generates a unique "digital fingerprint" for each chip by utilizing the random physical variations naturally generated in the semiconductor manufacturing process, thereby significantly enhancing the security of the chip and effectively preventing tampering attacks on physical devices.

[0003] At present, the attack threats faced by chips are becoming increasingly diverse. Attack methods against chips include invasive attacks, semi-invasive attacks, and non-invasive attacks. Intrusive attacks are attacks in which attackers directly physically contact the chip, for example, using a microscope or scanning probe to analyze the internal circuit of the chip to obtain sensitive information or crack encryption keys. Attackers can use a microscope to view the circuit layout of the chip and reverse engineer the functions and data of the chip. Semi-invasive attacks are an attack method that physically contacts the chip but does not completely disassemble it. This type of attack usually obtains sensitive information or analyzes the chip through specific technical means without destroying the chip shell. For example, attackers use lasers to accurately strike the chip, use laser scanning or laser to cause circuit failures to change its working state or directly read internal data. In addition, attackers can also use radio frequency signals to interfere with the normal operation of the chip, obtain internal operating information of the chip or cause errors, and further observe and analyze the response signals. Non-invasive attacks are attacks in which attackers do not directly contact the chip, such as measuring the electromagnetic leakage or power consumption mode of the chip to infer the internal activities of the chip. This type of attack can use the electromagnetic waves or power consumption changes generated by the chip when processing data to infer keys or other secret information.

[0004] In response to these attack methods, the industry has adopted some protection technologies, including chip top metal active shielding layer technology, protective packaging technology and anti-side channel attack technology. Among them, the chip top metal active shielding layer technology uses the top metal to form a complex wiring network to shield key components such as the chip encryption module, and then cooperates with the integrity perception unit to achieve effective perception and protection against invasive physical attacks. The protective packaging technology uses tamper-proof packaging, applies a special coating on the chip surface or wraps the chip with electromagnetic shielding materials to prevent the chip information from being obtained through lasers or electromagnetic waves. Anti-side channel attack technologies include power analysis protection and electromagnetic interference technology. These technologies are designed to cover up the power consumption and electromagnetic signals generated by the chip when processing data to prevent attackers from extracting sensitive information through these signals.

[0005] However, among many chip protection technologies, the necessity of chip bottom protection is often overlooked. The bottom of the chip usually does not have the same protection measures as the top layer, and attackers can make physical contact at the bottom without being easily discovered. By removing or destroying the bottom package of the chip, attackers can directly access sensitive circuits and storage components inside the chip, which may lead to the leakage of key information such as encryption keys and user data. Although current chip protection technologies have played an important role in preventing most attacks, they are mainly concentrated on the upper layer and data processing part of the chip, and the protection measures for the bottom of the chip are relatively weak, which makes the bottom of the chip a potential security vulnerability, easy to be exploited by attackers, and has poor security performance. Therefore, a chip bottom attack detection circuit and method based on photosensitive characteristics of DIO-PUF are proposed to solve the above problems. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention provides a chip bottom attack detection circuit and method based on the photosensitive characteristics of DIO-PUF, which has the advantages of good security performance and solves the problem that the protection measures for the bottom of the chip are relatively weak, which makes the bottom of the chip a potential security vulnerability that is easy to be exploited by attackers and has poor security performance.

[0007] To achieve the above object, the present invention provides the following technical solutions: a chip bottom attack detection circuit based on DIO-PUF with photosensitivity, comprising an input port C, a control logic CTL, a photosensitive diode circuit, a latch-type sensitive amplifier LSSA, a register REG and an output port KEY; The input port C is used to input signals, the control logic CTL is used to generate a clock signal CLK_REG and an enable signal EN, the photodiode circuit is used to generate a voltage at point A and a voltage at point B, the sensitive amplifier LSSA is used to amplify the difference between the voltage at point A and the voltage at point B, the register REG is used to transmit or store signals, and the output port KEY is used to output signals.

[0008] Further, the positive electrode of the photosensitive diode circuit and the positive electrode of the sensitive amplifier LSSA are both electrically connected to the power supply, the negative electrode of the photosensitive diode circuit and the negative electrode of the sensitive amplifier LSSA are both grounded GND, the output end of the photosensitive diode circuit is electrically connected to the input end of the sensitive amplifier LSSA, the output end of the sensitive amplifier LSSA is electrically connected to the input end of the register REG, the input port C is electrically connected to the input end of the control logic CTL, the control end of the sensitive amplifier LSSA and the control end of the register REG are both electrically connected to the output end of the control logic CTL, and the output end of the register REG is electrically connected to the output port KEY.

[0009] Furthermore, the chip bottom attack detection circuit based on the photosensitive characteristic of DIO-PUF specifically includes the following two operating states: Normal state: When the bottom of the chip is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on. The signal enters from the input port C. The photodiode circuit inputs the voltage at the A end and the voltage at the B end to the sensitive amplifier LSSA through the dark current. The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY. Abnormal state: When the bottom of the chip is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on, and the signal enters from the input port C. The external light irradiates the bottom of the chip and acts on the photosensitive diode circuit. The photosensitive diode circuit generates and separates photogenerated electron-hole pairs. The photogenerated holes migrate along the potential gradient to the output end of the photosensitive diode circuit, causing the potential to gradually increase, causing the potential relationship between the A-end voltage and the B-end voltage to change, thereby causing the generated key to change. The A-end voltage and the B-end voltage are input to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between the A-end voltage and the B-end voltage, and outputs a unique digital signal as the digital key of each chip's unique information. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY.

[0010] Furthermore, the photodiode circuit includes a TG gate, the TG gate includes a P tube and an N tube, the P tube and the N tube are connected in parallel, the gate of the P tube is electrically connected to a power supply VDD, and the gate of the N tube is grounded GND.

[0011] Furthermore, the P-tube source and the P-tube substrate form a diode D1, the N-tube substrate and the N-tube drain form a diode D2, the P-tube drain and the P-tube substrate form a diode D3, and the N-tube substrate and the N-tube source form a diode D4.

[0012] Further, the cathode of the diode D1 and the cathode of the diode D3 are both electrically connected to the power supply VDD, the anode of the diode D2 and the anode of the diode D4 are both grounded GND, the anode of the diode D1 and the cathode of the diode D2 are both electrically connected to the first input terminal of the sense amplifier LSSA, and the anode of the diode D3 and the cathode of the diode D4 are both electrically connected to the second input terminal of the sense amplifier LSSA.

[0013] Furthermore, the chip bottom attack detection circuit based on the photosensitive characteristic of DIO-PUF specifically includes the following two operating states: Normal state: When the bottom of the chip is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on. The signal enters from the input port C. The diodes D1, D2, D3 and D4 all pass dark current to input the voltage at the A end and the voltage at the B end to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY. Abnormal state: When the bottom of the chip is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on, and the signal enters from the input port C. The external light irradiates the bottom of the chip and acts on the diodes D1, D2, D3 and D4. The diodes D1, D2, D3 and D4 generate and separate photogenerated electron-hole pairs. The photogenerated holes migrate along the potential gradient to the anode of the diode D1 and the anode of the diode D3, causing the potential to gradually increase, so that the potential relationship between the voltage at the A end and the voltage at the B end changes, thereby causing the generated key to change. The voltage at the A end and the voltage at the B end are input to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY.

[0014] Another technical problem solved by the present application is to provide a chip bottom attack detection method based on the photosensitive characteristics of DIO-PUF, including the following specific steps: S1: The enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on; S2: The signal enters from the input port C, and the voltage at the A terminal and the voltage at the B terminal are input to the sense amplifier LSSA; S3: The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A terminal and the voltage at the B terminal, and outputs a unique digital signal as a digital key for the unique information of each chip; S4: The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY; S5: Calculate the digital key when there is light and when there is no light, and determine whether the digital key at this time is the same as the digital key when there is no light. If yes, proceed to S6; if not, proceed to S7; S5.1.1: When there is no light, the diode - The equation is: ; In the formula, is the charge constant, is the diode PN junction area, is the electron diffusion coefficient, is the diffusion coefficient of holes, is the equilibrium concentration of electrons in a P-type semiconductor, is the equilibrium concentration of holes in an n-type semiconductor, is the diffusion length of hole electrons, is the diffusion length of holes and electrons, is the diode PN junction voltage, is the Boltzmann constant, is the absolute temperature; S5.1.2: Simplify equations, use constants replace , when there is no light, the simplified diode - The equation is: ; S5.1.3: When there is no light, dark current flows through diodes D1, D2, D3, and D4. Suppose the potentials at A and B are , , the power supply voltage is , then according to the simplified diode - Equation and KCL law, we can get the following constraints: ; ; Combining the above two equations, we can get: ; In the formula, is the constant of diode D1 , is the constant of diode D2 , is the constant of diode D3 , is the diode D4 constant At this time, the potential difference between points A and B is closely related to the differences in the diode PN junction during the manufacturing process. The differences in the manufacturing process are: , , , , , and , based on multiple groups of the same structure to generate keys, a multi-digit digital key can be obtained; S5.2.1: When there is light, electrons absorb photon energy and transition to the conduction band. The photosensitive diode circuit generates and separates photogenerated electron-hole pairs. The electron-hole pairs generated by light excitation generate photocurrent for the diode PN junction current. At this time, the current passing through the diode is the sum of the dark current and the photocurrent. Then the diode - The equation is: ; In the formula, is the photogenerated carrier generation rate, w is the depletion region width of the diode PN junction; S5.2.2: Simplify equations, use constants replace , when there is no light, the simplified diode - The equation is: ; S5.2.3: When there is light, the external light irradiates the bottom of the chip and acts on diodes D1, D2, D3 and D4. Diodes D1, D2, D3 and D4 generate and separate photogenerated electron-hole pairs. According to the simplified diode - Equation and KCL law, we can get the following constraints: ; ; Combining the above two equations, we can get: ; In the formula, is the constant of diode D1 , is the constant of diode D2 , is the constant of diode D3 , is the constant of diode D4 At this time, the potential difference between points A and B is not only related to the differences in the diode PN junction during the manufacturing process, but also the differences in the manufacturing process are: , , , , , and , and it is also related to the light intensity. When light shines on the diodes D1, D2, D3 and D4 at the bottom of the chip, the key will change with the change of light intensity; S6: The bottom of the chip was not attacked; S7: The bottom of the chip is attacked.

[0015] Compared with the prior art, the technical solution of this application has the following beneficial effects: The chip bottom attack detection circuit and method based on the photosensitive DIO-PUF detects whether the chip package is removed and determines in real time whether the chip working environment is safe, thereby providing an effective protection method. Through the photosensitive DIO-PUF technology, a unique digital key can be integrated at the bottom of the chip, so that the chip can effectively verify its authenticity when facing physical intervention. This unique identity identification can greatly increase the difficulty of intrusion by attackers and improve the overall security of the chip. It can also be used to detect whether the chip working environment is threatened, ensure that the chip runs in a safe environment, and avoid potential security problems caused by environmental changes. Through these measures, the present invention not only improves the protection capability of the chip bottom, but also fills the gap in the existing protection technology, and provides more comprehensive protection for the overall security of the chip, which will help to further enhance the security of the chip in the face of complex attack environments and ensure the integrity of key data and information. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a schematic diagram of the detection circuit structure of the present invention; Figure 2 Schematic diagram of the TG gate structure of the present invention; Figure 3 It is a schematic diagram of the cross-sectional structure of the TG door of the present invention; Figure 4 It is the equivalent diagram of the TG gate of the present invention; Figure 5This is the PUF unit layout of the present invention; Figure 6 The digital key without illumination and the digital key with illumination under the diode illumination condition of 25°C of the present invention; Figure 7 It is a schematic diagram of the variation of photocurrent with light power in the PN junction of the diode of the present invention.

[0017] In the figure: C is the input port, CTL is the control logic, LSSA is the latch-type sensitive amplifier, REG is the register, KEY is the output port, D1 is the diode D1, D2 is the diode D2, D3 is the diode D3, D4 is the diode D4, P is the P tube, P-sub is the P type substrate, N is the N tube, N-well is the N type substrate, VDD is the power supply, and GND is the ground. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] See also Figure 1-7 , a chip bottom attack detection circuit based on DIO-PUF of photosensitive characteristics in this embodiment includes an input port C, a control logic CTL, a photodiode circuit, a latch-type sensitive amplifier LSSA, a register REG and an output port KEY; The input port C is used for inputting signals, the control logic CTL is used for generating the clock signal CLK_REG and the enable signal EN, the photodiode circuit is used for generating the voltage at point A and the voltage at point B, the sensitive amplifier LSSA is used for amplifying the difference between the voltage at point A and the voltage at point B, the register REG is used for transmitting or storing signals, and the output port KEY is used for outputting signals.

[0020] The positive electrode of the photosensitive diode circuit and the positive electrode of the sensitive amplifier LSSA are both electrically connected to the power supply, the negative electrode of the photosensitive diode circuit and the negative electrode of the sensitive amplifier LSSA are both grounded GND, the output end of the photosensitive diode circuit is electrically connected to the input end of the sensitive amplifier LSSA, the output end of the sensitive amplifier LSSA is electrically connected to the input end of the register REG, the input port C is electrically connected to the input end of the control logic CTL, the control end of the sensitive amplifier LSSA and the control end of the register REG are both electrically connected to the output end of the control logic CTL, and the output end of the register REG is electrically connected to the output port KEY.

[0021] The chip bottom attack detection circuit of DIO-PUF based on photosensitive characteristics specifically includes the following two operating states: Normal state: When the bottom of the chip is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on. The signal enters from the input port C. The photodiode circuit inputs the voltage at the A end and the voltage at the B end to the sensitive amplifier LSSA through the dark current. The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY. Abnormal state: When the bottom of the chip is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on, and the signal enters from the input port C. The external light irradiates the bottom of the chip and acts on the photosensitive diode circuit. The photosensitive diode circuit generates and separates photogenerated electron-hole pairs. The photogenerated holes migrate along the potential gradient to the output end of the photosensitive diode circuit, causing the potential to gradually increase, causing the potential relationship between the A-end voltage and the B-end voltage to change, thereby causing the generated key to change. The A-end voltage and the B-end voltage are input to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between the A-end voltage and the B-end voltage, and outputs a unique digital signal as the digital key of each chip's unique information. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY.

[0022] The photosensitive diode circuit includes a TG gate, which includes a P tube and an N tube. The P tube and the N tube are connected in parallel. The gate of the P tube is electrically connected to the power supply VDD, the gate of the N tube is grounded GND, the source of the P tube and the substrate of the P tube form a diode D1, the substrate of the N tube and the drain of the N tube form a diode D2, the drain of the P tube and the substrate of the P tube form a diode D3, and the substrate of the N tube and the source of the N tube form a diode D4.

[0023] The cathode of the diode D1 and the cathode of the diode D3 are both electrically connected to the power supply VDD, the anode of the diode D2 and the anode of the diode D4 are both grounded GND, the anode of the diode D1 and the cathode of the diode D2 are both electrically connected to the first input terminal of the sense amplifier LSSA, and the anode of the diode D3 and the cathode of the diode D4 are both electrically connected to the second input terminal of the sense amplifier LSSA.

[0024] The chip bottom attack detection circuit of DIO-PUF based on photosensitive characteristics specifically includes the following two operating states: Normal state: When the bottom of the chip is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on. The signal enters from the input port C. The diodes D1, D2, D3 and D4 all pass dark current to input the voltage at the A end and the voltage at the B end to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY. Abnormal state: When the bottom of the chip is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on, and the signal enters from the input port C. The external light irradiates the bottom of the chip and acts on the diodes D1, D2, D3 and D4. The diodes D1, D2, D3 and D4 generate and separate photogenerated electron-hole pairs. The photogenerated holes migrate along the potential gradient to the anode of the diode D1 and the anode of the diode D3, causing the potential to gradually increase, so that the potential relationship between the voltage at the A end and the voltage at the B end changes, thereby causing the generated key to change. The voltage at the A end and the voltage at the B end are input to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY.

[0025] Another technical problem solved by the present application is to provide a chip bottom attack detection method based on the photosensitive characteristics of DIO-PUF, including the following specific steps: S1: The enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on; S2: The signal enters from the input port C, and the voltage at the A terminal and the voltage at the B terminal are input to the sense amplifier LSSA; S3: The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A terminal and the voltage at the B terminal, and outputs a unique digital signal as a digital key for the unique information of each chip; S4: The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY; S5: Calculate the digital key when there is light and when there is no light, and determine whether the digital key at this time is the same as the digital key when there is no light. If yes, proceed to S6; if not, proceed to S7; S5.1.1: When there is no light, the diode - The equation is: ; In the formula, is the charge constant, is the diode PN junction area, is the electron diffusion coefficient, is the diffusion coefficient of holes, is the equilibrium concentration of electrons in a P-type semiconductor, is the equilibrium concentration of holes in an n-type semiconductor, is the diffusion length of hole electrons, is the diffusion length of holes and electrons, is the diode PN junction voltage, is the Boltzmann constant, is the absolute temperature; S5.1.2: Simplify equations, use constants replace , when there is no light, the simplified diode - The equation is: ; S5.1.3: When there is no light, dark current flows through diodes D1, D2, D3, and D4. Suppose the potentials at A and B are , , the power supply voltage is , then according to the simplified diode - Equation and KCL law, we can get the following constraints: ; ; Combining the above two equations, we can get: ; In the formula, is the constant of diode D1 , is the constant of diode D2 , is the constant of diode D3 , is the diode D4 constant At this time, the potential difference between points A and B is closely related to the differences in the diode PN junction during the manufacturing process. The differences in the manufacturing process are: , , , , , and , based on multiple groups of the same structure to generate keys, a multi-digit digital key can be obtained; S5.2.1: When there is light, electrons absorb photon energy and transition to the conduction band. The photosensitive diode circuit generates and separates photogenerated electron-hole pairs. The electron-hole pairs generated by light excitation generate photocurrent for the diode PN junction current. At this time, the current passing through the diode is the sum of the dark current and the photocurrent. Then the diode - The equation is: ; In the formula, is the photogenerated carrier generation rate, w is the depletion region width of the diode PN junction; S5.2.2: Simplify equations, use constants replace , when there is no light, the simplified diode - The equation is: ; S5.2.3: When there is light, the external light irradiates the bottom of the chip and acts on diodes D1, D2, D3 and D4. Diodes D1, D2, D3 and D4 generate and separate photogenerated electron-hole pairs. According to the simplified diode - Equation and KCL law, we can get the following constraints: ; ; Combining the above two equations, we can get: ; In the formula, is the constant of diode D1 , is the constant of diode D2 , is the constant of diode D3 , is the constant of diode D4 At this time, the potential difference between points A and B is not only related to the differences in the diode PN junction during the manufacturing process, but also the differences in the manufacturing process are: , , , , , and , and it is also related to the light intensity. When light shines on the diodes D1, D2, D3 and D4 at the bottom of the chip, the key will change with the change of light intensity; S6: The bottom of the chip was not attacked; S7: The bottom of the chip is attacked.

[0026] In order to effectively protect a chip substrate with an area of ​​1mm×1mm, DIO-PUF-based technology is used. First, in order to enhance the ability to resist brute force attacks, the key length needs to be at least 256 bits, which means that 256 DIO-PUF units are needed to generate a random key of sufficient strength. Secondly, in order to enhance the detection ability of the PUF unit against external attacks, it should be ensured that the PUF units are evenly distributed on the substrate surface. This uniform arrangement helps to ensure that light can evenly illuminate each unit, thereby improving the overall detection accuracy and stability. Finally, taking into account security and cost-effectiveness, the width of the MOS tube is set to 20um and the length is 3um. At this time, the corresponding diode PN junction interface area is 4μm², which not only ensures the performance of the circuit, but also effectively controls the manufacturing cost. The PUF unit layout is as follows: Figure 5 shown.

[0027] Based on the above parameter settings, the present invention models the proposed protection scheme based on the Spectre model and conducts Monte Carlo simulation verification. The simulation results show that under the condition of no illumination, the probability of '1' in the key is 44.92%. The generation results of the digital key with and without illumination at 25°C are as follows: Figure 6 As shown in the figure, by modifying the junction saturation current density and side junction saturation current density parameters in the device model, the influence of changes in illumination conditions in the circuit on the generation of PUF unit keys is simulated. The simulation results show that when the above parameters increase by 20%, the key changes, and the probability of '1' in the key is 46.88% at this time. The change rate of the key before and after illumination is 58.20%, indicating that the PUF structure has good biasing properties and meets the requirements of PUF random keys. When the illumination conditions change, the key can change significantly to sensitively indicate whether the chip is attacked.

[0028] In addition, the photosensitivity of the diode PN junction was further simulated and verified by using Comsol software. The simulation results show how the photocurrent changes with the optical power. Figure 7 As shown, when the light power increases from 0 to 50μW, the photocurrent in the diode PN junction changes by about 0.4uA, thereby verifying the sensitivity of the diode PN junction under different light intensities and further proving the effectiveness and reliability.

[0029] The working principle of the above embodiment is: By detecting whether the chip package has been removed, it is possible to determine in real time whether the chip's working environment is safe, thereby providing an effective means of protection. Through the photosensitive DIO-PUF technology, a unique digital key can be integrated at the bottom of the chip, so that the chip can effectively verify its authenticity when facing physical intervention. This unique identity identification can greatly increase the difficulty of intrusion by attackers and improve the overall security of the chip. It can also be used to detect whether the chip's working environment is threatened, ensure that the chip runs in a safe environment, and avoid potential security issues caused by environmental changes. Through these measures, the present invention not only improves the protection capability of the chip bottom, but also fills the gap in existing protection technology, and provides more comprehensive protection for the overall security of the chip, which will help to further enhance the security of the chip in the face of complex attack environments and ensure the integrity of key data and information.

[0030] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0031] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A chip bottom attack detection circuit based on DIO-PUF with photosensitive characteristics, characterized in that: It includes an input port C, a control logic CTL, a photodiode circuit, a latch-type sensitive amplifier LSSA, a register REG and an output port KEY; The input port C is used to input signals, the control logic CTL is used to generate a clock signal CLK_REG and an enable signal EN, the photodiode circuit is used to generate a voltage at point A and a voltage at point B, the sensitive amplifier LSSA is used to amplify the difference between the voltage at point A and the voltage at point B, the register REG is used to transmit or store signals, and the output port KEY is used to output signals.

2. A chip bottom attack detection circuit based on photosensitive characteristics of DIO-PUF as claimed in claim 1, characterized in that: The positive electrode of the photosensitive diode circuit and the positive electrode of the sensitive amplifier LSSA are both electrically connected to the power supply, the negative electrode of the photosensitive diode circuit and the negative electrode of the sensitive amplifier LSSA are both grounded GND, the output end of the photosensitive diode circuit is electrically connected to the input end of the sensitive amplifier LSSA, the output end of the sensitive amplifier LSSA is electrically connected to the input end of the register REG, the input port C is electrically connected to the input end of the control logic CTL, the control end of the sensitive amplifier LSSA and the control end of the register REG are both electrically connected to the output end of the control logic CTL, and the output end of the register REG is electrically connected to the output port KEY.

3. A chip bottom attack detection circuit based on DIO-PUF with photosensitive characteristics as claimed in claim 2, characterized in that: The chip bottom attack detection circuit of the DIO-PUF based on photosensitive characteristics specifically includes the following two operating states: Normal state: When the bottom of the chip is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on. The signal enters from the input port C. The photodiode circuit inputs the voltage at the A end and the voltage at the B end to the sensitive amplifier LSSA through the dark current. The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY. Abnormal state: When the bottom of the chip is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on, and the signal enters from the input port C. The external light irradiates the bottom of the chip and acts on the photosensitive diode circuit. The photosensitive diode circuit generates and separates photogenerated electron-hole pairs. The photogenerated holes migrate along the potential gradient to the output end of the photosensitive diode circuit, causing the potential to gradually increase, causing the potential relationship between the A-end voltage and the B-end voltage to change, thereby causing the generated key to change. The A-end voltage and the B-end voltage are input to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between the A-end voltage and the B-end voltage, and outputs a unique digital signal as the digital key of each chip's unique information. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY.

4. A chip bottom attack detection circuit based on photosensitive characteristics of DIO-PUF as claimed in claim 2, characterized in that: The photosensitive diode circuit includes a TG gate, and the TG gate includes a P tube and an N tube. The P tube and the N tube are connected in parallel. The gate of the P tube is electrically connected to a power supply VDD, and the gate of the N tube is grounded GND.

5. A chip bottom attack detection circuit based on DIO-PUF with photosensitive characteristics as claimed in claim 4, characterized in that: The P-tube source and the P-tube substrate form a diode D1, the N-tube substrate and the N-tube drain form a diode D2, the P-tube drain and the P-tube substrate form a diode D3, and the N-tube substrate and the N-tube source form a diode D4.

6. A chip bottom attack detection circuit based on photosensitive characteristics of DIO-PUF as claimed in claim 5, characterized in that: The cathode of the diode D1 and the cathode of the diode D3 are both electrically connected to the power supply VDD, the anode of the diode D2 and the anode of the diode D4 are both grounded GND, the anode of the diode D1 and the cathode of the diode D2 are both electrically connected to the first input terminal of the sense amplifier LSSA, and the anode of the diode D3 and the cathode of the diode D4 are both electrically connected to the second input terminal of the sense amplifier LSSA.

7. A chip bottom attack detection circuit based on photosensitive characteristics of DIO-PUF as claimed in claim 6, characterized in that: The chip bottom attack detection circuit of the DIO-PUF based on photosensitive characteristics specifically includes the following two operating states: Normal state: When the bottom of the chip is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on. The signal enters from the input port C. The diodes D1, D2, D3 and D4 all pass dark current to input the voltage at the A end and the voltage at the B end to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY. Abnormal state: When the bottom of the chip is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on, and the signal enters from the input port C. The external light irradiates the bottom of the chip and acts on the diodes D1, D2, D3 and D4. The diodes D1, D2, D3 and D4 generate and separate photogenerated electron-hole pairs. The photogenerated holes migrate along the potential gradient to the anode of the diode D1 and the anode of the diode D3, causing the potential to gradually increase, so that the potential relationship between the voltage at the A end and the voltage at the B end changes, thereby causing the generated key to change. The voltage at the A end and the voltage at the B end are input to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip. The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY.

8. A chip bottom attack detection method based on the photosensitive characteristics of DIO-PUF according to any one of claims 1 to 7, characterized in that: The specific steps include: S1: The enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on; S2: The signal enters from the input port C, and the voltage at the A terminal and the voltage at the B terminal are input to the sense amplifier LSSA; S3: The sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A terminal and the voltage at the B terminal, and outputs a unique digital signal as a digital key for the unique information of each chip; S4: The clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG and are finally output from the output port KEY; S5: Calculate the digital key when there is light and when there is no light, and determine whether the digital key at this time is the same as the digital key when there is no light. If yes, proceed to S6; if not, proceed to S7; S6: The bottom of the chip was not attacked; S7: The bottom of the chip is attacked.

9. A chip bottom attack detection method based on photosensitive characteristics of DIO-PUF as claimed in claim 8, characterized in that: The step S5 of calculating the digital key when there is no light includes the following specific steps: S5.1.1: When there is no light, the diode - The equation is: ； In the formula, is the charge constant, is the diode PN junction area, is the electron diffusion coefficient, is the diffusion coefficient of holes, is the equilibrium concentration of electrons in a P-type semiconductor, is the equilibrium concentration of holes in an n-type semiconductor, is the diffusion length of hole electrons, is the diffusion length of holes and electrons, is the diode PN junction voltage, is the Boltzmann constant, is the absolute temperature; S5.1.2: Simplify equations, use constants replace , when there is no light, the simplified diode - The equation is: ； S5.1.3: When there is no light, dark current flows through diodes D1, D2, D3, and D4. Suppose the potentials at A and B are , , the power supply voltage is , then according to the simplified diode - Equation and KCL law, we can get the following constraints: ； ； Combining the above two equations, we can get: ； In the formula, is the constant of diode D1 , is the constant of diode D2 , is the constant of diode D3 , is the diode D4 constant At this time, the potential difference between points A and B is closely related to the differences in the diode PN junction during the manufacturing process. The differences in the manufacturing process are: , , , , , and , based on multiple groups of the same structure to generate keys, a multi-digit digital key can be obtained.

10. A chip bottom attack detection method based on photosensitive characteristics of DIO-PUF as claimed in claim 9, characterized in that: The calculation of the digital key when there is light in step S5 includes the following specific steps: S5.2.1: When there is light, electrons absorb photon energy and transition to the conduction band. The photosensitive diode circuit generates and separates photogenerated electron-hole pairs. The electron-hole pairs generated by light excitation generate photocurrent for the diode PN junction current. At this time, the current passing through the diode is the sum of the dark current and the photocurrent. Then the diode - The equation is: ； In the formula, is the photogenerated carrier generation rate, w is the depletion region width of the diode PN junction; S5.2.2: Simplify equations, use constants replace , when there is no light, the simplified diode - The equation is: ； S5.2.3: When there is light, the external light irradiates the bottom of the chip and acts on diodes D1, D2, D3 and D4. Diodes D1, D2, D3 and D4 generate and separate photogenerated electron-hole pairs. According to the simplified diode - Equation and KCL law, we can get the following constraints: ； ； Combining the above two equations, we can get: ； In the formula, is the constant of diode D1 , is the constant of diode D2 , is the constant of diode D3 , is the constant of diode D4 At this time, the potential difference between points A and B is not only related to the differences in the diode PN junction during the manufacturing process, but also the differences in the manufacturing process are: , , , , , and It is also related to the light intensity. When light shines on the diodes D1, D2, D3 and D4 at the bottom of the chip, the key will change with the change of light intensity.

Images