Chip bottom attack detection circuit and method based on photosensitive characteristic of DIO-PUF

Abstract

The application relates to a chip bottom attack detection circuit and method based on a DIO-PUF with photosensitive characteristics, which comprises an input port C, control logic CTL, a photosensitive diode circuit, a latching sensitive amplifier LSSA, a register REG and an output port KEY. The chip bottom attack detection circuit and method based on the DIO-PUF with photosensitive characteristics can judge whether the working environment of the chip is safe in real time by detecting whether the chip packaging is removed, thereby providing an effective protection means. Through the DIO-PUF technology with photosensitive characteristics, a unique digital key can be integrated at the bottom of the chip, so that the chip can effectively verify its authenticity when facing physical intervention. The unique identity can greatly increase the difficulty of intrusion of attackers, improve the overall security of the chip, and can also be used to detect whether the working environment of the chip is threatened, so as to ensure that the chip operates in a safe environment and avoid potential security problems caused by environmental changes.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of hardware security and anti-counterfeiting technology, in particular to a chip bottom attack detection circuit and method based on DIO-PUF with light-sensitive characteristics. BACKGROUND

[0002] With the rapid development of technology, many fields in modern society, such as the Internet of Things, cloud computing, mobile devices, and critical infrastructure, are increasingly dependent on the functions of chips. These chips are not only the core components of various advanced technologies, but also, due to their critical role, they have become the focus of attackers. Therefore, the protection of chip security is particularly important. In order to cope with the increasing security threats, the physical unclonable function technology has emerged. This technology generates a unique "digital fingerprint" for each chip by utilizing the random physical variations naturally occurring during the semiconductor manufacturing process, thereby significantly enhancing the security of the chip and effectively preventing tampering attacks on physical devices.

[0003] Currently, the attack threats faced by chips are also increasingly diverse. Attack methods against chips include invasive attacks, semi-invasive attacks, and non-invasive attacks. Invasive attacks are when attackers directly physically contact the chip, such as using a microscope or a scanning probe to analyze the internal circuit of the chip, in order to obtain sensitive information or crack encryption keys. Attackers can view the circuit layout of the chip through a microscope and reverse engineer the functions and data of the chip. Semi-invasive attacks are a method of physically contacting the chip without completely disassembling it. This type of attack usually obtains sensitive information or analyzes the chip without damaging the chip's outer shell through specific technical means. For example, attackers use lasers to precisely hit the chip, change its working state or directly read internal data by laser scanning or laser-induced circuit failure. In addition, attackers can also use radio frequency signals to interfere with the normal operation of the chip, obtain internal operation information or cause errors, and further observe and analyze the response signals. Non-invasive attacks are when attackers do not directly contact the chip, such as by measuring the electromagnetic leakage or power consumption pattern of the chip to infer the internal activities of the chip. This type of attack can use the electromagnetic waves or power consumption changes generated by the chip when processing data to infer the key or other secret information.

[0004] In response to these attack methods, the industry has taken some protection techniques, including chip top layer metal active shielding layer technology, protection packaging technology and anti-side channel attack technology, wherein the chip top layer metal active shielding layer technology is to form a complex wiring network with the top layer metal to shield the key components such as the chip encryption module, and then cooperate with the integrity sensing unit to realize effective sensing and protection against invasive physical attacks. The protection packaging technology is to use tamper-proof packaging to apply a special coating on the surface of the chip or wrap the chip with electromagnetic shielding material to prevent the chip information from being obtained through laser or electromagnetic waves. The anti-side channel attack technology includes power consumption analysis protection and electromagnetic interference technology. These technologies aim to mask the power consumption and electromagnetic signals generated by the chip when processing data to prevent attackers from extracting sensitive information through these signals.

[0005] However, among the many chip protection technologies, the necessity of chip bottom protection is often overlooked. The bottom of the chip usually does not have the same protection measures as the top layer, and attackers can make physical contact on the bottom without being easily detected. By removing or damaging the bottom packaging of the chip, attackers can directly access the sensitive circuits and storage elements inside the chip, which may lead to the leakage of encryption keys, user data and other critical information. Although current chip protection technologies play an important role in preventing most attacks, they mainly focus on the upper layer and data processing part of the chip, and the protection measures for the bottom of the chip are relatively weak, which makes the bottom of the chip a potential security vulnerability that can be easily exploited by attackers. Therefore, a chip bottom attack detection circuit and method based on DIO-PUF of light-sensitive characteristics are proposed to solve the above problems. SUMMARY

[0006] In view of the deficiencies of the prior art, the present application provides a chip bottom attack detection circuit and method based on DIO-PUF of light-sensitive characteristics, which has the advantages of good security performance, etc., and solves the problem that the protection measures for the bottom of the chip are relatively weak, which makes the bottom of the chip a potential security vulnerability that can be easily exploited by attackers, and the security performance is poor.

[0007] To achieve the above purpose, the present application provides the following technical solution: a chip bottom attack detection circuit based on DIO-PUF of light-sensitive characteristics, comprising an input port C, a control logic CTL, a photodiode circuit, a latch-type sensitive amplifier LSSA, a register REG and an output port KEY.

[0008] The input port C is used for inputting signals, the control logic CTL is used for generating a clock signal CLK_REG and an enable signal EN, the photodiode circuit is used for generating A-point voltage and B-point voltage, the sensitive amplifier LSSA is used for amplifying the difference between the A-point voltage and the B-point voltage, the register REG is used for transmitting or storing signals, and the output port KEY is used for outputting signals.

[0009] Further, the anode of the photodiode circuit and the anode of the sensitive amplifier LSSA are electrically connected to a power supply, the cathode of the photodiode circuit and the cathode of the sensitive amplifier LSSA are grounded GND, the output end of the photodiode circuit is electrically connected to the input end of the sensitive amplifier LSSA, the output end of the sensitive amplifier LSSA is electrically connected to the input end of the register REG, the input port C is electrically connected to the input end of the control logic CTL, the control end of the sensitive amplifier LSSA and the control end of the register REG are electrically connected to the output end of the control logic CTL, and the output end of the register REG is electrically connected to the output port KEY.

[0010] Further, the chip bottom attack detection circuit based on the DIO-PUF with light-sensitive characteristics specifically includes the following two operating states:

[0011] Normal state: when the chip bottom is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to be turned on, the signal enters from the input port C, the photodiode circuit inputs the A-end voltage and the B-end voltage to the sensitive amplifier LSSA through the dark current, the sensitive amplifier LSSA amplifies the voltage difference between the A-end voltage and the B-end voltage, and outputs a unique digital signal as the digital key of the chip-specific information, the clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG, and finally are output from the output port KEY;

[0012] Abnormal state: when the chip bottom is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to open, the signal enters from the input port C, the external light irradiates the chip bottom and acts on the photodiode circuit, the photodiode circuit generates and separates the photo-generated electron-hole pairs, the photo-generated holes migrate to the output end of the photodiode circuit along the potential gradient, causing the potential to gradually rise, causing the potential relationship between the A end voltage and the B end voltage to change, thereby causing the generated key to change, the A end voltage and the B end voltage are input to the sensitive amplifier LSSA, the sensitive amplifier LSSA amplifies the voltage difference between the A end voltage and the B end voltage, and outputs a unique digital signal as the digital key of the unique information of each chip, the clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG, and finally output from the output port KEY.

[0013] Further, the photodiode circuit includes a TG gate, the TG gate includes a P tube and an N tube, the P tube and the N tube are connected in parallel, the gate of the P tube is electrically connected with the power supply VDD, and the gate of the N tube is grounded GND.

[0014] Further, the P tube source and the P tube substrate form a diode D1, the N tube substrate and the N tube drain form a diode D2, the P tube drain and the P tube substrate form a diode D3, and the N tube substrate and the N tube source form a diode D4.

[0015] Further, the cathode of the diode D1 and the cathode of the diode D3 are electrically connected with the power supply VDD, the anode of the diode D2 and the anode of the diode D4 are grounded GND, the anode of the diode D1 and the cathode of the diode D2 are electrically connected with the first input end of the sensitive amplifier LSSA, and the anode of the diode D3 and the cathode of the diode D4 are electrically connected with the second input end of the sensitive amplifier LSSA.

[0016] Further, the chip bottom attack detection circuit based on the DIO-PUF with light-sensitive characteristics specifically includes the following two operating states:

[0017] Normal state: when the chip bottom is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to open, the signal enters from the input port C, the diodes D1, D2, D3 and D4 all pass through the dark current, the A end voltage and the B end voltage are input to the sensitive amplifier LSSA, the sensitive amplifier LSSA amplifies the voltage difference between the A end voltage and the B end voltage, and outputs a unique digital signal as the digital key of the unique information of each chip, the clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG, and finally output from the output port KEY;

[0018] Abnormal state: when the chip bottom is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to open, the signal enters from the input port C, the external light irradiates the chip bottom and acts on the diode D1, the diode D2, the diode D3 and the diode D4, the diode D1, the diode D2, the diode D3 and the diode D4 generate and separate photo-generated electron-hole pairs, the photo-generated holes migrate to the anode of the diode D1 and the anode of the diode D3 along the potential gradient, causing the potential to gradually rise, causing the potential relationship between the A terminal voltage and the B terminal voltage to change, thereby causing the generated key to change, the A terminal voltage and the B terminal voltage are input to the sensitive amplifier LSSA, the sensitive amplifier LSSA amplifies the voltage difference between the A terminal voltage and the B terminal voltage, and outputs a unique digital signal as the digital key of the unique information of each chip, the clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG, and finally output from the output port KEY.

[0019] Another technical problem solved by the present application is to provide a chip bottom attack detection method based on the light-sensitive characteristics of DIO-PUF, comprising the following specific steps:

[0020] S1: the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to open;

[0021] S2: the signal enters from the input port C, and the A terminal voltage and the B terminal voltage are input to the sensitive amplifier LSSA;

[0022] S3: the sensitive amplifier LSSA amplifies the voltage difference between the A terminal voltage and the B terminal voltage, and outputs a unique digital signal as the digital key of the unique information of each chip;

[0023] S4: the clock signal CLK_REG and the digital key generated by the control logic CTL enter the register REG, and finally output from the output port KEY;

[0024] S5: calculate the digital key with and without light and the digital key with light, and determine whether the digital key at this time is the same as the digital key without light, if yes, enter S6, otherwise, enter S7;

[0025] S5.1.1: without light, the diode - The equation is:

[0026] ;

[0027] In the formula, is the charge constant, is the diode PN junction area, Diffusion coefficient of electrons, Diffusion coefficient of holes, Equilibrium concentration of electrons in P-type semiconductor, Equilibrium concentration of holes in n-type semiconductor, Diffusion length of electrons and holes, Diffusion length of holes and electrons, End voltage of diode PN junction, Boltzmann constant, Absolute temperature,

[0028] S5.1.2: Simplified equation, using constants Instead of , with no light, the simplified diode - Equation is:

[0029] ;

[0030] S5.1.3: With no light, diodes D1, D2, D3 and D4 all pass dark current, let the potentials at points A and B be , , and the power supply voltage be , then according to the simplified diode - Equation and KCL law, the following constraints can be obtained:

[0031] ;

[0032] ;

[0033] The above two equations can be obtained:

[0034] ;

[0035] In the formula, is the constant of diode D1 , is the constant of diode D2 , is the constant of diode D3 , is the constant of diode D4 , at this time the potential difference between points A and B is closely related to the difference in the manufacturing process of the diode PN junction, the difference in the manufacturing process is respectively: , , , , , and Based on the same structure of multiple groups to generate keys, you can get a multi-bit digital key.

[0036] S5.2.1: with light, the electronic absorption photon energy transition to the conduction band, photodiode circuit and separate photo-generated electron-hole pairs, photo-generated electron-hole pairs produced by the photoelectric current generated by the diode PN junction current, the current through the diode at this time is the sum of the dark current and photocurrent, then the diode - Equation:

[0037] ;

[0038] In the formula, is the photo-generated carrier generation rate, w is the width of the depletion region of the diode PN junction;

[0039] S5.2.2: simplified equation, using constant Instead of , no light, the simplified diode - Equation:

[0040] ;

[0041] S5.2.3: with light, the external light irradiation chip bottom and work on diode D1, diode D2, diode D3 and diode D4, diode D1, diode D2, diode D3 and diode D4 and separate photo-generated electron-hole pairs, according to the simplified diode - Equation and KCL law, the following constraints can be obtained:

[0042] ;

[0043] ;

[0044] The above two equations can be obtained:

[0045] ;

[0046] In the formula, is the constant of diode D1 , is the constant of diode D2 , is the constant of diode D3 , is the constant of diode D4 , the potential difference between points A and B is not only related to the difference in the manufacturing process of the diode PN junction, the difference in the manufacturing process is: , 、 、 、 、 and , and the light intensity is related to the light irradiating the diode D1, the diode D2, the diode D3 and the diode at the bottom of the chip, and the key changes with the change of the light intensity;

[0047] S6: The bottom of the chip is not attacked;

[0048] S7: The bottom of the chip is attacked.

[0049] Compared with the prior art, the technical scheme of the present application has the following beneficial effects:

[0050] The chip bottom attack detection circuit and method based on the light-sensitive characteristic DIO-PUF can detect whether the chip packaging is removed, judge in real time whether the working environment of the chip is safe, and thus provide an effective protection means. Through the light-sensitive characteristic DIO-PUF technology, a unique digital key can be integrated at the bottom of the chip, so that the chip can effectively verify its authenticity when facing physical intervention. This unique identity can greatly increase the difficulty of intrusion of attackers and improve the overall security of the chip. It can also be used to detect whether the working environment of the chip is threatened, to ensure that the chip operates in a safe environment and avoid potential security problems caused by environmental changes. Through these measures, the protection capability of the bottom of the chip is improved, and the blank of the existing protection technology is filled, providing more comprehensive protection for the overall security of the chip. This will help to further enhance the security of the chip in the face of complex attack environment and ensure the integrity of critical data and information. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 It is a detection circuit structure schematic diagram of the present application;

[0052] Figure 2 It is a TG gate structure schematic diagram of the present application;

[0053] Figure 3 It is a TG gate cross-sectional structure schematic diagram of the present application;

[0054] Figure 4 It is a TG gate equivalent diagram of the present application;

[0055] Figure 5 It is a PUF unit layout of the present application;

[0056] Figure 6 It is a diode light condition 25℃ without light digital key and with light digital key of the present application;

[0057] Figure 7A schematic diagram of the variation of the photocurrent in the PN junction of the diode with the optical power.

[0058] In the figure: C is an input port, CTL is control logic, LSSA is a latching type sensitive amplifier, REG is a register, KEY is an output port, D1 is diode D1, D2 is diode D2, D3 is diode D3, D4 is diode D4, P is a P tube, P-sub is a P-type substrate, N is an N tube, N-well is an N-type substrate, VDD is a power supply, and GND is a ground. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0060] Please refer to Figures 1-7 The chip bottom attack detection circuit based on the light-sensitive characteristic of the DIO-PUF in the embodiment includes an input port C, control logic CTL, a light-sensitive diode circuit, a latching type sensitive amplifier LSSA, a register REG, and an output port KEY.

[0061] The input port C is used for inputting signals, the control logic CTL is used for generating a clock signal CLK_REG and an enable signal EN, the light-sensitive diode circuit is used for generating A-point voltage and B-point voltage, the sensitive amplifier LSSA is used for amplifying the difference between the A-point voltage and the B-point voltage, the register REG is used for transmitting or storing signals, and the output port KEY is used for outputting signals.

[0062] The anode of the light-sensitive diode circuit and the anode of the sensitive amplifier LSSA are electrically connected to a power supply, the cathode of the light-sensitive diode circuit and the cathode of the sensitive amplifier LSSA are grounded GND, the output end of the light-sensitive diode circuit is electrically connected to the input end of the sensitive amplifier LSSA, the output end of the sensitive amplifier LSSA is electrically connected to the input end of the register REG, the input port C is electrically connected to the input end of the control logic CTL, the control end of the sensitive amplifier LSSA and the control end of the register REG are electrically connected to the output end of the control logic CTL, and the output end of the register REG is electrically connected to the output port KEY.

[0063] The chip bottom attack detection circuit based on the light-sensitive characteristic of the DIO-PUF specifically includes the following two operating states:

[0064] Normal state: when the chip bottom is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to open, the signal enters from the input port C, the photodiode circuit inputs the voltage at the A end and the voltage at the B end to the sensitive amplifier LSSA through the dark current, the sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip, the clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG, and finally are output from the output port KEY;

[0065] Abnormal state: when the chip bottom is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to open, the signal enters from the input port C, the external light irradiates the chip bottom and acts on the photodiode circuit, the photodiode circuit generates and separates the photo-generated electron-hole pairs, the photo-generated holes migrate to the output end of the photodiode circuit along the potential gradient, causing the potential to gradually rise, so that the potential size relationship between the voltage at the A end and the voltage at the B end changes, thereby causing the generated key to change, the voltage at the A end and the voltage at the B end are input to the sensitive amplifier LSSA, the sensitive amplifier LSSA amplifies the voltage difference between the voltage at the A end and the voltage at the B end, and outputs a unique digital signal as the digital key of the unique information of each chip, the clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG, and finally are output from the output port KEY.

[0066] The photodiode circuit comprises a TG gate, the TG gate comprises a P tube and an N tube, the P tube and the N tube are connected in parallel, the gate of the P tube is electrically connected with the power supply VDD, the gate of the N tube is grounded GND, the source of the P tube and the substrate of the P tube form a diode D1, the substrate of the N tube and the drain of the N tube form a diode D2, the drain of the P tube and the substrate of the P tube form a diode D3, and the substrate of the N tube and the source of the N tube form a diode D4.

[0067] The cathode of the diode D1 and the cathode of the diode D3 are electrically connected with the power supply VDD, the anode of the diode D2 and the anode of the diode D4 are grounded GND, the anode of the diode D1 and the cathode of the diode D2 are electrically connected with the first input end of the sensitive amplifier LSSA, and the anode of the diode D3 and the cathode of the diode D4 are electrically connected with the second input end of the sensitive amplifier LSSA.

[0068] The chip bottom attack detection circuit based on the light-sensitive characteristics of the DIO-PUF specifically comprises the following two operating states:

[0069] Normal state: when the chip bottom is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to open, the signal enters from the input port C, the diode D1, the diode D2, the diode D3 and the diode D4 all pass through the dark current, the A end voltage and the B end voltage are input to the sensitive amplifier LSSA, the sensitive amplifier LSSA amplifies the voltage difference between the A end voltage and the B end voltage, and outputs a unique digital signal as the digital key of the unique information of each chip, the clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG, and finally output from the output port KEY;

[0070] Abnormal state: when the chip bottom is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to open, the signal enters from the input port C, the external light irradiates the chip bottom and acts on the diode D1, the diode D2, the diode D3 and the diode D4, the diode D1, the diode D2, the diode D3 and the diode D4 generate and separate the photo-generated electron-hole pairs, the photo-generated holes migrate to the anode of the diode D1 and the anode of the diode D3 along the potential gradient, causing the potential to gradually rise, so that the potential relationship between the A end voltage and the B end voltage changes, thereby causing the generated key to change, the A end voltage and the B end voltage are input to the sensitive amplifier LSSA, the sensitive amplifier LSSA amplifies the voltage difference between the A end voltage and the B end voltage, and outputs a unique digital signal as the digital key of the unique information of each chip, the clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG, and finally output from the output port KEY.

[0071] Another technical problem solved by the present application is to provide a chip bottom attack detection method based on the light-sensitive characteristics of DIO-PUF, comprising the following specific steps:

[0072] S1: the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to open;

[0073] S2: the signal enters from the input port C, and the A end voltage and the B end voltage are input to the sensitive amplifier LSSA;

[0074] S3: the sensitive amplifier LSSA amplifies the voltage difference between the A end voltage and the B end voltage, and outputs a unique digital signal as the digital key of the unique information of each chip;

[0075] S4: the clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG, and finally output from the output port KEY;

[0076] S5: Calculate the digital key with and without light and the digital key with light, and determine whether the digital key at this time is the same as the digital key without light, yes, then enter S6, no, then enter S7;

[0077] S5.1.1: Without light, diode - The equation is:

[0078] ;

[0079] In the formula, is the charge constant, is the diode PN junction area, is the diffusion coefficient of electrons, is the diffusion coefficient of holes, is the equilibrium concentration of electrons in P-type semiconductor, is the equilibrium concentration of holes in n-type semiconductor, is the diffusion length of holes and electrons, is the diffusion length of holes and electrons, is the diode PN junction terminal voltage, is the Boltzmann constant, is the absolute temperature;

[0080] S5.1.2: Simplify the equation and use constant instead of , without light, the simplified diode - The equation is:

[0081] ;

[0082] S5.1.3: Without light, diode D1, diode D2, diode D3 and diode D4 all pass through dark current, set A, B two potential respectively , , the power supply voltage is , then according to the simplified diode - equation and KCL law, the following constraints can be obtained:

[0083] ;

[0084] ;

[0085] The above two equations can be obtained:

[0086] ;

[0087] In the formula, Constant for diode D1 , Constant for diode D2 , Constant for diode D3 , Constant for diode D4 , at this time, the potential difference between points A and B is closely related to the difference in the manufacturing process of the PN junction of the diode, and the difference in the manufacturing process is: , , , , , and , based on multiple groups of the same structure to generate a key, a multi-bit digital key can be obtained;

[0088] S5.2.1: When there is light, the electrons absorb photon energy to transition to the conduction band, and the photodiode circuit generates and separates the photoelectron-hole pairs. The photoexcitation generated electron-hole pairs produce photocurrent for the diode PN junction current. At this time, the current passing through the diode is the sum of the dark current and the photocurrent, and the diode - The equation is:

[0089] ;

[0090] In the formula, is the photo-generated carrier generation rate, and w is the width of the depletion region of the diode PN junction;

[0091] S5.2.2: Simplify the equation, and use constant instead of , in the absence of light, the simplified diode - The equation is:

[0092] ;

[0093] S5.2.3: When there is light, the external light irradiates the bottom of the chip and acts on diode D1, diode D2, diode D3 and diode D4. Diode D1, diode D2, diode D3 and diode D4 generate and separate photoelectron-hole pairs. According to the simplified diode - Equation and KCL law, the following constraint conditions can be obtained:

[0094] ;

[0095] ;

[0096] The above two equations can be obtained:

[0097] ;

[0098] In the formula, is a constant of diode D1 , is a constant of diode D2 , is a constant of diode D3 , is a constant of diode D4 At this time, the potential difference between points A and B is not only related to the difference in the manufacturing process of the diode PN junction, which is respectively: , , , , , and , but also related to the light intensity. When the diode D1, diode D2, diode D3 and diode at the bottom of the chip are irradiated, the key will change with the change of light intensity;

[0099] S6: The bottom of the chip is not attacked;

[0100] S7: The bottom of the chip is attacked.

[0101] In order to effectively protect a chip substrate with an area of 1mm*1mm, the technology based on DIO-PUF is adopted. First, in order to enhance the ability to resist brute force attack, the length of the key needs to be at least 256 bits, which means that 256 DIO-PUF units need to be used to generate a random key with sufficient strength. Secondly, in order to enhance the detection ability of PUF units to external attacks, it is necessary to ensure that the PUF units are evenly distributed on the surface of the substrate. This uniform arrangement helps to ensure that light can uniformly irradiate each unit, thereby improving the overall detection accuracy and stability. Finally, while considering security and cost-effectiveness, the width of the MOS tube is set to 20um and the length is set to 3um. At this time, the corresponding diode PN junction interface area is 4um², which not only ensures the performance of the circuit, but also effectively controls the manufacturing cost. The PUF unit layout is as shown in Figure 5 .

[0102] Based on the above parameter settings, the present application models and Monte Carlo simulation verifies the protection scheme based on the Spectre model. The simulation results show that under the condition of no light, the probability of '1' in the key is 44.92%, and the generation results of the digital key with no light and the digital key with light at 25℃ are as follows: Figure 6As shown, by modifying the junction saturation current density and side junction saturation current density parameters in the device model to simulate the effect of changing the light conditions in the circuit on the PUF unit key generation, the simulation results show that when the above parameters increase by 20%, the key changes, and at this time the probability of '1' in the key is 46.88%, and the key change rate before and after light is 58.20%, indicating that the PUF structure has good bias, meeting the requirements of PUF random key, and when the light condition changes, the key can change significantly to sensitively indicate whether the chip is attacked.

[0103] In addition, by using Comsol software to further simulate and verify the photosensitive characteristics of the diode PN junction, the simulation results show the change of photocurrent with light power as Figure 7 As shown, when the light power rises from 0 to 50uW, the photocurrent in the diode PN junction changes by about 0.4uA, thereby verifying the sensitivity of the diode PN junction under different light intensities and further proving the effectiveness and reliability.

[0104] The working principle of the above embodiment is as follows:

[0105] By detecting whether the chip package is removed, it is judged in real time whether the working environment of the chip is safe, thereby providing an effective protection means, and through the photosensitive characteristic DIO-PUF technology, a unique digital key can be integrated at the bottom of the chip, so that the chip can effectively verify its authenticity when facing physical intervention. This unique identity can greatly increase the difficulty of intrusion for attackers and improve the overall security of the chip. It can also be used to detect whether the chip working environment is threatened to ensure that the chip operates in a safe environment and avoid potential security problems caused by environmental changes. Through these measures, the protection capability of the bottom of the chip is improved, and the blank of the existing protection technology is filled, providing more comprehensive protection for the overall security of the chip. This will help to further enhance the security of the chip in the face of complex attack environment and ensure the integrity of critical data and information.

[0106] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting; it is not intended to exclude myriad other embodiments of the present application that other inventors can develop based on the same general inventive concepts embodied by the described embodiments. That is, although the present application is described in terms of particular embodiments and implementations, it is to be understood that the terminology used is for the purpose of descriptive clarity and that it is intended to be limited only by the words recited in the appended claims. It is to be understood that the terms "including", "comprising", "consisting" and variations thereof do not preclude the addition of further integers to the claimed combination of integers. It is to be understood that the terms "including", "comprising", "consisting" and variations thereof encompass the terms "consisting of" and "consisting essentially of". It is to be understood that the terms "including", "comprising", "consisting" and variations thereof are not intended to exclude other integers or additional integers not specifically recited. It is to be understood that the terms "including", "comprising", "consisting" and variations thereof are not to be construed as limiting the scope of the claimed concept to the complete reading of the claims. It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting; it is not intended to exclude myriad other embodiments of the present application that other inventors can develop based on the same general inventive concepts embodied by the described embodiments. That is, although the present application is described in terms of particular embodiments and implementations, it is to be understood that the terminology used is for the purpose of descriptive clarity and that it is intended to be limited only by the words recited in the appended claims.

[0107] While the embodiments of the application have been shown and described herein, it is to be understood that the application is not limited to the embodiments described, and it is not intended to exclude myriad other embodiments of the present application that other inventors can develop based on the same general inventive concepts embodied by the described embodiments. That is, although the present application is described in terms of particular embodiments and implementations, it is to be understood that the terminology used is for the purpose of descriptive clarity and that it is intended to be limited only by the words recited in the appended claims.

Claims

1. A chip bottom attack detection circuit based on photosensitive properties of DIO-PUF, characterized in that, This includes input port C, control logic CTL, photodiode circuit, latching sensitive amplifier LSSA, register REG, and output port KEY; The input port C is used to input signals, the control logic CTL is used to generate clock signal CLK_REG and enable signal EN, the photodiode circuit is used to generate voltage at point A and voltage at point B, the sensitive amplifier LSSA is used to amplify the difference between voltage at point A and voltage at point B, the register REG is used to transmit or store signals, and the output port KEY is used to output signals. The positive terminals of the photodiode circuit and the LSSA (Laser Sensor Amplifier) ​​are both electrically connected to the power supply. The negative terminals of the photodiode circuit and the LSSA are both grounded (GND). The output terminal of the photodiode circuit is electrically connected to the input terminal of the LSSA. The output terminal of the LSSA is electrically connected to the input terminal of the REG register. The input port C is electrically connected to the input terminal of the control logic CTL. The control terminals of the LSSA and REG are both electrically connected to the output terminals of the CTL. The output terminal of the REG register is electrically connected to the output port KEY.

2. The chip bottom attack detection circuit based on photosensitive characteristics of a DIO-PUF as described in claim 1, characterized in that, The chip bottom attack detection circuit based on photosensitive properties of DIO-PUF specifically includes the following two operating states: Normal state: When the bottom of the chip is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on. The signal enters from the input port C. The photodiode circuit inputs the voltage at terminal A and terminal B to the sensitive amplifier LSSA through dark current. The sensitive amplifier LSSA amplifies the voltage difference between terminal A and terminal B and outputs a unique digital signal as a digital key for the unique information of each chip. The clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG and are finally output from the output port KEY. Abnormal State: When the bottom of the chip is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on. The signal enters from the input port C. External light shines on the bottom of the chip and acts on the photodiode circuit. The photodiode circuit generates and separates photogenerated electron-hole pairs. The photogenerated holes migrate along the potential gradient to the output terminal of the photodiode circuit, causing the potential to gradually increase. This changes the potential relationship between the voltage at terminal A and terminal B, thereby changing the generated key. The voltage at terminal A and terminal B is input to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between the voltage at terminal A and terminal B and outputs a unique digital signal as the digital key for each chip's unique information. The clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG and are finally output from the output port KEY.

3. The chip bottom attack detection circuit based on photosensitive characteristics of a DIO-PUF as described in claim 1, characterized in that, The photodiode circuit includes a TG gate, which comprises a P-type transistor and an N-type transistor. The P-type transistor and the N-type transistor are connected in parallel. The gate of the P-type transistor is electrically connected to the power supply VDD, and the gate of the N-type transistor is grounded to GND.

4. The chip bottom attack detection circuit based on photosensitive characteristics of a DIO-PUF as described in claim 3, characterized in that, The source and substrate of the P-tube form diode D1, the substrate and drain of the N-tube form diode D2, the drain and substrate of the P-tube form diode D3, and the substrate and source of the N-tube form diode D4.

5. The chip bottom attack detection circuit based on photosensitive characteristics of a DIO-PUF as described in claim 4, characterized in that, The cathodes of diodes D1 and D3 are both electrically connected to the power supply VDD. The anodes of diodes D2 and D4 are both grounded to GND. The anodes of diodes D1 and D2 are both electrically connected to the first input terminal of the sensitive amplifier LSSA. The anodes of diodes D3 and D4 are both electrically connected to the second input terminal of the sensitive amplifier LSSA.

6. The chip bottom attack detection circuit based on photosensitive characteristics of a DIO-PUF as described in claim 5, characterized in that, The chip bottom attack detection circuit based on photosensitive properties of DIO-PUF specifically includes the following two operating states: Normal state: When the bottom of the chip is not attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on. The signal enters from the input port C. Diodes D1, D2, D3, and D4 all carry dark current, inputting the voltage at terminal A and terminal B to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between terminal A and terminal B and outputs a unique digital signal as a digital key for the unique information of each chip. The clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG and are finally output from the output port KEY. Abnormal State: When the bottom of the chip is attacked, the enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on. The signal enters from the input port C. External light shines on the bottom of the chip and acts on diodes D1, D2, D3, and D4. Diodes D1, D2, D3, and D4 generate and separate photogenerated electron-hole pairs. The photogenerated holes migrate along the potential gradient to the anodes of diodes D1 and D3, causing the potential to gradually increase. This changes the potential relationship between the voltage at terminals A and B, thereby changing the generated key. The voltage at terminals A and B is input to the sensitive amplifier LSSA. The sensitive amplifier LSSA amplifies the voltage difference between terminals A and B and outputs a unique digital signal as the digital key for each chip's unique information. The clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG and are finally output from the output port KEY.

7. A detection method for a chip bottom attack detection circuit based on photosensitive properties of a DIO-PUF as described in any one of claims 1 to 6, characterized in that, The specific steps include the following: S1: The enable signal EN generated by the control logic CTL controls the sensitive amplifier LSSA to turn on; S2: The signal enters from the input port C, and the voltages at terminals A and B are input to the sensitive amplifier LSSA; S3: The LSSA sensitive amplifier amplifies the voltage difference between the voltage at terminal A and terminal B, and outputs a unique digital signal as a digital key for the unique information of each chip. S4: The clock signal CLK_REG generated by the control logic CTL and the digital key enter the register REG and are finally output from the output port KEY. S5: Calculate the digital key with and without light and the digital key with light respectively, and determine whether the digital key at this time is the same as the digital key without light. If yes, proceed to S6; otherwise, proceed to S7. S6: The bottom of the chip was not attacked; S7: The bottom of the chip was attacked.

8. The detection method for a chip bottom attack detection circuit based on photosensitive properties of a DIO-PUF as described in claim 7, characterized in that, Step S5, which involves calculating the digital key in the absence of light, includes the following specific steps: S5.1.1: In the absence of light, the diode... - The equation is: ； In the formula, It is a constant charge. The area of ​​the diode's PN junction is... The electron diffusion coefficient is denoted as . is the diffusion coefficient of the hole. This represents the equilibrium concentration of electrons in a p-type semiconductor. This represents the equilibrium concentration of holes in an n-type semiconductor. The diffusion length of holes and electrons, The diffusion length of holes and electrons. This is the voltage across the PN junction of the diode. Boltzmann's constant, Absolute temperature; S5.1.2: Simplify the equations by using constants. replace In the absence of light, the simplified diode - The equation is: ； S5.1.3: In the absence of light, diodes D1, D2, D3, and D4 all carry dark current. Let the potentials at points A and B be respectively... , The power supply voltage is Then, based on the simplified diode - From the equations and KCL's law, the following constraints can be obtained: ； ； Combining the above two equations, we get: ； In the formula, The constant of diode D1 , The constant of diode D2 , The constant of diode D3 , The constant of diode D4 At this point, the potential difference between points A and B is closely related to the differences in the manufacturing process of the diode's PN junction. These differences are as follows: , , , , , and By generating keys based on multiple sets of the same structure, a multi-digit digital key can be obtained.

9. The detection method for a chip bottom attack detection circuit based on photosensitive DIO-PUF as described in claim 8, characterized in that, Step S5, which involves calculating the digital key under illumination, includes the following specific steps: S5.2.1: When illuminated, electrons absorb photon energy and transition to the conduction band. The photodiode circuit generates and separates photogenerated electron-hole pairs. The photogenerated electron-hole pairs produce a photocurrent in the diode's PN junction current. At this time, the current flowing through the diode is the sum of the dark current and the photocurrent. - The equation is: ； In the formula, denoted as the photogenerated carrier generation rate, and w is the depletion region width of the diode's PN junction; S5.2.2: Simplify the equations using constants replace In the absence of light, the simplified diode - The equation is: ； S5.2.3: When there is light, external light shines on the bottom of the chip and acts on diodes D1, D2, D3, and D4. Diodes D1, D2, D3, and D4 generate and separate photogenerated electron-hole pairs. Based on the simplified diode... - From the equations and KCL's law, the following constraints can be obtained: ； ； Combining the above two equations, we get: In the formula, The constant of diode D1 , The constant of diode D2 , The constant of diode D3 , The constant of diode D4 At this point, the potential difference between points A and B is not only related to the differences in the manufacturing process of the diode's PN junction, but the differences in the manufacturing process are as follows: , , , , , and It is also related to the light intensity. When light shines on diodes D1, D2, D3 and D4 at the bottom of the chip, the key will change with the light intensity.

Images