Hacker attack detection method and corresponding integrated circuit package

Abstract

The invention relates to a hacker attack detection method and a corresponding integrated circuit package. Hacker attacks involving stimulation of voltage variations in an integrated circuit package are detected by deploying a basic detector network distributed across the integrated circuit package. Each detector is located at a respective location within the package and is configured to generate an alarm signal in response to a voltage change occurring at the particular location. The base detector includes a first component and a second component (such as a flip-flop), the respective outputs of which are configured to be set to complementary binary levels. Logic circuitry is coupled to the outputs of the first component and the second component and is designed to generate an alarm signal to indicate a hacker attack involving local voltage variations within the integrated circuit package when the outputs of the first component and the second component no longer exhibit complementary binary levels.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to Italian Patent Application No. 102024000017470, filed on July 26, 2024, the entire contents of which are incorporated herein by reference to the fullest extent permitted by law. Technical Field

[0003] This manual covers the detection of hacker attacks.

[0004] For example, aspects of this specification can be used to defend on-chip system architectures against physical hacking by applying runtime countermeasures designed to prevent attacks. Background Technology

[0005] Detecting "physical" hacking attacks is an evolving topic.

[0006] Effectively detecting hacker attacks promotes runtime countermeasures to prevent attacks, such as next-generation attacks where hackers modify chip power locally.

[0007] Most physical hacking attacks are based on attempts to modify the voltage values ​​of a chip. Such modifications can be made locally, thus maintaining the chip's functionality, except for parts of the chip that store sensitive information or perform sensitive checks ("sub-circuits").

[0008] Such local modifications can involve causing a change in the voltage value within the chip from outside the chip (“bounce”), and in some cases, it is not necessary to remove part of the package or open the package (so-called decapping).

[0009] For example, local power supplies can be modified in various ways.

[0010] For example, an attacker could attempt to change the level of one of the power lines and could combine μ-probe technology with focused ion beam (FIB).

[0011] Electromagnetic fields (EM) (leading to so-called Localized EM Attacks (LEMA)) or laser beam energy (leading to so-called Laser Fault Injection Attacks (LFIA)) can be applied within the framework of attacks that affect the functionality of subsections of a circuit. Summary of the Invention

[0012] The purpose of one or more embodiments is to help solve the above-mentioned problems.

[0013] According to one or more embodiments, such an objective can be achieved via a method having the features described in the following claims.

[0014] One or more embodiments relate to corresponding integrated circuit packages. A system-on-a-chip (SoC) is an example of such a package.

[0015] In the solution described in this article, users (customers) can be provided with configurable hardware (HW) tools that are configured to detect and combat hacking attacks.

[0016] In the solution described in this paper, a (very) numerous detectors (sensors) are distributed on the integrated circuit (IC) package to be protected according to a coordinate strategy. These sensors can detect the effects of external entities that may cause circuit failure (i.e., the toggling of flip-flops (FFs)).

[0017] In the solution described in this paper, Nested Vector Interrupt Control (NVIC) can be used to facilitate complex management of interrupts (and thus resist attacks).

[0018] For example, some interrupts can be disabled in response to a host decision, while others can be handled with (high) priority, taking into account the importance of the protected circuitry in a particular application.

[0019] Depending on the sensitivity requirements and the area where such a detector will be placed, the detectors discussed in this paper may include different types of triggers: for example, a sensor distributed over a certain area may use the same type of trigger as the one used in a protected area.

[0020] Different strategies can serve as the basis for detector placement.

[0021] For example, sensors can be: evenly distributed within the chip area, located in the area where the trigger is located, or distributed in a way that the designer / user deems more advantageous.

[0022] The solutions described in this paper offer one or more of the following advantages: they do not involve host-specific settings; the solutions proposed in this paper do not rely on IP modifications and are therefore ultimately “IP-agnostic”, which is particularly advantageous where system characteristics are specified by a third party; and the solutions proposed in this paper can be applied a posteriori to SoC architectures (i.e., after the design has been solidified). Attached Figure Description

[0023] One or more embodiments will now be described by way of example only with reference to the accompanying drawings, in which:

[0024] Figure 1 This is a general overview of the underlying methodologies of the solutions described in this article;

[0025] Figure 2 This is a circuit diagram of the detector applicable to the solution described in this article;

[0026] Figure 3 This is an example diagram of the first possible implementation of the solution described in this article;

[0027] Figure 4 This is an explanation Figure 3 The diagram illustrates the possible temporal behavior (waveform) of signals that can occur in the system.

[0028] Figure 5 This is an explanation Figure 3 Circuit diagrams detailing possible implementations of the solution shown;

[0029] Figure 6 and Figure 7 These are block diagrams of other possible implementations of the solution described in this article;

[0030] Figure 8 This section describes possible options for implementing the solution described in this article;

[0031] Figure 9 This is a block diagram of a multi-core system-on-a-chip (SoC) architecture in which the solutions described in this article can be applied;

[0032] Figure 10 This includes details of possible implementations of the solution described in this article; and

[0033] Figure 11A , Figure 11B and Figure 11C Explained implementation Figure 2 Possible alternatives to the detector shown. Detailed Implementation

[0034] These figures are provided to clearly illustrate relevant aspects of the embodiments, and they are not necessarily drawn to scale.

[0035] The edges of features drawn in the diagram do not necessarily indicate the end of the feature's range.

[0036] In the following description, one or more specific details are set forth to provide a thorough understanding of examples of embodiments of this specification. These embodiments may be obtained without one or more of these specific details, or may be obtained by other methods, components, materials, etc. In other instances, known structures, materials, or operations have not been shown or described in detail so that certain aspects of the embodiments are not obscured.

[0037] References to "embodiment" or "one embodiment" within the framework of this specification are intended to indicate that a particular configuration, structure, or feature described in connection with that embodiment is included in at least one embodiment. Therefore, phrases such as "in an embodiment" or "in one embodiment" that may appear in one or more places within this specification do not necessarily refer to the same embodiment. Furthermore, in one or more embodiments, particular configurations, structures, or features may be combined in any suitable manner.

[0038] The headings / references used herein are provided for convenience only and therefore do not limit the scope or range of protection of the embodiments.

[0039] In the accompanying figures, unless the context otherwise indicates, the same components or elements are represented by the same references / numbers, and for the sake of brevity, the corresponding descriptions will not be repeated.

[0040] Furthermore, for simplicity and ease of explanation: the same names may be used throughout the specification to designate a node or line and the signal that appears at that node or line; and the same names may be used throughout the specification to designate certain components (such as capacitors, resistors, or inductors or coils) and their electrical parameters.

[0041] Furthermore, when it is said that a component is “connected to” or “coupled to” another component, it should be understood that the other component may be inserted between them, and that the component may be directly connected to or coupled to the other component.

[0042] For example, in the various figures accompanying this specification, such as Figure 2 This illustrates a possible embodiment of the basic detector, in which OR gates are coupled to the output (neg(Q)) of the first flip-flop via a logic inverter inserted between them.

[0043] Hacking techniques have been extensively discussed in the literature, as evidenced by documents (all of which are incorporated herein by reference), such as:

[0044] Rodriguez, et al.: "LLFI: Lateral Laser Fault Injection Attack, 2019Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC), Atlanta, GA, USA, 2019, pp.41-47;

[0045] Leveugle, et al.: "Experimental Evaluation of Protections Against Laser-induced Faults and Consequences on Fault Modeling", 2007 Design, Automation & Test in Europe Conference & Exhibition, Nice, France, 2007, pp. 1-6; or

[0046] Bar-El, et al.: "The Sorcerer's Apprentice Guide to Fault Attacks," Proceedings of the IEEE, vol.94, no.2, pp.370-382, Feb. 2006.

[0047] Other prior art documents include US2008 / 0059741 A1, US2012 / 0226845A1, US11,620,178B1, US 7,805,557 B2 and US 7,590,880 B1 (all of which are incorporated herein by reference).

[0048] As mentioned earlier, a hacker's "physical" attack is usually based on a hack of the chip's voltage value: this may happen locally, and the chip's functionality is otherwise maintained except for parts that contain sensitive information or perform sensitive checks ("sub-circuits").

[0049] Such localized hacking attacks on the voltage values ​​of a chip can involve changes (“bounces”) caused from outside the chip in various ways: changes in external power lines, and / or changes caused by μ-probe technology, focused ion beam (FIB), electromagnetic (EM) fields, or applied laser beams are examples of hacking attacks that can occur without removing a portion of the package or opening the package (so-called decapping).

[0050] For example, an attacker might use a miniature antenna (μEM probe) placed on an integrated circuit (IC) chip and attempt a Localized Electromagnetic Attack (LEMA) as a side-channel attack, because the movement or even static placement of such an antenna on the chip causes changes in the electromagnetic field near the IC chip.

[0051] As another example, a laser fault injection attack (LFIA) can be attempted using the fact that, in response to laser beam irradiation, electron-hole pairs are induced in the IC due to their interaction with photons. This can affect transistors biased by the power and ground voltages applied to the IC due to the substrate current and associated voltage "bounce" generated at the irradiated location.

[0052] The paper “On-Chip Physical Attack Protection Circuits for Hardware Security” by Nagata et al. (IEEE Custom Integrated Circuits Conference 2019, Invited Paper, 1-6) (incorporated hereby by reference) provides further details on this topic.

[0053] In addition, Courbon et al.'s "Adjusting laser injections for fully controlled faults" (Constructive Side-Channel Analysis and Secure Design 2014, Apr 2014, Paris, France) (incorporated hereby by reference) details the various effects observed based on the energy level at the back of the impact circuit.

[0054] Figure 1 This illustrates the general concept of the solution described herein, namely, that a large number (conceptually thousands) of basic detectors 12 are distributed on at least a portion of an integrated circuit 10 (which can be any type of semiconductor chip or die: as previously stated, the solution described herein can be considered “IP-independent”).

[0055] These detectors (sensors) are configured to detect the effects of external interference that could cause the chip or die 10 to malfunction (e.g., trigger flip-flop).

[0056] The terms chip and die are used as synonyms in this article.

[0057] In summary, the solution described in this paper aims to detect hardware hacking attacks in which voltage changes are stimulated in the integrated circuit package 10.

[0058] Therefore, according to the solution described herein, a network of basic detectors 12 is distributed on the integrated circuit package 10, wherein each detector 12 is arranged at a corresponding location on the integrated circuit package 10.

[0059] The detector 12 is configured to generate an alarm signal in response to a voltage change at the location of the integrated circuit package 10 where the sensor is arranged (i.e., in response to a localized hacking attack).

[0060] The specific properties of detector / sensor 12 are not important in themselves, provided that certain factors are taken into account.

[0061] For example, the use of a large number (thousands) of detectors 12 can be achieved by: using small circuitry (few logic gates, few flip-flops FF); applying standard CMOS technology, which is also advantageous for the layout and routing purposes of gate sea architectures with standard flow; employing simple wiring (managed with just a few wires); providing a host-compatible solution without significant setup; low power consumption; and system-on-chip (SoC) level applicability, thus not involving modifications to the IP / subsystem (which may become critical when third-party IP comes into play).

[0062] Figure 2 This is a representation of (basic) detector 12, which provides the required functionality by comprising only two flip-flops 121 and 122, which receive a common reset signal DReset and have respective outputs neg(Q) and Q, coupled to logic inverter 123 (which in turn is coupled to one input of OR gate 124) and the other input of OR gate 124, the output of which provides an alarm signal (e.g., LEMA or LFIA, referred to here as voltage “bounce”) in response to a hacking attack HA, which may cause flip-flops 121 and / or 122 to “flip”.

[0063] It should be noted that D-type FF 121, 122, etc. Figure 2 As shown, its D input is coupled to the power node / line VDD. Other possible (static) configurations for these FFs may include coupling the D input to ground (GND), which facilitates increased sensitivity to any potential interference on VDD or GND. This also applies to the following combination Figure 11A , Figure 11B and Figure 11C Other types of FF discussed.

[0064] therefore, Figure 2The solution is an example of a basic detector 12, which includes: a first component (flip-flop 121) and a second component (flip-flop 122) having corresponding outputs Q, neg(Q) configured (via line DReset) to be set to a first logic level (e.g., binary levels, such as "1" and "0"); and a logic circuit system (inverter 123 and OR gate 124) coupled to the corresponding outputs Q, neg(Q) of the first component 121 and the second component 122.

[0065] Therefore, the logic circuit system is configured to generate an alarm signal Alarm in response to a change in at least one of the first logic levels at the outputs Q and neg(Q) of the first component 121 and the second component 122.

[0066] In fact, for example, for the first values ​​neg(Q) = 1 and Q = 0, the two inputs of OR gate 124 (i.e., the negative(Q) from flip-flop 121 is logically inverted to "0", and the Q from flip-flop 122 is set to "0") cause the output of OR gate 124 to be "0" (no alarm).

[0067] If at least one of the outputs Q and neg(Q) (i.e., one or both) changes, i.e., neg(Q) changes from 1 to 0 and / or Q changes from 0 to 1, the output of OR gate 124 switches to "1" and the signal Alarm is emitted.

[0068] like Figure 2 The implementation illustrated is advantageous because it includes only two flip-flops 121 and 122 and two logic gates 123 and 124 (approximately equivalent to 15 gates), and therefore: it is suitable for standard CMOS implementations, which also facilitates placement and routing in gate sea architectures with standard flow; it involves only two lines for management (DReset, Alarm), which can potentially be reduced to just one (e.g., as combined below). Figure 6 and Figure 7 (As discussed); it is essentially self-configurable and therefore directly usable by the host without any setup; it has low power consumption, theoretically zero as long as runtime fine-tuning or FF mode changes are not involved, thus affording thousands of uses; and it can be used at the SoC level without any modifications, as long as coordination with the (multiple) registers it protects is not involved.

[0069] The solution described in this paper is essentially a static solution that operates without any clock or input signal, thus eliminating dynamic power consumption, which is advantageous for low-power applications. This also provides greater flexibility in detector placement, as clock wiring or placement is not required.

[0070] Figure 3 This is a first possible example of the solution described in this paper, in which multiple detectors / sensors 12 described in this paper are located in sensitive areas of a circuit (integrated circuit IC, such as a system-on-a-chip SoC) designed to prevent physical hacking.

[0071] As previously mentioned, the solutions described in this paper may include a (very) large number (conceptually thousands) of basic detectors 12.

[0072] For simplicity and ease of explanation, Figure 3 The representations in (and other accompanying drawings) are limited to only a few of the detectors (e.g., three).

[0073] Figure 3 The representation in the text is primarily intended to illustrate the possibility of positioning detector 12 near (next to) a part of the system (e.g., system-on-a-chip or SoC) to prevent localized hacking attacks.

[0074] These attacks can occur locally, so the chip's normal functions are maintained, except for parts that contain sensitive information or perform sensitive checks.

[0075] The parts or regions to be protected here are exemplified as the parts or regions containing the flip-flop FF and the logic gate G that works with it.

[0076] As illustrated in the examples in this article, triggers FF can share a common reset line marked Reset_circuitry.

[0077] Detector 12 may have a reset input line branching from the base DReset line, and the Alarm output of detector 12 (labeled INT_REQ#1 to INT_REQ#N (for simplicity, N = 3 here: as mentioned before, N can be a very large number)) is fed into the input of logic gate (here illustrated as an OR gate) 14 to generate the final “global” alarm signal GlobalINT_REQ.

[0078] like Figure 3 As illustrated, the signal GlobalINT_REQ is then applied to block 16, which is configured to manage alarm signals and facilitate the application of appropriate measures to combat hacking attacks.

[0079] For example, block 16 may include a nested vector interrupt control (NVIC) block that facilitates the management of alarm signals as interrupt signals in a sophisticated manner (hence labeled as “INT” signals).

[0080] NVIC block 16 can be configured to work with the interrupt manager feature IM, which, as described herein, is typically already present in the system (e.g., SoC).

[0081] Essentially, NVIC block 16 can be configured (in a manner known to those skilled in the art) to differentiate alarms / interrupts INT_REQ#1, ..., INT_REQ#N in terms of priority / importance.

[0082] For example, NVIC block 16 can be configured to manage interrupts in a flexible manner according to the host's needs: for example, the host (which could be the SoC user) can decide to disable some of these interrupts, while other interrupts are handled with high priority.

[0083] This choice can depend on the importance of a part of the system / circuit to a particular application.

[0084] If NVIC block 16 is located at a certain distance from the attack point (a reasonable assumption), then a voltage "bounce" superimposed on the INT_REQ#j (j = 1, ..., N) signal may exist, such as... Figure 4 The voltage VDD is shown in the figure, where HA represents the time when the hack (LEMA / laser, such as LFIA) occurred.

[0085] Figure 4 As shown, ultimately, as Figure 2 The FF-based sensor 12 shown can hold the signal and stabilize it sufficiently so that it can be detected in the next NVIC clock cycle.

[0086] Figure 5 It's a circuit diagram, which explains... Figure 3 The solution shown is a possible implementation detail, in which “hold” triggers 181, ..., 18N, 18GLOB are provided for this purpose.

[0087] These triggers can be provided for each of the alarm interrupt requests INT_REQ#1, ..., INT_REQ#N and for the "global" interrupt request Global INT_REQ.

[0088] Flip-flops 181, ..., 18N, and 18GLOB share a common reset line RST and set their D input to logic "1".

[0089] They receive interrupt requests INT_REQ#1, ..., INT_REQ#N and the "global" interrupt request Global_INT_REQ at the clock input CK, and deliver the corresponding stable interrupt requests (also labeled INT_REQ#1, ..., INT_REQ#N and Global_INT_REQ for simplicity) to NVIC block 16 at their Q output.

[0090] Although represented as separate entities for ease of explanation and understanding, triggers 181, ..., 18N, 18GLOB can actually be merged into block 16.

[0091] Figure 6 This is a schematic diagram of another possible implementation of the solution following the above approach.

[0092] Figure 6 The implementation and Figure 3 The implementations presented in them have many things in common: therefore, Figure 6 The same reference numerals are used to represent the figures. Figure 3 For the sake of brevity, the parts or elements already presented will not be described again here.

[0093] Figure 6 This is an example of a possible implementation of the solution described in this paper, where the detector / sensor 12 is located around the sensitive area to be protected.

[0094] Once again, the solutions described in this paper can include (very) a large number (conceptually thousands) of basic detectors 12, and Figure 6 The representation in the table is limited to a few (e.g., four) of these detectors, simply for simplicity and ease of interpretation.

[0095] Figure 6 The representation in the diagram is primarily intended to illustrate the possible distribution of detector 12, which is arranged around portions of the system (e.g., system-on-chip or SoC) to prevent localized hacking attacks.

[0096] Also in Figure 6 In this context, the parts or regions to be protected are represented as the locations of flip-flops FF and the logic gates G that work with them.

[0097] As illustrated in the examples herein, triggers FF can be arranged in a daisy-chain configuration (DReset = Reset_circuitry) sharing a common reset line (single line), while the Alarm outputs INT_REQ#1 to INT_REQ#N (for simplicity, N = 4 here, but N can again be a very large number) are fed into the input of logic gate 14 (again exemplified here as an OR gate) to generate the final “global” alarm signal INT_REQ, which can be forwarded to the interrupt manager feature IM. As previously mentioned, this feature is typically already present in the systems described herein (e.g., SoCs) and can be configured in a manner that enables the management of alarm signals and facilitates the application of appropriate measures against hacking, as previously described.

[0098] Figure 7 Replaced with a more sophisticated alarm management network 14' Figure 6 Examples of the possibilities for a simple OR gate 14 are shown.

[0099] Starting with a simple implementation based on EX-OR gates, this network 14' can include a logic network capable of processing alarm signals from specific areas / locations of the chip.

[0100] For example, the network can be configured (in a manner known to those skilled in the art) to assess the size of an attack HA and to enable users (implementers) to develop countermeasures commensurate with the size of the attack.

[0101] For example, a large-scale attack (high-energy) might "flip" dozens of trigger FFs, thus triggering multiple alerts, and a global system reset is employed as a countermeasure against such a large-scale attack.

[0102] Conversely, in the event of a limited attack, some peripheral deactivation / reset intervention measures can be taken as a countermeasure.

[0103] Figure 8 It is Figure 6 The example shown illustrates the possibility of extending the detector placement arrangement to multiple domains (such as...). Figure 7 (Modified from the example shown in this paper): It should be noted that this approach of extending to multiple domains also applies to other detector placement arrangements illustrated in this paper.

[0104] In this scenario of expansion to multiple domains, different alarms Alarm#1, Alarm#2, ..., Alarm#N (again, N can be a very large number) occurring in different areas / peripherals / subsystems can be managed in different ways (e.g., as mentioned earlier, as interrupts) using several different interrupt lines, and alarms can be collected in groups.

[0105] For example, this can be achieved via combinational logic (for simplicity, illustrated here as a hierarchical arrangement of OR gates, such as 201, 202, and 301), which is configured to generate a global alarm signal labeled Global_Alarm based on a combination of individual alarms Alarm#1, Alarm#2, ..., Alarm#N from various detectors 12.

[0106] Regardless of the specific implementation details (sensor 12, single / multiple domains, combination of alarms / interrupts, etc.), the solutions described in this paper enable users to implement their own chosen countermeasures in response to (maskable) anomalies triggered by hardware detection of attacks.

[0107] For example, users can configure the interrupt manager feature IM to implement (enforce) various countermeasures against detected hacking attacks, such as: keeping the chip in a reset state until the source of interference disappears; revoking (disabling) the use of a certain feature / service; initiating an erase operation to clear sensitive information present in certain registers or memory; and / or requesting the user to re-authenticate after the interference disappears.

[0108] Figure 9 This is a block diagram of a multi-core system-on-a-chip (SoC) architecture in which the solutions described in this article can be applied.

[0109] Figure 9 The architecture shown is an example of various systems, where a (higher) number of detectors 12 (e.g., with Figure 2 The structure shown can be distributed in various locations where hardware attacks (e.g., LEMA or LFIA) can be attempted.

[0110] like Figure 10 As shown, as a non-limiting example, the detector (sensor) 12 is distributed in the following locations:

[0111] Multiple memory cores MC#1, ..., MC#M are interfaced with an implementation definition attribute unit IDAU, which is configured to provide address lookup and generate security attributes for addresses accessed in memory cores MC#1, ..., MC#M with associated cache memories IC#, ..., IC#M;

[0112] The first bus matrix BUS-M#1 (Advanced High Performance BUS-AHB, Advanced Scalable BUS-AXI, or other types) is coupled to memory cores MC#1, ..., MC#M and cache memory IC#1, ..., IC#M via buses S-BUS and C-BUS; the first bus matrix BUS-M#1 works in conjunction with the second bus matrix BUS-M#2 (also AHB / AXI / other types) which manages flash memory FM via flash interface FI and other system circuitry typically denoted by SC, for example via a direct memory access (DMA) controller DMA-C, which is configured to facilitate low-latency data transfer between peripheral devices and memory;

[0113] Various peripheral domains, including AHB / AXI blocks AHB1_x / AXI_x, ..., AHB1_y / AXI_y (labeled PD#1, ..., PD#K), and groups of Advanced Peripheral Bus (APB) modules APB_1, ..., APB_Q coupled to them via bridges B_1, ..., B_Q (e.g., AHB2APB bridge).

[0114] same, Figure 9 The architecture shown is merely a non-limiting example of various systems in which detector 12 can be (very) widely distributed across locations exposed to hardware attacks.

[0115] Figure 10 This is an example of the possible (automatic) uniform placement / positioning of detector / sensor 12.

[0116] This can have very high densities, for example, around 7000 μm. 2 The system has five detectors on its surface area.

[0117] This placement can be based on an alternating parallel row configuration (often called a "quincunx" configuration), such as... Figure 10 As shown, it can be considered as being composed of basic units, each of which includes four sensors 12 located at the corners of a square with a side length of 85um and another fifth sensor 12 located at the center of the square.

[0118] Of course, these quantitative values ​​are merely exemplary and non-limiting: however, they demonstrate the possibility of “covering” the IC circuit with a very dense, uniformly distributed array of detectors 12, each detector having, for example, Figure 2 The structure shown.

[0119] For example, this is compatible with sea-of-gates architectures with standard processes, such as the TSMC40(G01) 40nm process offered by Taiwan Semiconductor Manufacturing Company.

[0120] Figure 11A , Figure 11B and Figure 11C Explained implementation Figure 2 Possible alternatives to the detector shown.

[0121] exist Figure 2 In the diagram, D flip-flops are exemplified for flip-flops 121 and 122 and are designed to act as sensors to detect a hacking attack HA (e.g., LEMA or LFIA) that could cause a voltage “bounce” that would cause flip-flops 121 and / or 122 to flip.

[0122] In fact, any type of trigger (FF) or latch can be used for detector / sensor 12. For example, SR trigger (such as...) Figure 11A As shown), JK flip-flops (such as...) Figure 11B (as shown) or a T flip-flop (such as Figure 11C (As shown) can be used to replace a D flip-flop (such as Figure 2 (As shown).

[0123] and Figure 2 Similar to the D-type FFs 121 and 122 shown, the inputs of these other types of FFs can be coupled to the power node / line VDD or ground (GND), which promotes increased sensitivity to any possible interference on VDD or GND.

[0124] These different types of triggers (e.g., D-type triggers, SR triggers, JK triggers, or T triggers) can exhibit the same sensitivity, but the flexibility that can be had in selecting the type of FF used can be advantageous, since the same type of FF or latch included in the block to be protected can be used for the detector / sensor 12 associated with that block.

[0125] Having the same type of FF or latch in detector / sensor 12 and in the block(s) to be protected helps to achieve matching between them: in fact, in response to including the same type of FF or latch, detector / sensor 12 can be expected to closely “mimic” the impact of a hacking attack on a part / area of ​​the circuit / system associated with detector / sensor 12.

[0126] The ability to design several detectors to spread across a circuit / system helps add testability features to hardware product designs using DFT (Design for Testability) techniques.

[0127] Distributing basic detector networks on integrated circuit packages allows for the consideration of various factors, resulting in a more refined / efficient distribution.

[0128] For example, only a few detectors (or even no detectors at all) may be provided in the pure combinatorial region of the circuit, while the detectors are distributed more densely near the FF region (which can be detected by back-end tools).

[0129] Without prejudice to the fundamental principles, details and embodiments may vary, even significantly, from what has been described by example only, without departing from the scope of protection.

[0130] The claims form an integral part of the disclosure provided herein with respect to embodiments.

[0131] The scope of protection is determined by the appended claims.

Claims

1. A method for detecting a hacking attack, the hacking attack involving a voltage change induced in an integrated circuit package, the method comprising: A basic detector network distributed on the integrated circuit package is provided, wherein each basic detector is arranged at a corresponding location on the integrated circuit package and is configured to generate an alarm signal in response to a voltage change at the corresponding location on the integrated circuit package.

2. The method of claim 1, wherein the basic detector network comprises: The first component and the second component, each component having an output configured to be set to a first logic level; as well as A logic circuit system coupled to the outputs of the first component and the second component, the logic circuit system being configured to generate the alarm signal in response to a change in at least one of the first logic levels at the outputs of the first component and the second component.

3. The method of claim 2, wherein the basic detector network comprises: The first flip-flop and the second flip-flop, each flip-flop having a corresponding output configured to be set to complementary binary levels; as well as An OR gate, having an input coupled to: The logically inverted copy of the output of the first flip-flop, and The output of the second trigger.

4. The method of claim 1, further comprising, in response to at least one of the basic detectors in the network generating the alarm signal, taking attack countermeasures, the attack countermeasures being selected from a countermeasures list, the countermeasures list including: The corresponding position of the integrated circuit package shall be kept in the reset state at least temporarily. The use of the corresponding location in the integrated circuit package should be prohibited at least temporarily; Initiate an erase operation to remove at least a portion of the corresponding location of the integrated circuit package; as well as Request the user to re-authenticate.

5. The method of claim 1, wherein the basic detector network includes a trigger configured to detect voltage changes by monitoring complementary binary levels at the output of the trigger.

6. The method of claim 5, wherein the basic detector network is configured to generate an alarm signal in response to a change in at least one of the complementary binary levels at the output of the trigger.

7. The method of claim 6, wherein the alarm signal generated by the basic detector is managed by a nested vector interrupt control (NVIC) block configured to prioritize interrupts based on the importance of the circuitry protected by the integrated circuit package.

8. The method of claim 1, wherein the basic detectors are distributed in an interleaved parallel row configuration, wherein each detector covers a predefined area of ​​the integrated circuit package.

9. The method of claim 1, wherein the basic detector is configured to operate without any clock or input signal, thereby not consuming dynamic power during operation.

10. The method of claim 1, wherein the basic detector is configured to detect voltage changes caused by an electromagnetic field or a laser beam.

11. The method of claim 1, wherein the basic detector is configured to mimic the behavior of a trigger in a circuit protected by the integrated circuit package to achieve matching sensitivity to hacking attacks.

12. An integrated circuit package configured to detect a hacking attack involving a voltage change induced within the integrated circuit package, the integrated circuit package comprising: A network of basic detectors distributed on the integrated circuit package, wherein each of the basic detectors is arranged at a corresponding location on the integrated circuit package and is configured to generate an alarm signal in response to a voltage change at the corresponding location on the integrated circuit package.

13. The integrated circuit package of claim 12, wherein the basic detector network comprises: The first component and the second component, each component having an output configured to be set to a first logic level; as well as A logic circuit system coupled to the outputs of the first component and the second component, the logic circuit system being configured to generate the alarm signal in response to a change in at least one of the first logic levels at the outputs of the first component and the second component.

14. The integrated circuit package of claim 13, wherein the basic detector network comprises: The first flip-flop and the second flip-flop, each flip-flop having a corresponding output configured to be set to complementary binary levels; as well as An OR gate having an input coupled to a logically inverted copy of the output of a first flip-flop and the output of a second flip-flop.

15. The integrated circuit package of claim 14, wherein the first flip-flop and the second flip-flop are selected from D flip-flops, SR flip-flops, JK flip-flops and / or T flip-flops.

16. The integrated circuit package of claim 12, further comprising an alarm management circuitry configured to manage alarm signals from the basic detector network distributed on the integrated circuit package.

17. The integrated circuit package of claim 16, wherein the alarm management circuitry includes a nested vector interrupt control NVIC block configured to manage alarm signals from the basic detector network as interrupt signals, the interrupt signals being candidates to be disabled or addressed with high priority.

18. The integrated circuit package of claim 16, wherein the alarm management circuitry is configured to take countermeasures based on alarm signals from the basic detector network distributed on the integrated circuit package, the countermeasures being selected from: The corresponding position of the integrated circuit package shall be kept in the reset state at least temporarily. The use of the corresponding location in the integrated circuit package should be prohibited at least temporarily; Initiate an erase operation to remove at least a portion of the corresponding location of the integrated circuit package; as well as Request the user to re-authenticate.

Images