Semiconductor integrated circuit, design and fabrication method, chip interlayer verification method

Abstract

This invention relates to the field of semiconductor integrated circuit security technology, and discloses semiconductor integrated circuits, design and fabrication methods, and inter-chip layer verification methods. In this semiconductor integrated circuit, a first PUF circuit is disposed in the first chip layer, and a second PUF circuit is disposed in the second chip layer. The output of the first PUF circuit serves as the input of the second PUF circuit, forming a cascaded physically unclonable function architecture. An interposer board includes an inter-layer interconnect interposer layer, in which real interconnect units and dummy interconnect units are disposed, increasing the difficulty of reverse engineering by obfuscating the inter-layer connection relationships. This invention, through multiple security mechanisms such as dual PUF cascade verification, obfuscation of real and dummy interconnects, and layered decomposition of logic circuits, can prevent chip cloning, reverse engineering, and supply chain attacks, thereby improving the security protection capabilities of integrated circuits.

Description

Technical Field

[0001] This invention relates to the field of semiconductor integrated circuit security technology, and in particular to semiconductor integrated circuits, design and fabrication methods, and inter-chip verification methods. Background Technology

[0002] In advanced packaging architectures such as 3D-IC and Chiplet, different functional modules often need to be manufactured by different companies. While this layered manufacturing model can reduce manufacturing costs and increase production flexibility, it also brings serious challenges to intellectual property protection. During the manufacturing process, all parties involved have the opportunity to access some design information, thereby increasing the risk of leakage of high-value intellectual property.

[0003] Traditional protection schemes primarily rely on logic encryption technology, which prevents unauthorized access to functions by inserting logic locks or encryption units into the circuit. However, these purely logic-level protection measures are often vulnerable to sophisticated chip reverse engineering attacks. Attackers can use advanced physical analysis techniques such as focused ion beams and electron beam probes to peel away the chip structure layer by layer and reconstruct the complete circuit topology, thereby bypassing logic encryption mechanisms.

[0004] Physically unclonable functions (PFCs), as a hardware security primitive based on the randomness of the manufacturing process, have been widely used in chip authentication and key generation in recent years. Existing PFC applications mainly focus on independent authentication scenarios for a single chip, where each chip independently generates an authentication response and completes verification. In layered 3D-IC architectures, since each layer of chips is manufactured by different manufacturers, this single-layer independent PFC verification mechanism cannot effectively prevent a single manufacturer from illegally using the layer information it possesses, nor can it establish effective security dependencies between multi-layer structures.

[0005] 3D-IC technology achieves vertical chip stacking and interlayer communication through interlayer interconnects such as through-silicon vias (TSVs) and micro-bumps. This three-dimensional physical structure offers new possibilities for security protection. However, current technologies have not fully utilized the physical structural characteristics of the 3D-IC architecture to build security mechanisms. In interlayer interconnect design, all interconnect units are typically real functional signal paths. Once an attacker identifies the cross-layer connections through physical analysis, they can deduce the logical connections between different layers and thus restore the complete circuit function.

[0006] Furthermore, existing security solutions often lack organic integration across multiple dimensions, such as circuit structure decomposition, physical layer shielding, and cross-layer activation mechanisms. Single-dimensional protection measures are easily breached by targeted attacks, while multi-dimensional protection technologies, if lacking coordination, are unlikely to form an effective overall defense system. In layered manufacturing scenarios, how to ensure that each manufacturer can only obtain partial information and that no single piece of information is sufficient to restore complete functionality, how to build sufficient obfuscation and shielding at the physical layer to resist reverse engineering, and how to establish cross-layer security dependencies so that full functionality can only be activated after final packaging—these problems have not yet been systematically solved in existing technologies. Summary of the Invention

[0007] The purpose of this invention is to provide semiconductor integrated circuits, design and fabrication methods, and chip interlayer verification methods to solve the technical problem of lacking an effective overall defense system.

[0008] To solve the above-mentioned technical problems, according to a first aspect of the present invention, a semiconductor integrated circuit is provided, comprising:

[0009] A first chip layer and a second chip layer, wherein a first PUF circuit is provided in the first chip layer and a second PUF circuit is provided in the second chip layer, and the output of the first PUF circuit is used as the input of the second PUF circuit;

[0010] An intermediate layer adapter board includes an interlayer interconnect intermediary layer for enabling connectivity between the first chip layer and the second chip layer. The interlayer interconnect intermediary layer has real interconnect units and dummy interconnect units.

[0011] Optionally, it also includes: an activation control unit, used to generate a verification key based on the outputs of the first PUF circuit and the second PUF circuit, and to control the activation state of the real interconnect unit according to the verification result.

[0012] Optionally, the first PUF circuit generates a first response value in response to the initial challenge value, the second PUF circuit generates a second response value in response to the first response value, and the activation control unit is used to generate the verification key by performing calculations on the first response value and the second response value, and compare the verification key with a pre-stored verification value. When the comparison is successful, the real interconnect unit is turned on.

[0013] Optional, also includes:

[0014] The first chip layer and the second chip layer each contain different subsets of logic circuits, and the subsets in the same chip layer are insufficient to implement the complete logic circuit function.

[0015] And / or, the dummy interconnect unit includes a conductive structure and an insulating layer disposed inside or at the bottom of the conductive structure;

[0016] And / or, the interlayer adapter plate further includes an interlayer shielding structure disposed on two opposite surfaces of the interlayer interconnect interlayer, the interlayer shielding structure comprising a randomly distributed metal pattern;

[0017] And / or, an attack detection unit, used to detect abnormal operations and trigger a protection response when an abnormal operation is detected.

[0018] According to a second aspect of the present invention, a method for designing a semiconductor integrated circuit is provided, comprising:

[0019] Identify circuit design data and generate design data corresponding to the first chip layer and the second chip layer. The first chip layer is provided with a first PUF circuit, and the second chip layer is provided with a second PUF circuit. The output of the first PUF circuit is used as the input of the second PUF circuit.

[0020] Interlayer interconnects are defined between the design data of the first chip layer and the second chip layer, and the interlayer interconnects include real interconnects and dummy interconnects.

[0021] Optionally, defining interlayer interconnects further includes: determining the distribution location of the dummy interconnects in the interlayer interface according to random or pseudo-random rules.

[0022] Optionally, the identification circuit design data, generating design data corresponding to the first chip layer and the second chip layer, includes:

[0023] Identify key circuit paths in circuit design data and split the key circuit paths into the first chip layer and the second chip layer.

[0024] Based on the splitting results, design data corresponding to the first chip layer and the second chip layer is generated;

[0025] Configure PUF circuits in the design data of the first chip layer and the second chip layer respectively;

[0026] Configure activation control logic to verify and activate the real interconnect based on the outputs of the first PUF circuit and the second PUF circuit.

[0027] Optionally, it also includes: generating interlayer shielding structure definitions.

[0028] According to a third aspect of the present invention, a method for fabricating a semiconductor integrated circuit is provided, comprising:

[0029] A first chip layer and a second chip layer are fabricated respectively. A first PUF circuit is formed in the first chip layer and a second PUF circuit is formed in the second chip layer. The output of the first PUF circuit is used as the input of the second PUF circuit.

[0030] A middle layer adapter board is prepared, including an interlayer interconnection middle layer, wherein real interconnection cells and dummy interconnection cells are formed in the interlayer interconnection middle layer;

[0031] The first chip layer and the second chip layer are bonded together using the interposer.

[0032] Optionally, the separate fabrication of the first chip layer and the second chip layer further includes: forming different subsets of logic circuits in each chip layer, wherein the subsets in the same chip layer are insufficient to realize the complete logic circuit function;

[0033] And / or, form an activation control unit for verifying and activating the real interconnect based on the outputs of the first PUF circuit and the second PUF circuit.

[0034] Optionally, the preparation of the interlayer adapter plate further includes: forming an interlayer shielding structure on two opposing surfaces of the interlayer interconnecting interlayer, the interlayer shielding structure comprising a randomly distributed metal pattern.

[0035] Optionally, the first chip layer and the second chip layer are fabricated in different factories.

[0036] According to a fourth aspect of the present invention, a chip interlayer verification method is provided, comprising:

[0037] Obtain initial challenge values;

[0038] The initial challenge value is input into the first PUF circuit of the first chip layer to generate a first response value;

[0039] The first response value is transmitted to the second chip layer and input into the second PUF circuit to generate the second response value;

[0040] A verification key is generated based on the first and second response values;

[0041] The electrical connection status between the chip layers is controlled based on the verification key.

[0042] Optionally, the step of generating a verification key based on the first response value and the second response value includes: performing an XOR operation, a concatenation operation, or a hash operation on the first response value and the second response value;

[0043] And / or, the step of controlling the electrical connection state between chip layers according to the verification key includes: comparing the verification key with a pre-stored verification value;

[0044] When the comparison is successful, an effective electrical connection is established between the chip layers;

[0045] If the comparison fails, disconnect or keep disconnected the electrical connection between the chip layers, or trigger a protection response.

[0046] Compared with the prior art, the present invention has at least the following technical effects:

[0047] On the one hand, this invention constructs a cascaded physically unclonable function architecture by setting a first PUF circuit and a second PUF circuit in the first chip layer and the second chip layer respectively, and using the output of the first PUF circuit as the input of the second PUF circuit, significantly improving security protection capabilities. On the other hand, the interlayer interconnection intermediate layer in the intermediate layer adapter board simultaneously sets up real interconnect units and dummy interconnect units, making the interlayer connection relationships appear confused. Attackers find it difficult to accurately identify which interconnect units are real and valid electrical connections and which are dummy structures used for deception, thereby increasing the difficulty and cost of reverse engineering.

[0048] Furthermore, this invention implements a dynamic access control mechanism based on dual PUF verification by setting up an activation control unit. The activation control unit calculates a verification key by processing the first and second response values ​​and compares it with a pre-stored verification value. Only when the verification passes can the real interconnect unit be activated, establishing an effective electrical connection between chip layers. This invention also designs a subset of logic circuits in the same chip layer to be insufficient to achieve the complete function, further enhancing the protection effect. Even if an attacker obtains the design information of a single chip layer, they cannot understand the complete circuit function or perform effective functional replication. The insulating layer set inside or at the bottom of the fake interconnect unit, the randomly distributed metal patterns in the inter-layer shielding structure, and the combined use of the attack detection unit constitute a multi-layered, three-dimensional active defense system that can promptly trigger a protection response when abnormal operation is detected, minimizing the risk of sensitive information leakage.

[0049] On the other hand, the design method provided by this invention, by planning the real and spurious distribution of inter-layer interconnections during the design phase, ensures that the security protection mechanism is implemented from the source of chip design, avoiding the limitations of later remedial measures. The strategy of identifying critical circuit paths and splitting them into different chip layers ensures that even if some design data is leaked, the complete core functional implementation will not be exposed. Furthermore, the fabrication method supports the separate fabrication of each chip layer by different factories. This decentralized manufacturing model significantly reduces the risk of a single manufacturing stage having complete control over chip design information, making it particularly suitable for chip products with extremely high security requirements. The inter-layer verification method provides a flexible verification key generation method, which can disconnect inter-layer electrical connections or trigger protection responses in the event of verification failure, achieving hardware-level access control and offering higher reliability and resistance to attacks compared to pure software verification schemes. Attached Figure Description

[0050] Figure 1 This is a schematic diagram of the structure of a semiconductor integrated circuit in an embodiment of the present invention;

[0051] Figure 2 This is a schematic diagram of the interlayer shielding structure in an embodiment of the present invention;

[0052] Figure 3 This is another schematic diagram of the structure of a semiconductor integrated circuit in an embodiment of the present invention;

[0053] Figure 4 This is a schematic diagram of the semiconductor integrated circuit design method in an embodiment of the present invention;

[0054] Figure 5 This is a schematic diagram of the key verification and activation steps in an embodiment of the present invention;

[0055] Figure 6 This is another flowchart illustrating the semiconductor integrated circuit design method in an embodiment of the present invention;

[0056] Figure 7 This is a schematic diagram of the semiconductor integrated circuit fabrication method in an embodiment of the present invention;

[0057] Figure 8 This is a schematic diagram of the chip interlayer verification method in an embodiment of the present invention.

[0058] In the figure, 1 is the interlayer interconnection interposer; 11 is the real interconnection cell; 12 is the dummy interconnection cell; 2 is the interlayer shielding structure; and 21 is the TSV via. Detailed Implementation

[0059] The following description, with reference to schematic diagrams, illustrates the semiconductor integrated circuit, design and fabrication method, and inter-chip verification method of the present invention. Preferred embodiments of the invention are shown. It should be understood that those skilled in the art can modify the invention described herein while still achieving its advantageous effects. Therefore, the following description should be understood as being of general knowledge to those skilled in the art and is not intended to limit the invention.

[0060] Based on the teachings of this specification, those skilled in the art can form new technical solutions by combining different implementation methods without creating technical contradictions. Such variations should be considered to fall within the protection scope of this application.

[0061] The invention is described more specifically by way of example in the following paragraphs with reference to the accompanying drawings. The advantages and features of the invention will become clearer from the following description. It should be noted that the drawings are in a very simplified form and use non-precise proportions, and are only used to facilitate and clarify the illustration of the embodiments of the invention.

[0062] Example 1

[0063] This embodiment provides a semiconductor integrated circuit; please refer to [reference needed]. Figure 1 It includes a first chip layer (Die A), a second chip layer (Die B), and an interposer board.

[0064] The first chip layer has a first PUF circuit, and the second chip layer has a second PUF circuit. The output of the first PUF circuit is used as the input of the second PUF circuit.

[0065] The interlayer adapter board includes an interlayer interconnection interlayer 1 for enabling the connection between the first chip layer and the second chip layer. The interlayer interconnection interlayer 1 has real interconnection units 11 and dummy interconnection units 12. The real interconnection units 11 are used to transmit valid signals, and the dummy interconnection units 12 do not form a valid electrical connection.

[0066] Specifically, the semiconductor integrated circuit includes at least two vertically stacked chip layers, including a first chip layer and a second chip layer. The first chip layer and the second chip layer are electrically connected through an interlayer interconnection layer 1.

[0067] In one specific example, the first chip layer may be a bottom chip, including front-end transistor fabrication (FEOL) and a partial metal interconnect layer; the second chip layer may be a top chip, including back-end metal interconnect fabrication (BEOL) and other functional circuits. The vertical stacking of the two chip layers is achieved by methods commonly used by those skilled in the art, such as hybrid bonding or micro-bumping.

[0068] In the following description, "PUF circuit" refers to a circuit that includes both a first PUT circuit and a second PUF circuit.

[0069] Specifically, PUF circuits utilize unavoidable random variations in the manufacturing process, such as transistor threshold voltage and interconnect delays, to generate unique and unpredictable response values ​​for the chip.

[0070] In a specific example, the PUF circuit can employ various known PUF structures such as SRAM PUF, Ring Oscillator PUF, and Arbiter PUF. The specific implementation circuit of the PUF circuit is a common practice among those skilled in the art and will not be described in detail here.

[0071] Furthermore, the actual interconnect unit 11 is used to transmit valid signals. The actual interconnect unit 11 physically forms a complete conductive path from the first chip layer to the second chip layer. In a specific example, the actual interconnect unit 11 can be implemented using a through-silicon via (TSV). The actual interconnect unit 11 includes a conductive via penetrating the silicon substrate, the conductive via being filled with a conductive material (such as copper or tungsten), and the sidewalls of the conductive via being provided with an insulating liner (such as silicon oxide) to prevent electrical short circuits between the conductive material and the silicon substrate.

[0072] The dummy interconnect unit 12 is similar to the real interconnect unit 11 in appearance and some electrical parameters, but does not form an effective electrical connection. In this embodiment, the dummy interconnect unit 12 provides a structural basis for solving the technical problem of identifying the real signal path through physical detection in reverse engineering.

[0073] The dummy interconnect unit 12 includes a conductive structure and an insulating layer disposed within the conductive structure. Specifically:

[0074] The conductive structure is substantially identical in physical dimensions and material composition to the conductive structure of the real interconnect unit 11. In a specific example, the conductive structure of the dummy interconnect unit 12 is also a through-hole penetrating the silicon substrate, filled with the same conductive material (such as copper), with the hole diameter differing from that of the real TSV by within ±10% and being different, while the depth is substantially the same. The sidewalls of the conductive structure are also provided with an insulating liner.

[0075] By controlling the aperture, metal fill thickness, and geometry of the dummy interconnect unit 12, the difference between the capacitance value of the dummy interconnect unit 12 and the capacitance value of the real interconnect unit 11 is controlled within a preset threshold range and is distinct from each other. In a specific example, the preset threshold range is within ±15%, preferably within ±10%. This similarity in electrical parameters makes it difficult for external attackers to distinguish between the dummy interconnect unit 12 and the real interconnect unit 11 through capacitance measurement, impedance analysis, or other non-invasive probing methods.

[0076] The insulating layer can also be disposed inside or at the bottom of the conductive structure, physically blocking the conduction path of the dummy interconnect unit 12.

[0077] In one specific example, the insulating layer is disposed at the bottom of the dummy interconnect unit 12, 5-10 micrometers away from the bottom metal pad. The insulating layer is made of silicon oxide or silicon nitride. The dummy interconnect unit 12 is difficult to distinguish from the real interconnect unit 11 in top view and cross-sectional imaging, but is completely non-conductive.

[0078] In another specific example, the insulating layer can be disposed in the middle of the conductive structure, as long as it can effectively block the current path.

[0079] To enhance the obfuscation effect, the electrical parameters of the dummy interconnect unit 12 are not limited to capacitance, but may also include parameters such as resistance and inductance. By controlling the geometric dimensions, metal fill rate, and insulating layer position of the dummy interconnect unit 12, it is made similar to the real interconnect unit 11 in multiple dimensions such as low-frequency impedance, high-frequency response, and parasitic capacitance.

[0080] Furthermore, in the interlayer interconnection intermediary layer 1, the dummy interconnection unit 12 and the real interconnection unit 11 are mixed and distributed.

[0081] In one specific example, the number of dummy interconnect units 12 accounts for 20% to 50% of the total number of dummy interconnect units 12 and real interconnect units 11 in the interlayer interconnection intermediary layer 1.

[0082] The distribution of the dummy interconnect units 12 in the interlayer interconnection intermediate layer 1 is determined according to random or pseudo-random rules.

[0083] In a specific example, a pseudo-random number generator is used to generate the coordinate positions of the fake interconnect unit 12 with a preset seed value. This random distribution makes it impossible for an external attacker to infer which are the real signal paths based on the spatial distribution pattern, even if all TSVs have been physically mapped.

[0084] In this embodiment, the unauthorized party cannot generate the correct verification key on its own, and even if the reverse engineer completes the physical structure mapping, it will not be able to identify the real signal path.

[0085] For further details, please refer to... Figure 3 The semiconductor integrated circuit also includes an activation control unit, which is used to generate a verification key based on the outputs of the first PUF circuit and the second PUF circuit, and control the activation state of the real interconnect unit 11 according to the verification result.

[0086] Furthermore, the activation control unit is used to generate the verification key by performing calculations on the first response value and the second response value, and compare the verification key with the pre-stored verification value. When the comparison is successful, the real interconnection unit 11 is turned on.

[0087] Specifically, the activation control unit includes a key generation module, a key verification module, and an interconnection control module. The key generation module collects PUF responses from each chip layer and performs calculations to generate the verification key. The key verification module compares the verification key with a pre-stored verification value. The interconnection control module controls the conduction state of the actual interconnection unit 11 based on the verification result.

[0088] In one specific example, the activation control unit is located in the hardware circuit modules of the first chip layer and the second chip layer, and may include control logic, comparators, memory, and switch arrays, etc. The activation control unit may also be partially implemented as a microcode program embedded in read-only memory (ROM).

[0089] The activation control unit is used to compare the verification key with the pre-stored verification value, and when the comparison is successful, it enables the real interconnection unit 11 to be turned on.

[0090] The pre-stored verification value is generated in a trusted and secure environment after chip manufacturing and 3D stacking packaging. Specifically, during the testing phase, a complete PUF response chain generation process is executed to obtain the correct verification key. This verification key or its hash value is then used as the pre-stored verification value and burned into a one-time programmable memory (OTP) or an electronic fuse (eFuse). The one-time programmable memory ensures that the pre-stored verification value cannot be tampered with once written.

[0091] When the semiconductor integrated circuit is powered on, the activation control unit triggers a PUF response chain generation process to generate the current verification key. The key verification module reads the pre-stored verification value from the one-time programmable memory and compares the currently generated verification key with the pre-stored verification value bit by bit.

[0092] In a specific example, the comparison uses a full match method, meaning that all bits of the verification key must be exactly the same as the pre-stored verification value for the comparison to be considered successful.

[0093] When the comparison is successful, the activation control unit sends an unlock signal, and the interconnection control module responds to the unlock signal to turn on the real interconnection unit 11.

[0094] Specifically, the interconnection control module controls the gating switches or multiplexers set on the path of the actual interconnection unit 11 to connect the actual interconnection unit 11 to a valid signal node, establishing a complete cross-layer signal transmission path. At this time, the semiconductor integrated circuit enters a full-function operation mode, and all functional circuits operate normally.

[0095] When the comparison fails, the activation control unit keeps the actual interconnect unit 11 inactive or triggers a protection response. In this case, the semiconductor integrated circuit cannot perform its full function, and critical circuit paths are not conductive, thereby preventing unauthorized use or reverse engineering.

[0096] In a specific example, after the activation control unit verifies and activates the real interconnect unit 11, it can further perform a fake interconnect disconnection operation.

[0097] In this embodiment, a cross-layer PUF interlocking mechanism is adopted, combined with activation control based on verification keys, to achieve a deep integration of physical layer obfuscation and cryptographic authentication. Only authorized paired chip layer combinations can pass verification and activation.

[0098] In a specific example, unlike the prior art where each chip layer's PUF circuit works independently and generates verification keys separately, in this invention, the output of the first PUF circuit serves as the input of the second PUF circuit, forming a chain dependency relationship. Specifically, this includes the following steps:

[0099] Step 1: Initial Challenge.

[0100] The first PUF circuit PUF-A generates a first response value in response to the initial challenge value. The initial challenge value (C0) can be generated by the activation control unit or pre-stored in non-volatile memory.

[0101] The first PUF circuit PUF-A receives the initial challenge value C0 as input and generates the first response value (PA) based on the physical characteristics of the PUF-A, where PA = PUFA(C0). The generation process of the first response value reflects the manufacturing variation characteristics of the first chip layer and is unique and cannot be cloned.

[0102] Step 2: Cross-layer transmission.

[0103] The first response value PA is transmitted to the second chip layer via a specific cross-layer signal line. The cross-layer signal line is part of the actual interconnect unit 11 and is a signal path that has been verified as reliably conductive after manufacturing.

[0104] Step 3: Chain response generation.

[0105] The PUF-B generates a second response value PB in response to the first response value PA. Specifically, the PUF-B receives PA as its input challenge value and generates the second response value PB based on the physical characteristics of the PUF-B.

[0106] In a specific example, the PUF-B can directly use the PA as the challenge value, i.e., PB = PUFB(PA).

[0107] In another specific example, the PUF-B can use the XOR operation between PA and the locally generated challenge value as input, i.e., PB = PUFB(PA ⊕ C1), where C1 is the challenge value locally generated by the second chip layer.

[0108] Step 4: Verification key generation.

[0109] The activation control unit generates the verification key by performing operations on PA and PB. These operations include, but are not limited to, cascading operations, hash operations, and XOR operations.

[0110] In a specific example, the activation control unit first concatenates PA and PB to form a joint response value: R = PA || PB, where "||" indicates the concatenation operation. Then, it performs a hash operation on the joint response value to generate the verification key: K = Hash(PA || PB). The hash function can employ cryptographically secure hash algorithms such as SHA-256 or SHA-3.

[0111] In another specific example, if the semiconductor integrated circuit comprises three or more chip layers, a multi-level interlocking link can be formed. For example, the PUF circuit (PUF-C) of the third chip layer receives the second response value PB as input and generates a third response value PC = PUFC(PB). The verification key is then generated based on the response values ​​of all layers: K = Hash(PA|| PB || PC).

[0112] In this embodiment, since the verification key must be generated simultaneously based on the PUF responses of multiple chip layers, even if a single manufacturer fully understands the structure and PUF characteristics of the chip layers it manufactures, it cannot generate the correct verification key independently. This is because the generation of the second response value depends on the first response value, and the first response value can only be generated by the first chip layer after actual manufacturing is completed, and cannot be predicted in advance.

[0113] The cross-layer interlocking mechanism ensures that only authorized paired chip layer combinations can pass verification. If an attacker attempts to replace one of the layers with a forged chip layer, due to the non-cloning nature of PUF, the forged layer cannot generate the same response value as the original layer, resulting in an incorrect verification key and activation failure.

[0114] Even if an attacker obtains the PUF circuit structure of each chip layer through physical analysis, the attacker still cannot predict the PUF output because the PUF response value depends on manufacturing variations rather than circuit topology. The aforementioned cross-layer interlocking mechanism further increases the difficulty of the attack.

[0115] Furthermore, the first and second chip layers each contain different subsets of logic circuits, and the subsets within the same chip layer are insufficient to implement the complete logic circuit function. The first and second chip layers each contain subsets of different functional circuits. These subsets of functional circuits are formed by splitting the critical circuit paths in the original circuit design. This splitting ensures that no single chip layer is sufficient to implement the complete circuit function on its own.

[0116] This embodiment addresses the technical problem of a single manufacturer potentially obtaining complete information in a layered manufacturing scenario. By allocating key logic gates and interconnect paths to different physical layers, even if a manufacturer obtains all the information about the chip layer it manufactures, it cannot deduce the complete circuit's function and implementation details.

[0117] Furthermore, in this embodiment, the intermediary layer adapter board also includes an interlayer shielding structure 2 disposed on the two opposite surfaces of the interlayer interconnection intermediary layer 1. The interlayer shielding structure 2 is a physical protection layer for the interlayer interconnection intermediary layer 1, used to enhance the resistance to physical attacks.

[0118] The interlayer shielding structure 2 includes randomly distributed metal patterns. These metal patterns form a two-dimensional grid or checkerboard structure covering the spaces between the chip layers. The material of the metal patterns is aluminum, copper, or other conductive metals.

[0119] For a specific example, please refer to Figure 2The metal pattern is a closed metal mesh, consisting of mesh lines and mesh nodes. The mesh linewidth varies randomly within the range of 100 nanometers to create unpredictable electromagnetic reflections.

[0120] Preferably, the grid line width is determined at each position using a pseudo-random number generator, so that the metal pattern does not exhibit regular geometric features.

[0121] The metal pattern does not participate in the functional signal transmission of the semiconductor integrated circuit, but is electrically connected to a reference potential node (such as a ground network VSS or a power network VDD) to form a virtual ground network or a virtual power network. This connection method enables the metal pattern to have a stable potential, shields against electromagnetic interference, and produces detectable changes in electrical characteristics when subjected to physical probing.

[0122] For a specific example, please refer to Figure 2 The metal pattern includes openings or TSV vias 21 that allow the real interconnect units 11 and the dummy interconnect units 12 to pass through, but the distribution of the openings or TSV vias 21 does not directly expose which are the real interconnect units 11.

[0123] In a specific example, the interlayer shielding structure 2 can be configured as a double-layer or multi-layer nested structure to further enhance the shielding effect. For example, a first shielding layer and a second shielding layer are provided between the first chip layer and the second chip layer. The metal patterns of the first shielding layer and the second shielding layer are generated using different random seeds, so that the two shielding patterns do not overlap, forming an interlaced double barrier.

[0124] In this embodiment, please continue to refer to Figure 3 The semiconductor integrated circuit also includes an attack detection unit for detecting abnormal operations and triggering a protection response when an abnormal operation is detected.

[0125] In a specific example, the abnormal operation includes, but is not limited to, the following:

[0126] 1. Physical intrusion signals.

[0127] Chip package integrity is detected by sensors disposed on the chip surface or in the interlayer shielding structure 2. In a specific example, the sensor is a metal mesh sensor, forming a dense network of wires covering the sensitive area. Any attempt to open the package, remove the passivation layer, or access the internal circuitry will disrupt the continuity of the metal mesh, causing a sudden change in sensor resistance or an open circuit, which will be detected as a physical intrusion.

[0128] 2. Abnormal electrical parameters.

[0129] The attack detection unit monitors the electrical parameters of the inter-layer interconnection interposer 1 in real time, including capacitance, resistance, and current consumption. In a specific example, the attack detection unit periodically performs capacitance measurements on the real interconnection unit 11 and the fake interconnection unit 12, and compares the measured values ​​with expected values.

[0130] When a local capacitance anomaly is detected (e.g., the capacitance value of a certain TSV suddenly increases or decreases beyond a preset threshold), it is determined that there may be FIB etching, probe contact, or other physical interference, triggering a protection response. The preset threshold can be set to ±20% or adjusted according to the specific design.

[0131] 3. Timing anomaly.

[0132] By monitoring the timing characteristics of the circuit, the system detects the presence of laser fault injection or clock glitches. In a specific example, the attack detection unit includes multiple ring oscillators or delay chains distributed at different locations to measure the propagation delay of critical signal paths in real time. When a sudden shortening or lengthening of the delay beyond the normal fluctuation range is detected, a timing attack is determined to exist.

[0133] 4. Abnormal power supply and temperature.

[0134] The system monitors abnormal fluctuations in power supply voltage and chip temperature. Attacks such as laser irradiation and high-energy probe contact can cause a sharp increase in local temperature or an abnormal increase in power supply current. The attack detection unit uses temperature sensors and current monitoring circuitry to detect these anomalies in real time.

[0135] Furthermore, when the attack detection unit detects an abnormal operation, it triggers a protection response. The protection response includes, but is not limited to, the following:

[0136] 1. Lock immediately.

[0137] The activation control unit immediately disconnects the actual interconnect unit 11, causing the semiconductor integrated circuit to enter a non-functional state. Specifically, the interconnect control module cuts off the connection between the actual interconnect unit 11 and the signal node.

[0138] 2. Data clearing.

[0139] Sensitive data stored in volatile memory (such as the verification key, intermediate calculation results, etc.) will be immediately cleared.

[0140] 3. The fuse burned out.

[0141] By blowing the electronic fuse on the critical path, the circuit's functionality is permanently destroyed. This protective response is irreversible, ensuring that even if an attacker subsequently attempts to restore it, the chip will no longer function properly.

[0142] 4. Trap path activated.

[0143] It directs pre-designed fake logic units or trap circuits to output random or misleading results.

[0144] 5. Downgrade operation.

[0145] Keep non-sensitive functional modules operational, but disable core functions or critical IP modules. This approach is suitable for scenarios that require maintaining basic chip availability while preventing the leakage of core technologies.

[0146] In a specific example, the protection response can employ a multi-level strategy: when a minor anomaly is detected for the first time, the event is recorded and the monitoring intensity is increased; when an anomaly is detected again, a degraded operation mode is entered; when a third anomaly is detected or a serious anomaly is detected, immediate locking or fuse blowing is performed.

[0147] In a specific example, the attack detection unit can be implemented as an architecture combining a distributed sensor network and centralized decision logic. The sensors include metal mesh sensors, temperature sensors, current monitoring circuits, capacitance measurement circuits, timing monitoring circuits, etc., distributed at different locations on the chip layer. The decision logic is integrated into the activation control unit or implemented as a separate security monitoring module, responsible for collecting data from each sensor, making a comprehensive judgment, and triggering corresponding protection responses.

[0148] In summary, this invention's semiconductor integrated circuit systematically integrates multi-layered security features such as the implementation of spurious interconnects, detailed mechanisms of cross-layer PUF interlocking, a complete activation verification process, inter-layer randomized shielding structures, real-time attack detection, and cross-layer decomposition of functional circuits. This constructs a comprehensive IP protection system covering the physical, structural, algorithmic, and detection layers. It not only increases the time cost of physical reverse engineering through spurious interconnects and randomized shielding layers, but also achieves chip-level binding authentication through cross-layer PUF interlocking. Combined with the attack detection unit's real-time monitoring and protection response to various attack methods, it ensures that even if attackers invest significant resources to attempt to simultaneously breach multiple layers of protection, they will find it difficult to succeed.

[0149] Example 2

[0150] This embodiment provides a design method for a semiconductor integrated circuit, which can be used to implement the semiconductor integrated circuit design described in Embodiment 1. Figure 4 As shown, the design method includes the following steps:

[0151] S11. Identify the circuit design data and generate design data corresponding to the first chip layer and the second chip layer. The first chip layer is provided with a first PUF circuit, and the second chip layer is provided with a second PUF circuit. The output of the first PUF circuit is used as the input of the second PUF circuit.

[0152] S12. Define interlayer interconnects between the design data of the first chip layer and the second chip layer, wherein the interlayer interconnects include real interconnects and dummy interconnects.

[0153] Specifically, in step S11, the circuit design data includes the complete functional logic that the semiconductor integrated circuit needs to implement.

[0154] Step S11 includes: Step S111, identifying key circuit paths in the circuit design data, and splitting the key circuit paths into the first chip layer and the second chip layer.

[0155] The goal of this splitting is to make each chip layer insufficient to achieve complete circuit functionality on its own.

[0156] In a specific example, static timing analysis (STA) is performed on the circuit design data to identify the critical circuit paths. These critical circuit paths refer to signal paths that are essential to the circuit's function or performance, including critical timing paths (such as the longest delay path and the shortest delay path), core algorithm logic paths, and sensitive control signal paths.

[0157] In another specific example, timing analysis tools (such as PrimeTime, Tempus, etc.) are used to mark paths with timing margins less than a preset threshold as critical paths. Functional analysis can also be used to identify the combinations of logic gates implementing the core IP algorithm, and the paths involving these logic gates can be marked as critical paths.

[0158] It also includes step S112, generating design data corresponding to the first chip layer and the second chip layer based on the splitting result.

[0159] The design data for the first chip layer includes logic gates, interconnects, and input / output port definitions allocated to the first chip layer. The design data for the second chip layer includes logic gates, interconnects, and input / output port definitions allocated to the second chip layer.

[0160] In the design data, the severed signal paths are marked as signals that require cross-layer connections. These signals will be connected in subsequent steps via the interlayer interconnection intermediary layer 1.

[0161] Furthermore, it also includes step S113, configuring PUF circuits in the design data of the first chip layer and the second chip layer respectively, wherein the output of the first PUF circuit of the first chip layer is used as the input of the second PUF circuit of the second chip layer.

[0162] Specifically, step S113 includes step S1131, inserting a first PUF circuit into the design data of the first chip layer. The input of the first PUF circuit is connected to an initial challenge value source (such as a random number generator or a pre-stored value), and the output is connected to a cross-layer signal line to transmit the first response value to the second chip layer.

[0163] The method also includes step S1132, inserting a second PUF circuit into the design data of the second chip layer. The input of the second PUF circuit is connected to the cross-layer signal line from the first chip layer, receiving the first response value as input. The output of the second PUF circuit is connected to the activation control unit, providing the second response value to the key generation module.

[0164] The insertion location of the PUF circuit is chosen in a high-security area of ​​the circuit layout, avoiding locations near the chip edge or vulnerable to physical attacks. In a specific example, the PUF circuit is placed in the central area of ​​the chip, surrounded by a shielding layer and sensors to enhance protection.

[0165] It also includes step S1133, configuring the interlocking relationship between the PUF circuits. The signal flow is explicitly defined in the design data: output of the first PUF circuit → input of the second PUF circuit → output of the second PUF circuit → activation control unit.

[0166] Furthermore, step S11 also includes step S114, configuring activation control logic for verifying and activating the real interconnect based on the outputs of the first PUF circuit and the second PUF circuit.

[0167] For details, please refer to Figure 5 The first response value and the second response value generate the verification key, which is then compared with the pre-stored verification value. Based on the comparison result, it is determined whether the verification passes. The conduction state of the actual interconnect is controlled according to the verification result. When verification passes, the control signal generation circuit outputs an activation signal, and the switch array responds to the activation signal by closing the corresponding switch, thus enabling the actual interconnect to conduct. When verification fails, the switch array remains open, and the actual interconnect remains inactive.

[0168] Step S12 specifically includes step S121, which identifies signals that need to be transmitted across layers based on the splitting results in S11.

[0169] For each severed signal path, a transmit port and a receive port are defined in the design data of the first chip layer and the second chip layer, respectively, and the actual interconnect connecting these two ports is defined.

[0170] In a specific example, the definition of the actual interconnect includes: the starting coordinates of the connection, the ending coordinates, the signal type (such as digital signal, clock signal, power signal, etc.), and the electrical parameter requirements (such as maximum capacitance, maximum resistance, etc.).

[0171] Furthermore, the process includes step S122, generating a dummy interconnect definition. The dummy interconnect is physically similar to the real interconnect, but does not form a valid conductive path.

[0172] The method also includes step S123, determining the number of dummy interconnects. In a specific example, the number of dummy interconnects is set to a certain percentage of the number of real interconnects, for example, 30% to 100%. That is, if there are 100 real interconnects, then 30 to 100 dummy interconnects are generated.

[0173] The method also includes step S124, determining the distribution location of the spurious interconnects in the cross-layer interface according to random or pseudo-random rules. In a specific example, a pseudo-random number generator is used to generate the X and Y coordinates of the spurious interconnects with a preset seed value. The location distribution of the spurious interconnects is mixed with the location distribution of the real interconnects, making it impossible to distinguish between real and spurious interconnects by spatial distribution patterns when viewed from above or in cross-section.

[0174] When generating the locations, ensure that the dummy interconnects maintain a minimum spacing (e.g., 2 micrometers or more) between them and the real interconnects to avoid mutual interference during the manufacturing process. Simultaneously, avoid dummy interconnects aligning with critical nodes of other functional circuits to prevent accidental electrical connections.

[0175] The process also includes step S125, defining electrical parameters for the dummy interconnect that are similar to those for the real interconnect. Specifically, the geometric and material parameters of the dummy interconnect, such as aperture, depth, and filling material, are consistent with or vary within a preset range from those of the real interconnect. It is ensured that the differences between the corresponding parameters and those of the real interconnect are within a preset threshold range (e.g., ±10% to ±15%).

[0176] The method also includes step S126, configuring an insulating structure in the definition of the spurious interconnect so that the spurious interconnect does not form a valid conductive path. The configuration of the insulating structure includes: specifying the insertion position of the insulating layer (e.g., the bottom, top, or middle of the conductive structure), the material of the insulating layer (e.g., SiO2, Si3N4), and the thickness of the insulating layer (e.g., 50-200 nanometers).

[0177] The insertion position of the insulating layer can vary between different spurious interconnects, further increasing the obfuscation effect. In one specific example, 70% of the insulating layers for the spurious interconnects are located at the bottom, 20% in the middle, and 10% at the top.

[0178] For further details, please refer to... Figure 6 It also includes step S13, generating the definition of interlayer shielding structure 2.

[0179] Specifically, the layout of the metal pattern is generated using a random or pseudo-random algorithm.

[0180] In one specific example, an opening or TSV via 21 is defined in the metal pattern, allowing the real interconnect and the dummy interconnect to pass through. The position of the opening or TSV via 21 corresponds to the coordinates of the real interconnect and the dummy interconnect.

[0181] Furthermore, it also includes step S14, outputting design data.

[0182] The design data for the first chip layer and the design data for the second chip layer are output as separate files for subsequent tape-out manufacturing. The design data for the first chip layer is given to a first manufacturer, and the design data for the second chip layer is given to a second manufacturer. In the subsequent layered manufacturing process, each manufacturer can only obtain the design data for the chip layer it is responsible for manufacturing and cannot access information from other chip layers. Because the critical circuit paths have been split, a single manufacturer cannot recover the complete circuit function from the design data it possesses.

[0183] Example 3

[0184] This embodiment provides a method for fabricating a semiconductor integrated circuit, such as... Figure 7 As shown, it can be used to prepare the semiconductor integrated circuit provided in Example 1, and can also be used to implement the manufacturing process of Example 2. The preparation method specifically includes the following steps:

[0185] S21. A first PUF circuit is formed on a first chip layer and a second chip layer respectively. A first PUF circuit is formed on the first chip layer and a second PUF circuit is formed on the second chip layer. The output of the first PUF circuit is used as the input of the second PUF circuit.

[0186] S22. Prepare an intermediary layer adapter board, including an interlayer interconnection intermediary layer, wherein real interconnection cells and dummy interconnection cells are formed in the interlayer interconnection intermediary layer;

[0187] S23. The first chip layer and the second chip layer are bonded together using the intermediary layer adapter.

[0188] In step S21, each chip layer is prepared using standard semiconductor manufacturing processes, which are common practices for those skilled in the art and will not be described in detail here.

[0189] In a specific example, the fabricated first chip layer includes: a bottom shielding structure, a logic circuit layer, a first PUF circuit, and a bonding pad structure for connection with an interposer board.

[0190] The second chip layer includes: a logic circuit layer, a second PUF circuit, and a bonding pad structure for connection with the interposer board.

[0191] During the fabrication of each chip layer, PUF circuits are also integrated. The first PUF circuit of the first chip layer is configured to receive an initial challenge value and generate a first response value, and the second PUF circuit of the second chip layer is configured to receive the first response value as a challenge value and generate a second response value. The specific implementation of the PUF circuit can employ a ring oscillator PUF, an arbitrator PUF, an SRAM PUF, or other types of PUF structures.

[0192] Furthermore, step S21 includes step S211, forming different subsets of logic circuits in each chip layer, wherein the subsets in the same chip layer are insufficient to realize the complete logic circuit function.

[0193] In a specific example, the at least two chip layers each contain subsets of different functional circuits. Specifically, the complete circuit function is divided into multiple subsets, each implementing a partial function and fabricated in a different chip layer. For example, the first chip layer contains digital logic circuits and control circuits, while the second chip layer contains analog circuits and memory circuits. Each subset alone is insufficient to implement the complete circuit function; only by combining multiple chip layers through inter-layer interconnects can a complete functional system be formed. This functional decomposition design increases the difficulty of reverse engineering and improves circuit security.

[0194] In one specific example, the at least two chip layers are fabricated by different manufacturing plants. The first chip layer can be fabricated by manufacturing plant A, and the second chip layer can be fabricated by manufacturing plant B. Since each chip layer only contains partial functional circuitry, a single manufacturing plant cannot obtain complete circuit design information, thereby reducing the risk of intellectual property leakage. Different manufacturing plants can also employ different process nodes or technology platforms to achieve heterogeneous integration and fully leverage the advantages of each process.

[0195] Furthermore, step S21 also includes step S212, forming an activation control unit for verifying and activating the real interconnect based on the outputs of the first PUF circuit and the second PUF circuit.

[0196] In a specific example, the activation control unit may be located in the hardware circuit module of the first chip layer or the second chip layer.

[0197] Specifically, in step S22, the real interconnect unit 11 is used to transmit valid signals between chip layers, realizing electrical and functional connections. The real interconnect unit 11 can be formed using at least one of the following techniques:

[0198] Hybrid bonding, micro-bumps, through-silicon vias (TSVs), or copper pillars.

[0199] The dummy interconnect unit 12 is similar in appearance to the real interconnect unit 11, but does not form a valid electrical connection. The formation process of the dummy interconnect unit 12 includes:

[0200] A conductive structure (such as a metal pillar or metal pad) is formed at a predetermined location. The shape, size, and material of this conductive structure are similar to or identical to the conductive structure of the actual interconnect unit 11. Then, an insulating layer is disposed inside or at the bottom of the conductive structure. The insulating layer may be silicon oxide, silicon nitride, a polymer material, or other insulating materials.

[0201] The distribution of dummy interconnect units 12 in the cross-layer interface can be determined according to random or pseudo-random rules, making it difficult for attackers to distinguish between real interconnect units 11 and dummy interconnect units 12 based on appearance or location information. In a specific example, the ratio of real interconnect units 11 to dummy interconnect units 12 can be from 1:1 to 1:5, with the specific ratio determined according to security and functional requirements.

[0202] The output of the first PUF circuit is connected to the input of the second PUF circuit through the real interconnect unit 11, forming a cross-layer PUF chain. Simultaneously, the functional circuits of each chip layer are also connected through the real interconnect unit 11 to realize the function of the complete circuit.

[0203] Furthermore, step S22 also includes step S221, forming an interlayer shielding structure 2 on the two opposing surfaces of the interlayer interconnection intermediary layer 1, wherein the interlayer shielding structure 2 includes a randomly distributed metal pattern.

[0204] In a specific example, the interlayer shielding structure 2 is located between the first chip layer and the second chip layer, and includes randomly distributed metal patterns. The metal patterns can be irregularly shaped metal blocks, metal grids, or metal line segments, and their distribution, shape, and size are generated by a random algorithm.

[0205] The interlayer shielding structure 2 can be formed simultaneously with the interlayer interconnection intermediary layer 1, or formed after the interlayer interconnection intermediary layer 1 is formed by an additional metallization process.

[0206] Furthermore, in step S23, the first chip layer and the second chip layer are bonded using the interposer plate, and the integrated circuit is packaged after bonding. The packaging process includes underfill, molding, substrate connection, and other steps, which are common practices for those skilled in the art. After packaging, the integrated circuit is subjected to functional and reliability tests to verify whether the electrical connection of the actual interconnect unit 11 is normal, whether the PUF circuit is working properly, and whether the activation control logic can correctly execute the verification and activation functions.

[0207] In a specific example, within a trusted packaging environment, the first and second chip layers are vertically stacked to establish physical connections between the real interconnects and the dummy interconnects. During stacking, the alignment accuracy of the real interconnects is ensured, so that the transmitting end of the first chip layer accurately mates with the receiving end of the second chip layer. The dummy interconnects also achieve physical connection, but due to the presence of the insulating layer, no conductivity is formed. After stacking, the semiconductor integrated circuit is tested in a secure environment. A complete PUF response chain generation process is executed, including the following steps:

[0208] Provide an initial challenge value to the first PUF circuit;

[0209] Read the first response value output by the first PUF circuit;

[0210] Confirm that the first response value is correctly transmitted to the second PUF circuit through the cross-layer signal line;

[0211] Read the second response value output by the second PUF circuit;

[0212] The activation control unit generates a verification key.

[0213] The verification key or its hash value is used as the pre-stored verification value and programmed into the one-time programmable memory of the semiconductor integrated circuit. This programming operation is irreversible, ensuring that the pre-stored verification value is fixed once written.

[0214] After testing and programming are completed, the semiconductor integrated circuit enters the delivery state. Furthermore, in subsequent use, the same PUF response chain generation process is executed each time power is applied. The generated verification key is compared with the pre-stored verification value. Upon successful verification, the actual interconnect is activated, and the system enters normal operating mode.

[0215] In this embodiment of the invention, PUF circuits are integrated into the chip layer and interlayer connections are achieved through an interlayer interconnection intermediary layer 1. This utilizes the random physical variations inherent in the fabrication process, enabling hardware-level authentication without the need for an additional key storage unit, thus improving security while reducing costs. An interlayer interconnection intermediary layer 1, comprising real interconnection units 11 and dummy interconnection units 12, is formed between adjacent chip layers. The dummy interconnection units 12 can be fabricated by placing an insulating layer inside or at the bottom of the conductive structure. This structure is highly similar in appearance and morphology to the real interconnection, making it difficult to distinguish during physical analysis after fabrication, effectively enhancing anti-reverse engineering capabilities. By fabricating at least two chip layers separately and ensuring that each chip layer contains a subset of circuits insufficient to achieve complete functionality, physical-level security isolation is established during the fabrication stage, avoiding the risk of exposing complete design information in a single fabrication step. The formed interlayer shielding structure 2 contains randomly distributed metal patterns, which can be completed during the metallization process. This not only interferes with electromagnetic detection and side-channel attacks but also serves as a mechanical protective layer to enhance the physical strength of the chip. Furthermore, this method supports the separate fabrication of at least two chip layers by different manufacturing plants, achieving secure decentralization at the supply chain level. Even if a security vulnerability or malicious implantation exists in a certain manufacturing stage, the complete circuit design and functional implementation cannot be obtained, fundamentally reducing the risk of supply chain attacks. This has significant practical implications and application value for application scenarios with high security requirements.

[0216] Example 4

[0217] This embodiment provides a chip inter-layer verification method, such as... Figure 8 As shown, this method can be applied to the semiconductor integrated circuit provided in Example 1 or to the semiconductor integrated circuit prepared according to the method described in Example 2 or Example 3. The verification method is applied to a semiconductor integrated circuit having at least two chip layers and includes the following steps:

[0218] S31. Obtain initial challenge values;

[0219] S32. Input the initial challenge value into the first PUF circuit of the first chip layer to generate a first response value;

[0220] S33. Transmit the first response value to the second chip layer and input it into the second PUF circuit to generate a second response value;

[0221] S34. Generate a verification key based on the first response value and the second response value;

[0222] S35. Control the electrical connection state between the chip layers according to the verification key.

[0223] Specifically, in step S31, when the integrated circuit is powered on or enters the working mode, the initial challenge value is obtained.

[0224] The initial challenge value can be generated by a random number generator inside the integrated circuit or input from an external system via an interface. The length of the initial challenge value is determined according to security requirements, and is typically 64 bits, 128 bits, or 256 bits.

[0225] Specifically, in step S32, the initial challenge value is input to the first PUF circuit. The PUF circuit processes the initial challenge value based on its physical characteristics (such as differences in device threshold voltage, changes in delay paths, etc.) to generate a first response value. The first response value is a unique response of the PUF circuit of the first chip layer to the initial challenge value, and it is unclonable and unpredictable.

[0226] Specifically, in step S33, a first response value is transmitted and a second response value is generated. The first response value is transmitted to the second chip layer through the interlayer interconnection intermediary layer 1. The physical interconnection unit 11 in the interlayer interconnection intermediary layer 1 provides an electrical connection path between the first chip layer and the second chip layer, enabling the first response value to be transmitted to the PUF circuit input terminal of the second chip layer.

[0227] The second PUF circuit receives the first response value as its challenge value, processes the first response value according to its own physical characteristics, and generates a second response value. The second response value is the unique response of the second PUF circuit to the first response value.

[0228] This cascaded PUF structure forms a challenge-response chain across chip layers. The second response value depends on the physical characteristics of both the first and second chip layers; replacement or tampering with any chip layer will cause a change in the second response value. This cross-layer interlocking mechanism effectively prevents attacks that could result from the replacement of a single chip layer.

[0229] Specifically, in step S34, a verification key is generated based on the first response value and the second response value. The method for generating the verification key includes performing operations on the first response value and the second response value, and the operations include, but are not limited to, XOR operations, concatenation operations, and hash operations.

[0230] In a specific example, other information (such as chip serial number, timestamp, etc.) can be added to the generation process of the verification key to further enhance the uniqueness and security of the key.

[0231] Specifically, in step S35, the verification key is compared with a pre-stored verification value. The pre-stored verification value is a reference value pre-stored in non-volatile memory during the integrated circuit manufacturing or initialization phase. The pre-stored verification value is generated in a trusted environment through the same challenge-response-key generation process and represents the correct verification key that a legitimate chip layer combination should produce.

[0232] The generated verification key is compared bit by bit with the pre-stored verification value to determine if they are completely identical. Based on the comparison result, the corresponding operation is performed.

[0233] If the verification key matches the pre-stored verification value exactly, it means that both the first and second chip layers are legitimate and have not been tampered with, and the verification is successful. At this point, the activation control unit sends an activation signal to establish a valid electrical connection between the chip layers, allowing signals and data to be transmitted between them. The integrated circuit enters normal operating mode, and the functional circuits of each chip layer work together to achieve complete circuit functionality.

[0234] If the verification key does not match the pre-stored verification value, it indicates that at least one chip layer has been replaced, tampered with, or is abnormal, and the verification fails. In this case, signal transmission between chip layers is blocked, the integrated circuit cannot function properly, and attackers cannot gain effective functionality by tampering with the chip layers.

[0235] In a specific example, a protection response can also be triggered when the comparison fails. The protection response includes:

[0236] Data erasure: Erase keys, configuration information, or other sensitive data from storage to prevent attackers from extracting this information through physical analysis.

[0237] Generate alarm signals: Send alarm signals through external interfaces to notify the system or user that a potential attack or anomaly has been detected.

[0238] Enter Safe Mode: Switches the integrated circuit to Safe Mode or Low-Function Mode, restricting its functions and access permissions to prevent further attacks.

[0239] In extreme cases, the integrated circuit can be permanently disabled by triggering internal physical destruction mechanisms (such as blowing fuses or destroying critical circuit paths).

[0240] In this embodiment of the invention, the above-described chip layer inter-verification method realizes cross-layer interlocking verification based on PUF, ensuring that only legitimate chip layer combinations can work normally, effectively preventing attacks such as chip layer replacement, cloning, and reverse engineering, and significantly improving the security of semiconductor integrated circuits.

[0241] In summary, this invention provides a high-strength, multi-layered IP protection solution for semiconductor integrated circuits through cross-layer PUF interlocking mechanisms, false interconnection obfuscation, inter-layer random shielding, and comprehensive attack detection, demonstrating significant technological advancements and broad application prospects.

[0242] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A semiconductor integrated circuit, characterized by comprising: include: A first chip layer and a second chip layer, wherein a first PUF circuit is provided in the first chip layer and a second PUF circuit is provided in the second chip layer, and the output of the first PUF circuit is used as the input of the second PUF circuit; An intermediary layer adapter board includes an inter-layer interconnection intermediary layer for enabling communication between the first chip layer and the second chip layer. The inter-layer interconnection intermediary layer has real interconnection units and dummy interconnection units. The activation control unit is used to generate a verification key based on the outputs of the first PUF circuit and the second PUF circuit, and to control the activation state of the real interconnect unit according to the verification result.

2. The semiconductor integrated circuit according to claim 1, characterized by The first PUF circuit generates a first response value in response to the initial challenge value, and the second PUF circuit generates a second response value in response to the first response value. The activation control unit is used to generate the verification key by performing calculations on the first response value and the second response value, and compare the verification key with a pre-stored verification value. When the comparison is successful, the real interconnect unit is turned on.

3. The semiconductor integrated circuit according to claim 1, characterized by, Also includes: The first chip layer and the second chip layer each contain different subsets of logic circuits, and the subsets in the same chip layer are insufficient to implement the complete logic circuit function. And / or, the dummy interconnect unit includes a conductive structure and an insulating layer disposed inside or at the bottom of the conductive structure; And / or, the interlayer adapter plate further includes an interlayer shielding structure disposed on two opposite surfaces of the interlayer interconnect interlayer, the interlayer shielding structure comprising a randomly distributed metal pattern; And / or, an attack detection unit, used to detect abnormal operations and trigger a protection response when an abnormal operation is detected.

4. A method for designing semiconductor integrated circuits, characterized in that, include: Identify circuit design data and generate design data corresponding to the first chip layer and the second chip layer. The first chip layer is provided with a first PUF circuit, and the second chip layer is provided with a second PUF circuit. The output of the first PUF circuit is used as the input of the second PUF circuit. Interlayer interconnects are defined between the design data of the first chip layer and the second chip layer, and the interlayer interconnects include real interconnects and dummy interconnects; Configure activation control logic to generate a verification key based on the outputs of the first PUF circuit and the second PUF circuit, and control the activation state of the real interconnect according to the verification result.

5. The semiconductor integrated circuit design method according to claim 4, characterized in that, The definition of interlayer interconnection also includes: determining the distribution position of the dummy interconnection in the interlayer interface according to random or pseudo-random rules.

6. The semiconductor integrated circuit design method according to claim 4, characterized in that, The identification circuit design data, generating design data corresponding to the first chip layer and the second chip layer, includes: Identify key circuit paths in circuit design data and split the key circuit paths into the first chip layer and the second chip layer. Based on the splitting results, design data corresponding to the first chip layer and the second chip layer is generated; Configure PUF circuits in the design data of the first chip layer and the second chip layer respectively.

7. The semiconductor integrated circuit design method according to claim 4, characterized in that, Also includes: Generate the definition of the interlayer shielding structure.

8. A method for fabricating a semiconductor integrated circuit, characterized in that, include: A first chip layer and a second chip layer are fabricated respectively. A first PUF circuit is formed in the first chip layer and a second PUF circuit is formed in the second chip layer. The output of the first PUF circuit is used as the input of the second PUF circuit. A middle layer adapter board is prepared, including an interlayer interconnection middle layer, wherein real interconnection cells and dummy interconnection cells are formed in the interlayer interconnection middle layer; An activation control unit is formed to verify and activate the real interconnect unit based on the outputs of the first PUF circuit and the second PUF circuit; The first chip layer and the second chip layer are bonded together using the interposer.

9. The method for fabricating a semiconductor integrated circuit according to claim 8, characterized in that, The separate fabrication of the first chip layer and the second chip layer further includes: forming different subsets of logic circuits in each chip layer, wherein the subsets in the same chip layer are insufficient to realize the complete logic circuit function.

10. The method for fabricating a semiconductor integrated circuit according to claim 8, characterized in that, The preparation of the intermediate layer adapter plate further includes: forming an interlayer shielding structure on two opposite surfaces of the interlayer interconnecting intermediate layer, wherein the interlayer shielding structure includes a randomly distributed metal pattern.

11. The method for fabricating a semiconductor integrated circuit according to claim 8, characterized in that, The first chip layer and the second chip layer are fabricated in different factories.

12. A chip interlayer verification method, characterized in that, Applications to semiconductor integrated circuits with real interconnect units and dummy interconnect units include: Obtain initial challenge values; The initial challenge value is input into the first PUF circuit of the first chip layer to generate a first response value; The first response value is transmitted to the second chip layer and input into the second PUF circuit to generate the second response value; A verification key is generated based on the first and second response values; The activation state of the actual interconnect unit is controlled according to the verification key, thereby controlling the electrical connection state between the chip layers.

13. The chip interlayer verification method according to claim 12, characterized in that, The step of generating a verification key based on the first response value and the second response value includes: performing an XOR operation, a concatenation operation, or a hash operation on the first response value and the second response value; And / or, the step of controlling the electrical connection state between chip layers according to the verification key includes: comparing the verification key with a pre-stored verification value; When the comparison is successful, an effective electrical connection is established between the chip layers; If the comparison fails, disconnect or keep disconnected the electrical connection between the chip layers, or trigger a protection response.

Images