Backside intrusion prevention and self-destruction device and method for quantum-resistant cryptographic chips

Abstract

The application discloses a backside intrusion defense and self-destruction device and method for quantum-resistant cryptographic chips, a graphene passive metamaterial shielding layer is constructed on the backside of a chip silicon substrate to absorb 100MHz-10GHz radio frequency detection signals and block active electromagnetic reflection attacks; an active noise elimination current compensator is arranged inside to mirror power consumption and real-time current to offset the total current of external power supply and grounding pins, so that the ground return power consumption leakage is eliminated; an asynchronous erasing mechanism is adopted to quickly erase sensitive storage units within 5ns by using residual charges when power supply or clock is abnormal; volatile SRAM-PUF masks and double-layer thermal sensing networks are combined to trigger interlocking zeroization, burn the key path and permanently lock the output random code when thermal stimulation, low temperature or physical cutting is detected. The application systematically defends against extreme intrusion attacks such as backside electromagnetic, power consumption and static extraction from the physical bottom layer, and significantly improves the physical security level of quantum-resistant cryptographic chips.

Description

Technical Field

[0001] This invention belongs to the field of advanced packaging security technology for integrated circuits, and in particular relates to a back-side intrusion defense and self-destruct device and method for quantum cryptographic chips. Background Technology

[0002] As quantum-resistant cryptography (PQC) algorithms gradually enter the standardization and application stage, the security issues of their hardware implementation are becoming increasingly prominent. Currently, side-channel analysis (SCA) defenses against PQC accelerator IP cores, such as microarchitecture masking and randomized execution, are becoming increasingly sophisticated. However, attackers' methods are evolving from logical levels to more extreme destructive physical intrusions, posing a new and serious challenge to high-performance security chips employing advanced packaging technologies.

[0003] Specifically, to meet the demands of high-bandwidth I / O and heat dissipation, modern high-performance secure Systems-on-Chip (SoCs) commonly employ flip-chip packaging. In this packaging structure, the active circuitry side of the chip faces downwards and is connected to the substrate, while the back side of the silicon substrate is directly exposed, becoming a new and vulnerable interface for physical attacks. When a defender attempts to build security defenses on the front or inside of the chip, attackers can bypass these defenses and launch physical intrusion attacks directly from the exposed back side of the silicon wafer. Currently, physical security protection technologies targeting the back side of the silicon wafer have significant shortcomings and are ill-equipped to withstand the extreme attack methods employed by national-level physical failure analysis laboratories, primarily manifested as follows:

[0004] Inadequate defenses against Active Electromagnetic Side-Channel (EMA / Echo TEMPEST) attacks: To defend against electromagnetic probes, existing technologies typically deploy active shielding meshes on the top metal layer of the chip. However, when an attacker emits continuous electromagnetic waves of hundreds of megahertz from the back of the chip, the carrier wave can penetrate the silicon substrate and reach the internal active regions. Low-level cryptographic operations (such as polynomial multiplication) cause data-dependent changes in the transient impedance of transistors, thereby modulating key information onto the reflected echo. At this point, the traditional active shielding mesh, due to its nonlinear components, can actually act as a "Trojan antenna," efficiently reflecting the modulated signal back to the attacker's probe, leading to information leakage.

[0005] Defenses against ground return current power analysis attacks have weaknesses: existing technologies often employ guard rings and decoupling capacitors to isolate internal noise. However, these measures cannot eliminate a fundamental physical fact: all transient dynamic charges absorbed by the circuit module must ultimately return through the package's ground pin (GND). Attackers can obtain a global power consumption trajectory with extremely high signal-to-noise ratio by connecting an ultra-low impedance probe to the GND pad on the back of the chip, thereby implementing efficient differential power analysis (DPA) and rendering internal local noise isolation measures ineffective.

[0006] The lack of defense mechanisms against power-off static data extraction and thermal laser stimulation attacks: Current technologies lack a rapid and reliable physical self-destruct mechanism to address the risk of data retention after chip power loss or deep freezing. Attackers can use infrared lasers with a wavelength of 1300nm (photon energy lower than silicon's bandgap of 1.12eV) for thermal laser stimulation (TLS). This can induce resistance changes in static RAM cells without generating photocurrent (thus blinding traditional photoelectric sensors), thereby reading their stored state. More seriously, this attack can be carried out when the chip is completely powered off, directly extracting sensitive information such as key seeds that have long resided in SRAM or flip-flops. Conventional power-off erasure processes, relying on system clocks and residual energy, are often too slow to respond and cannot cope with instantaneous power outages or physical freezing.

[0007] In summary, existing technologies lack a solution that can systematically defend against various extreme physical intrusion methods, such as active electromagnetic reflection, ground return leakage, and static extraction during power failure, from a physical level, specifically targeting the exposed back side of the silicon wafer of a flip chip. How to construct an integrated protection architecture that is absolutely immune to electromagnetic echo modulation, eliminates ground return leakage, and achieves reliable self-destruction upon power failure has become a pressing technical challenge in this field. Summary of the Invention

[0008] The purpose of this invention is to provide a back-side intrusion defense and self-destruction device and method for quantum cryptographic chips, so as to achieve systematic protection of the exposed silicon substrate of flip chips. By integrating graphene passive metamaterial shielding, active noise cancellation current offsetting, time-borrowed asynchronous erasure, and volatile PUF interlocking zeroing mechanism, it simultaneously solves three extreme attacks from the physical level: active electromagnetic side channel reflection, ground return current power consumption analysis, and power-off static thermal laser stimulation extraction, thereby ensuring the absolute physical isolation of sensitive information of the chip.

[0009] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is a back-side intrusion defense and self-destruction method for quantum cryptographic chips, comprising the following steps:

[0010] S1. Construct a passive electromagnetic metamaterial shielding layer on the back side of the chip silicon substrate to absorb externally incident radio frequency detection signals;

[0011] S2. Deploy an active noise cancellation mechanism inside the chip to offset transient current fluctuations generated by cryptographic logic operations, so that the total current flowing through the external power supply and ground pin remains constant.

[0012] S3. Implement an asynchronous erase mechanism. When a power supply or clock anomaly is detected, the residual charge is used to trigger the erasure of the sensitive memory cell.

[0013] S4. Use volatile physical non-clonable functions to mask the long-term hidden seed in the chip, and combine it with a thermal sensing network to trigger an interlocking nullification mechanism when physical damage or abnormal thermal stimulation is detected.

[0014] Furthermore, in step S1, the passive electromagnetic metamaterial shielding layer is a graphene passive metamaterial back shielding layer, which is formed by alternately setting graphene conductive films and flexible dielectric layers on the back side of a silicon substrate, and does not contain any active transistor devices.

[0015] Furthermore, the graphene conductive film has 3 to 5 layers, an overall film thickness of 1 nm to 2 nm, and a sheet resistance of 300 Ω / sq to 400 Ω / sq; the flexible dielectric layer is made of polyimide or polydimethylsiloxane, has a dielectric constant of 2.8 to 3.0, and a thickness of 10 μm to 20 μm; the shielding layer has an absorption rate of greater than 90% for electromagnetic waves in the frequency range of 100 MHz to 10 GHz, and a reflectivity of less than -15 dB.

[0016] Furthermore, in step S2, the active ground noise cancellation mechanism is implemented through an active ground noise cancellation current compensator, which includes:

[0017] The mirror power consumer is symmetrically distributed in the physical layout with the quantum cryptography-resistant acceleration core;

[0018] A current sensing network is used to extract transient current characteristics from the main power supply path of the quantum cryptography-resistant acceleration core;

[0019] A low-noise error amplifier is used to compare the sensed signal output by the current sensing network with a reference voltage and output an error control signal.

[0020] The common-source cascode current mirror network is driven by the error control signal to control the current drawn by the mirror power consumer, so that the current of the mirror power consumer is offset in real time from the transient current fluctuation of the quantum cryptography-resistant acceleration core.

[0021] Furthermore, the hardware structure of the quantum-resistant cryptographic acceleration core includes: a number-theoretical transformation and inverse number-theoretical transformation operation array for performing polynomial multiplication operations; a hash calculation engine for generating cryptographically secure pseudo-random numbers; a local low-power static random access memory for caching polynomial coefficients and intermediate key states; and finite state machine control logic for scheduling the above components to execute quantum-resistant cryptographic algorithm instruction sequences.

[0022] Furthermore, in step S3, the triggering conditions for the asynchronous erase mechanism are: detecting that the core power supply voltage drops below 75% of the nominal operating voltage and lasts for more than 1 ns, and / or detecting that the interval between two consecutive rising edges of the main clock is greater than 50 ns.

[0023] The erasure is performed via a hardwired path of pure combinational logic gates independent of the system clock tree. The trigger signal of this path is directly connected to the asynchronous clear pin of the D flip-flop that holds the sensitive intermediate value and / or the gate of the pull-down discharge transistor of the secure static random access memory bit line.

[0024] The overall response time from the fulfillment of the triggering condition to the completion of erasing all target sensitive memory cells is less than 5ns.

[0025] Furthermore, in step S4, the masking using a volatile physical non-cloning function specifically involves: each time the chip is powered on, the long-term hidden seed is XORed and encrypted using the physical non-cloning function response value generated based on the power-on metastable state of the static random access memory cell, and the resulting mask seed is stored in the ordinary storage area; when the long-term hidden seed needs to be used, the mask seed is read in real time and XORed again with the physical non-cloning function response value to restore it.

[0026] Furthermore, in step S4, the thermal sensing network is a ring oscillator array deployed in the active area of ​​the chip bottom layer, which adopts a two-layer non-uniform distribution method combining a core high-density warning ring and a global background grid.

[0027] The triggering conditions for the interlocking nullification mechanism are: the thermal sensing network detects a local transient temperature rise rate greater than 10°C / μs, or the chip temperature is lower than -20°C, or the ring oscillator frequency experiences an irreversible drift of more than ±5%.

[0028] Furthermore, after the interlocking nullification mechanism is triggered, an atomic-level interlocking nullification operation is performed, including turning on the high-voltage charge pump to physically burn out the fuse structure on the long-term hidden seed reading path, and permanently locking the chip's response state to an implicit rejection mode that only returns fixed garbled characters.

[0029] A back-side intrusion defense and self-destruct device for quantum cryptographic chips, used to implement the above method, includes:

[0030] A graphene passive metamaterial back shielding layer is integrated on the back side of the chip's silicon substrate;

[0031] An active noise cancellation current compensator, located inside the chip, is connected in parallel with quantum cryptography-resistant accelerated nuclear physics;

[0032] An asynchronous erase trigger is embedded in the chip's power supply rail and clock tree root node, and connected to a spare bypass capacitor;

[0033] Physically unclonable function masking and thermal sensing interlocking networks are distributed in the underlying active transistor region of the chip.

[0034] Furthermore, the asynchronous erase trigger includes an internal low-voltage detector and a watchdog oscillator, used to monitor the core power supply voltage and the master clock state, respectively; the physical unclonable function masking and thermal sensing interlocking network is configured with a volatile physical unclonable function based on the power-on metastable state of the static random access memory cell; the thermal sensing interlocking network is composed of a ring oscillator.

[0035] Compared with the prior art, the beneficial effects of the present invention include the following:

[0036] This invention addresses the defense against active electromagnetic side-channel and echo modulation attacks by constructing a graphene passive metamaterial shielding layer on the back of a silicon substrate. This efficiently converts externally irradiated microwave radio frequency signals of a specific frequency band into heat dissipation, rather than reflection. The structure itself contains no nonlinear active devices, fundamentally eliminating the physical possibility of modulating transistor impedance changes caused by internal chip operations onto the reflected echo. This ensures that external detection probes can only collect background noise with no information content, thus completely blocking information leakage paths based on signal reflection.

[0037] In addressing ground return power analysis attacks, this invention employs a power supply mirroring and active ground noise cancellation mechanism. Through physical-level real-time current offsetting, it maintains a stable DC ground while ensuring that the total current flowing through the external power supply and ground pin exhibits a strictly zero-mean DC characteristic. This method abandons traditional isolation designs that easily introduce voltage drops, making it impossible for attackers to extract effective power differential characteristics from the power return network, thereby significantly improving the ability to resist high-order differential power analysis.

[0038] This invention addresses the challenges of static data extraction during power outages and attacks triggered by thermal laser stimulation. By leveraging the synergistic effect of an asynchronous time-to-write (OTW) erasure mechanism and a volatile physical non-cloning function (PUF) mask, it ensures that all sensitive data is never stored in plaintext form during any non-power-on state of the chip. Upon detecting an abnormal power drop or clock stall, the system can irreversibly erase all critical memory cells asynchronously using residual charge within a very short time window. Combined with a PUF mask that becomes invalid upon power outage, attackers cannot obtain valid key information even under conditions of deep cryogenic freezing or specific wavelength laser stimulation; they can only obtain unreadable high-entropy scrambled data. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a block diagram of the active ground noise cancellation (AGNC) current compensator in this embodiment;

[0041] Figure 2 This is a flowchart of the power failure self-destruction and asynchronous erase response in this embodiment;

[0042] Figure 3 This is a schematic diagram of the thermal delay sensor network deployment in this embodiment (active area at the bottom layer of the chip). Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] This embodiment provides a back-side intrusion defense and self-destruction device and method for quantum cryptographic chips, belonging to the interdisciplinary field of advanced integrated circuit packaging security, physical failure analysis defense, and post-quantum cryptography (PQC), and particularly relates to a method for M2-KEM and other quantum cryptographic chips based on... The three-dimensional physical security architecture of the modular quantum cryptography accelerator IP core is specifically a silicon wafer backside physical isolation and self-destruct sensing device that is absolutely immune to active electromagnetic side channel reflection, eliminates ground return leakage, and resists thermal laser stimulation (TLS) extraction in the power-off state.

[0045] S1. Construction of a silicon-backed graphene passive ultrawideband electromagnetic metamaterial shielding layer

[0046] On the physical back surface of the silicon substrate of the quantum-resistant (PQC) flip chip, a graphene passive metamaterial back shielding layer is constructed using wafer-level processes. This graphene passive metamaterial back shielding layer consists of alternating layers of multilayer graphene conductive films and flexible dielectric layers, and is electrically suspended or grounded through extremely high impedance. It does not contain any active transistor devices.

[0047] Specifically, the wafer-level process refers to the process implemented on the entire back side of the wafer after the back-end processes of integrated circuit manufacturing are completed or after back-side thinning of the wafer. Examples include chemical vapor deposition thin film transfer technology or polymer spin coating technology, to achieve large-area uniform coverage of the shielding layer. The multilayer graphene is preferably 3 to 5 layers, with an overall film thickness controlled between 1 nm and 2 nm, and a sheet resistance target value set in the range of 300 Ω / sq to 400 Ω / sq to match free-space wave impedance. The flexible dielectric layer material is preferably polyimide or polydimethylsiloxane, with a dielectric constant controlled between 2.8 and 3.0, and a thickness precisely controlled in the range of 10 μm to 20 μm. This parameter range is rigorously derived based on impedance matching and the Fabry-Perot resonator interference destructive principle. To enable the graphene layer (sheet resistance 300Ω / sq to 400Ω / sq) to absorb broadband electromagnetic waves with a radio frequency of 100MHz-10GHz, the input impedance of the metamaterial structure must be matched with the wave impedance of free space (approximately 377Ω).

[0048] As the flexible dielectric layer, polyimide (PI) exhibits extremely high thermal stability (withstanding the high-temperature processes of flip-chip packaging and reflow soldering) compared to ordinary resins or PET materials, and possesses excellent mechanical strength and insulation properties, making it ideal as a bonding layer on the back side of a chip silicon substrate. If polydimethylsiloxane (PDMS) is used as the flexible dielectric layer, it offers superior flexibility and conformability compared to rigid dielectrics, enabling highly seamless bonding with the rough silicon substrate back side and atomically thin graphene. Furthermore, it exhibits extremely low dielectric loss over a wide frequency band, without interfering with the resonant characteristics of the metamaterial structure.

[0049] Thus, a high-impedance graphene film and a flexible dielectric layer with specific parameters together form a Salisbury-like Fabry-Perot resonant cavity structure on the back side of a silicon substrate. When an external radio frequency detection signal with a frequency in the range of 100MHz to 10GHz is incident, the electromagnetic wave reflected from the graphene surface and the electromagnetic wave transmitted through the dielectric layer and reflected back from the bottom interface undergo destructive interference, forming a broadband resonance. This localizes the electromagnetic energy within the structure, which is then converted into heat dissipation through the ohmic loss of the graphene film. Within this frequency band, the shielding layer has an absorption rate of more than 90% and a reflectivity of less than -15dB.

[0050] Since the graphene passive metamaterial back shielding layer is a completely passive structure and does not contain nonlinear active devices, it will not generate micro-impedance modulation related to the internal operation of the chip when subjected to external high-frequency microwave irradiation. This fundamentally eliminates the physical conditions for modulating internal key information onto the reflected echo and completely blocks the signal reflection loop on which active electromagnetic side-channel attacks depend.

[0051] S2. Deployment of Active Ground Noise Cancellation (AGNC) Current Compensator

[0052] Deploying a mirror-power active noise cancellation current compensator within the chip, symmetrical to the physics of the PQC acceleration core, such as... Figure 1 The active noise cancellation current compensator includes a mirror power consumer, a current sensing network, a low-noise error amplifier, and a common-source cascode current mirror network that are symmetrically distributed with the PQC acceleration core on the physical layout. They are connected through a bypass feedback loop to form a real-time current offsetting system.

[0053] The quantum-resistant cryptography (PQC) acceleration core described in this embodiment has the following hardware structure: a number-theoretic transformation (NTT) and inverse number-theoretic transformation (INTT) operation array for performing polynomial multiplication operations; a hash calculation engine (such as a Keccak / SHA-3 core) for generating cryptographically secure pseudo-random numbers; a local low-power static random access memory (SRAM) for caching polynomial coefficients and key intermediate states; and a finite state machine (FSM) control logic for scheduling the above components to execute quantum-resistant cryptographic algorithm (such as M2-KEM) instruction sequences.

[0054] In the specific physical layout implementation, the symmetrical distribution is a combination of distributed centrosymmetry and complementary shape alternation. To prevent attackers from using high-precision spatial electromagnetic probes to carry out spatial dimension separation attacks through physical position differences, the mirrored power consumption unit is not simply placed in axisymmetric isolation from the anti-quantum cryptography accelerator core. Instead, it is arranged in a complementary shape, serving as a high-density dummy logic array to fill the blank areas (such as wiring track gaps) within the cryptographic core, or uniformly and tightly surrounding the outer boundary of the anti-quantum cryptography accelerator core. Furthermore, in terms of transistor scale, the total effective channel width and length of the NMOS / PMOS devices inside the mirrored power consumption unit are strictly equivalent to the scale of the active transistors within the anti-quantum cryptography core. This structure not only achieves a high degree of consistency between the physical geometric center, heat generation center, and electromagnetic radiation dipole center of both in macroscopic three-dimensional space, but also ensures electrical area parity to provide sufficient current throughput, thereby achieving mutual cancellation of local electric field dipoles and thermal gradients in the near field.

[0055] Specifically, the mirrored power consumer is a broadband programmable current sink or a high-density dummy logic array. Physically, it consists of a large number of NMOS / PMOS devices matching the size of the PQC acceleration core transistors of the quantum-resistant cryptography (PQC) chip, uniformly surrounding or interleaved around the PQC acceleration core to achieve physical symmetry.

[0056] Furthermore, the current sensing network is connected in parallel or series on the main power supply path of the PQC acceleration core to extract its high-frequency transient current characteristics without loss. This is achieved through a high-bandwidth ratio current mirror, specifically by placing a sensing transistor with the same physical origin as the main power supply switch but an area ratio of 1:N on the power supply trunk line or ground rail of the PQC acceleration core, to mirror the transient current of the PQC core. A proportionally small monitoring current is used, and this current is converted into a voltage signal via an impedance network. .

[0057] The low-noise error amplifier receives the voltage signal at its inverting input terminal. The non-inverting input is connected to an internal high-precision, high power supply rejection ratio (PSRR) reference voltage. (Representing the target constant current), used to compare and output error control signals.

[0058] The common-source cascode current mirror network, driven by the control voltage output of the low-noise error amplifier, acts as a high-output-impedance current regulation actuator to control the current I_dummy drawn by the mirror power consumption device.

[0059] The bypass feedback loop works as follows: the quantum-resistant cryptographic chip maintains the total current of the external power supply pin. constant ( This achieves dynamic hedging. When the PQC operation results in... When it increases instantaneously, As the voltage rises, the error amplifier then outputs a reverse-adjustment control voltage to drive the cascode current mirror network, causing the current of the mirror power consumer to rise. An equal decrease occurs, thus offsetting in real time. Fluctuations. This process ensures that the total current and total charge flowing into the external VDD and GND pins are strictly constant to eliminate channel leakage and electric field dipole radiation on the ground return side.

[0060] S3. Asynchronous erasure of "BorrowedTime" retrieved from static physical data:

[0061] An asynchronous erase trigger is configured in the volatile memory area of ​​the PQC core for monitoring residual charge and clock state, to implement a borrowed-time asynchronous erase mechanism to cope with static physical extraction. For example... Figure 2This mechanism is activated when the system detects an external clock stall, abnormal reset, or a core power supply voltage drop to the failure threshold. The hardware utilizes the last remaining charge (i.e., borrow time) in the on-chip miniature sustaining capacitor (i.e., the backup bypass capacitor) to asynchronously and irreversibly overwrite all registers and static memories containing sensitive intermediate values ​​(e.g., 256-bit M2-KEM session keys or intermediate states of polynomial operations) within nanoseconds via a hardwired path composed of purely combinational logic gates.

[0062] Specifically, the monitoring includes dual detection of clock stalls and voltage dips. For clock stalls, a watchdog oscillator continuously monitors the main PQC clock. A stall alarm is triggered when the time interval between two consecutive rising edges of the clock exceeds 50ns (equivalent to a main clock frequency below 20MHz). For voltage dips, an internal low-voltage detector continuously monitors the core supply voltage. When the supply voltage drops to 75% of the nominal operating voltage (e.g., 0.6V for a 0.8V process node) and the low-voltage state lasts for more than 1ns, it is determined to be an abnormal power outage or fault injection attack. From the triggering of either of these abnormal conditions to the arrival of the self-destruct erase control signal (Erase_CMD) at the last target register, the hardware response time of the entire system is strictly less than 5ns. This extremely short response window ensures that the physical toggling of all sensitive states can be completed before the residual charge of the spare bypass capacitor (typically in the tens of picofarads range) is depleted.

[0063] The erase operation is performed via an asynchronous path of "pure combinational logic gate hardwired," which is physically independent of the chip's global clock tree. Specifically, a high-level trigger signal (Erase_CMD) output from the exception monitoring module directly drives a pure combinational logic gate tree composed of high-drive-capability buffers. The output of this logic tree is directly hardwired via physical metal wires to two key target nodes: first, the asynchronous clear pins of all D flip-flops storing PQC-sensitive intermediate values; and second, the gates of NMOS transistors connected between the underlying secure SRAM array bit lines and the internal ground rail for pull-down discharge. This design ensures that the erase process is completely independent of the system clock, completed solely through the extremely rapid propagation of combinational logic.

[0064] During operation, for example, when the master clock is running normally at 500MHz, if an attacker suddenly cuts off the power or suspends the clock, the monitoring circuit will detect an anomaly of voltage below 0.6V or clock interval exceeding 50ns within less than 1ns and trigger immediately. Subsequently, utilizing the residual charge of the spare bypass capacitor, the Erase_CMD signal, through the aforementioned pure combinational logic path, simultaneously triggers the asynchronous clearing of the register group and the pull-down discharge of the SRAM bit lines within less than 5ns, forcibly resetting the sensitive data area to a full zero state. Afterward, when the capacitor charge is exhausted after approximately 10ns, the chip is in a state where no sensitive information can be extracted, thus completely resisting static extraction due to power failure and thermal laser stimulation attacks.

[0065] S4. Implementation of Volatile PUF Mask Residency and Interlocking Nullification Mechanism

[0066] The long-term hidden seed within the chip is in a masked residency state protected by a volatile Physically Unclonable Function (PUF) derived key. In conjunction with a densely deployed on-chip thermal delay sensor network, when the chip encounters physical cutting damage to the silicon backside or abnormal thermal laser stimulation, atomic-level interlocking nullification is triggered, permanently locking the PQC chip's response state to an implicit reject-scrap output mode.

[0067] To achieve static protection of long-term hidden seeds and proactive response to physical damage, a volatile physical unclonable function (PUF) mask residency mechanism is deployed within the chip, and combined with a thermal delay sensor network to form an interlocked nullification system.

[0068] The volatile PUF is an SRAM PUF based on the metastable state of a standard SRAM cell upon power-up. Its volatility is manifested in that the PUF's response value depends on the state of the SRAM cell at the moment of power-up, which is randomly established due to process deviations. Once the chip power is cut off, this state disappears immediately, and the response value cannot be physically extracted after power-off.

[0069] Furthermore, this embodiment distributes PUF mask obfuscation and thermal sensing interlocking networks in the underlying active transistor region to sense microscopic thermal drift and physical cutting, and utilizes the power-off destroyed PUF response value to provide static masking for long-term secrecy; PUF mask obfuscation is an XOR mask protection of the long-term secret seed within the chip using the PUF response value. Specifically, each time the chip is safely powered on and initialized, the SRAM PUF generates a unique hardware response value (…). The hardware logic uses this response value to perform bitwise XOR encryption on the long-term hidden seed, generating a mask seed residing in the ordinary storage area.

[0070]

[0071] Before performing post-quantum cryptography operations such as M2-KEM, the verification process reads... And again with XOR operations use the instantaneous plaintext reconstruction in computation. This is particularly relevant when facing extreme physical damage or sudden power outage attacks. Instantaneous physical evaporation, remaining in the storage area It transforms into irreversible high-entropy gibberish, thus providing an impeccable static cover for long-term secrecy.

[0072] In some specific embodiments, the thermal delay sensing network is composed of a miniature ring oscillator array distributed in the active region of the bottom layer of the PQC chip. For example... Figure 3 As shown, to accurately capture local anomalies and filter out environmental common-mode interference, the thermal delay sensing network adopts a two-layer non-uniform distribution method of global sparse and core dense, as detailed below:

[0073] The core high-density surveillance ring consists of RO nodes densely deployed around the physical boundary between the PQC acceleration core (such as the M2-KEM computing array) and the underlying secure SRAM (long-term hidden seed and mask area). These nodes are connected end-to-end and are specifically designed to capture localized thermal laser stimulation or pinpoint physical cutting initiated against high-value target areas in real time.

[0074] Global background mesh: In the general logic area and blank area surrounding the active area of ​​the bottom layer of the PQC chip, RO nodes are distributed in a low-density standard mesh (about 1 to 2 nodes per square millimeter) to extract the global ambient temperature and stress reference of the chip during normal operation.

[0075] The data from the two layers of the network converges downwards to the interlocking nullification control and comparison logic, which senses the local transient temperature change rate (ΔT / Δt) and the thermal stress drift of the silicon lattice caused by physical cutting by monitoring the frequency shift of the ring oscillator and performing differential comparison in conjunction with a global reference.

[0076] To distinguish between normal operation and physical attacks, this implementation system sets a multi-dimensional discrimination threshold: when a local transient temperature rise rate is detected to be greater than... When the chip temperature is detected to be below -20°C, it is determined to be an abnormal thermal laser stimulation attack; when the chip temperature is detected to be below -20°C, it is determined to be a deep cryogenic junction attack; when the ring oscillator frequency is detected to have an irreversible drift of more than ±5% relative to the reference, it is determined to be a physical cutting or grinding attack on the back of the silicon.

[0077] Once the thermal delay sensor network triggers any of the aforementioned attack alarms, an atomic-level interlocking nullification mechanism is activated. The system immediately activates the on-chip high-voltage charge pump, using the generated localized high voltage to physically burn out the micro-electro-fuse or anti-fuse structure connected in series in the long-term hidden seed read path. This permanent destruction of the physical path forces the chip's finite state machine to be hardware-redirected to a dead zone state. Thereafter, the chip's response to all external requests is permanently locked to an implicit rejection-of-scrap output mode, returning only fixed, meaningless gibberish, thus physically ensuring no valid information is leaked.

[0078] The graphene passive metamaterial back shielding layer described in this embodiment exhibits an absorption rate greater than 90% and a reflectivity less than -15dB for the incident radio frequency carrier within the target attack frequency band of 100MHz to 10GHz. Testing has shown that this structure can attenuate the signal-to-noise ratio (SNR) of the side-channel characteristics in the radio frequency echo by more than 30dB compared to traditional metal shields. This ensures that external probes can only receive background noise with no information content, thus physically and completely blocking the active electromagnetic side-channel attack path based on echo modulation (EchoTEMPEST).

[0079] This implementation's Active Ground Noise Cancellation (AGNC) current compensator maintains a solid DC ground while ensuring a constant total current flowing into the external power supply (VDD) and ground (GND) pins through sub-nanosecond hardware-level current offsetting. Based on the international standard Test Vector Leakage Assessment (TVLA) method, under attacks involving up to ten million power consumption curves, this solution effectively suppresses the absolute value of the T-test statistic for the M2-KEM core operation to below 4.5 across all time-domain sample points. This demonstrates that its resistance to Differential Power Analysis (DPA) is at least two orders of magnitude higher than traditional "floating ground" designs, rendering side-channel analysis via the external GND pin return network impractical.

[0080] In this embodiment, by utilizing a time-asynchronous erase trigger via a purely combinational logic hard-wired path, all sensitive registers and SRAM can be asynchronously erased within 5ns after a voltage drop or clock stall is detected, far faster than the window (10-20ns) during which the on-chip bypass capacitors are completely depleted. Simultaneously, by masking the long-term hidden seed using the SRAM PUF, which physically evaporates upon power-off and cannot be statically extracted, it is ensured that sensitive information never exists in plaintext form under any non-power-on state. Therefore, even under extremely low temperatures (-100°C) or with thermal laser stimulation (TLS) at a wavelength of 1300nm (photon energy below the silicon bandgap), the success rate of static extraction of the long-term hidden seed can be reduced to a theoretical 0%, achieving absolute physical isolation from power-off static extraction attacks.

[0081] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0082] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A back-side intrusion defense and self-destruction method for quantum cryptographic chips, characterized in that, Includes the following steps: S1. Construct a passive electromagnetic metamaterial shielding layer on the back side of the chip silicon substrate to absorb externally incident radio frequency detection signals. S2. Deploy an active noise cancellation mechanism inside the chip to offset transient current fluctuations generated by cryptographic logic operations, so that the total current flowing through the external power supply and ground pin remains constant. S3. Implement an asynchronous erase mechanism. When a power supply or clock anomaly is detected, the residual charge is used to trigger the erasure of the sensitive memory cell. S4. Use volatile physical non-clonable functions to mask the long-term hidden seed in the chip, and combine it with a thermal sensing network to trigger an interlocking nullification mechanism when physical damage or abnormal thermal stimulation is detected.

2. The back-side intrusion defense and self-destruction method for quantum cryptographic chips according to claim 1, characterized in that, In step S1, the passive electromagnetic metamaterial shielding layer is a graphene passive metamaterial back shielding layer, which is formed by alternately setting graphene conductive films and flexible dielectric layers on the back of a silicon substrate, and does not contain any active transistor devices.

3. The back-side intrusion defense and self-destruction method for quantum cryptographic chips according to claim 2, characterized in that, The graphene conductive film has 3 to 5 layers, an overall film thickness of 1 nm to 2 nm, and a sheet resistance of 300 Ω / sq to 400 Ω / sq; the flexible dielectric layer is made of polyimide or polydimethylsiloxane, has a dielectric constant of 2.8 to 3.0, and a thickness of 10 μm to 20 μm; the shielding layer has an absorption rate of greater than 90% for electromagnetic waves in the frequency range of 100 MHz to 10 GHz, and a reflectivity of less than -15 dB.

4. The back-side intrusion defense and self-destruction method for quantum cryptographic chips according to claim 1, characterized in that, In step S2, the active ground noise cancellation mechanism is implemented through an active ground noise cancellation current compensator, which includes: The mirror power consumer is symmetrically distributed on the physical layout with the quantum cryptography-resistant acceleration core; A current sensing network is used to extract transient current characteristics from the main power supply path of the quantum cryptography-resistant acceleration core; A low-noise error amplifier is used to compare the sensed signal output by the current sensing network with a reference voltage and output an error control signal. The common-source cascode current mirror network is driven by the error control signal to control the current drawn by the mirror power consumer, so that the current of the mirror power consumer is offset in real time from the transient current fluctuation of the quantum cryptography-resistant acceleration core.

5. A back-side intrusion defense and self-destruction method for quantum cryptographic chips according to claim 4, characterized in that, The hardware structure of the quantum-resistant cryptographic acceleration core includes: an array of number-theoretical and inverse number-theoretical transformation operations for performing polynomial multiplication; a hash calculation engine for generating cryptographically secure pseudo-random numbers; a local low-power static random access memory for caching polynomial coefficients and intermediate key states; and finite state machine control logic for scheduling the above components to execute quantum-resistant cryptographic algorithm instruction sequences.

6. A back-side intrusion defense and self-destruction method for quantum cryptographic chips according to claim 1, characterized in that, In step S3, the triggering conditions for the asynchronous erase mechanism are: detecting that the core power supply voltage drops below 75% of the nominal operating voltage and lasts for more than 1 ns, and / or detecting that the interval between two consecutive rising edges of the main clock is greater than 50 ns. The erasure is performed via a hardwired path of pure combinational logic gates independent of the system clock tree. The trigger signal of this path is directly connected to the asynchronous clear pin of the D flip-flop that holds the sensitive intermediate value and / or the gate of the pull-down discharge transistor of the secure static random access memory bit line. The overall response time from the fulfillment of the trigger condition to the completion of erasing all target sensitive memory cells is less than 5ns.

7. A back-side intrusion defense and self-destruction method for quantum cryptographic chips according to claim 1, characterized in that, In step S4, the masking of the long-term hidden seed in the chip using a volatile physical non-cloning function specifically involves: each time the chip is powered on, the long-term hidden seed is XORed and encrypted using the physical non-cloning function response value generated based on the power-on metastable state of the static random access memory cell, and the resulting mask seed is stored in the ordinary storage area; when the long-term hidden seed is needed, the mask seed is read in real time and XORed again with the physical non-cloning function response value to restore the original seed.

8. A back-side intrusion defense and self-destruction method for quantum cryptographic chips according to claim 1 or 7, characterized in that, In step S4, the thermal sensing network is a ring oscillator array deployed in the active area of ​​the chip bottom layer, which adopts a two-layer non-uniform distribution method combining a core high-density warning ring and a global background grid. The triggering conditions for the interlocking nullification mechanism are: the thermal sensing network detects a local transient temperature rise rate greater than 10°C / μs, or the chip temperature is lower than -20°C, or the ring oscillator frequency experiences an irreversible drift of more than ±5%.

9. A back-side intrusion defense and self-destruction method for quantum cryptographic chips according to claim 8, characterized in that, Once the interlocking nullification mechanism is triggered, atomic-level interlocking nullification operations are performed, including turning on the high-voltage charge pump to physically burn out the fuse structure on the long-term hidden seed reading path, and permanently locking the chip's response state to an implicit rejection mode that only returns fixed garbled characters.

10. A back-side intrusion defense and self-destruct device for quantum cryptographic chips, used to implement the method of any one of claims 1 to 9, characterized in that, include: A passive electromagnetic metamaterial shielding layer is integrated on the back side of the chip's silicon substrate; An active noise cancellation current compensator, located inside the chip, is connected in parallel with quantum cryptography-resistant accelerated nuclear physics; An asynchronous erase trigger is embedded in the chip's power supply rail and clock tree root node, and connected to a spare bypass capacitor; Physically unclonable function masking and thermal sensing interlocking networks are distributed in the underlying active transistor region of the chip.

11. A back-side intrusion defense and self-destruct device for quantum cryptographic chips according to claim 10, characterized in that, The asynchronous erase trigger includes an internal low-voltage detector and a watchdog oscillator, which are used to monitor the core power supply voltage and the master clock status, respectively; the physical unclonable function masking and thermal sensing interlocking network is configured with a volatile physical unclonable function based on the power-on metastable state of the static random access memory cell; the thermal sensing interlocking network is composed of a ring oscillator.

Images