Active ASIC intrusion shielding

Abstract

Device for protecting an integrated circuit against an invasive attack, the device comprising: a field of conductive traces arranged across at least one uppermost metal layer of the integrated circuit; a pseudorandom binary sequence generator (120) for generating a large number of bits; a true random number generator (130) for supplying an entropy source to at least one of a plurality of tap points that are led to the pseudorandom binary sequence generator (120); a comparator circuit connected to one end of the array of conductor tracks, wherein the comparator circuit determines whether at least one of the conductor tracks has an expected value, based on a bit generated by the pseudorandom binary sequence generator (120) and received at one end of the at least one conductor track; and a demultiplex circuit (110) that connects the pseudorandom binary sequence generator (120) to another end of the field of conductor tracks.

Description

BACKGROUND

[0001] A high-performance application-specific integrated circuit (ASIC) must be secure against a variety of specific attacks by unauthorized adversaries. One class of attack involves physically probing, modifying, or destroying the logic within the ASIC.This type of tampering typically involves multiple steps, including, for example, (1) physically exposing the package to gain physical contact with the wiring and logic on the silicon chip; (2) drilling holes in the surface protection layer to gain access to metal contacts; (3) physically probing (while active) the wires at the topmost layer of the device to determine their contents; (4) cutting top-level wires determined to be unimportant to gain access to more interesting content at lower layers, possibly down to the base layer; (5) using a focused ion beam (FIB) to cut wires to potentially disable critical security features; and (6) depositing metal to create new connections to modify critical functionality.

[0002] Despite the numerous steps involved, unauthorized parties are becoming increasingly sophisticated in their techniques for physically probing, modifying, and / or destroying the logic within ASICs. To protect against efforts to compromise the proper operation and functionality of a device, it is important to have a physical security system that can detect any of the above activities while the chip is active, as well as, at power-up, detect whether any of these activities occurred during the last power-down period.

[0003] US 2013 / 0 104 252 A1 relates to an integrated circuit and in particular to systems, devices and methods for integrating a tamper detection countermeasure into a security ASIC to ward off physical attacks.

[0004] US 2009 / 0 077 669 A1 describes a mesh protection system. The protection system comprises a plurality of grid lines that form a mesh near the operating logic.

[0005] US 2014 / 0 250 541 A1 describes a device comprising a mesh block, a first number generator configured to generate a first number, a second number generator configured to generate a second number, and a comparator block configured to compare the first number with the second number and generate an output signal from the mesh block. The output signal indicates the occurrence of unauthorized activity in the mesh block. SUMMARY

[0006] The summary introduces a selection of concepts in a simplified form to provide a basic understanding of some aspects of the present disclosure. This summary is not a comprehensive overview of the disclosure and is not intended to identify key or critical elements of the disclosure or to represent the scope of the disclosure. This summary merely presents some of the concepts of the disclosure as a prelude to the detailed description provided below.

[0007] The present disclosure generally relates to integrated circuits. More specifically, aspects of the present disclosure relate to protecting against invasive attacks on an application-specific integrated circuit.

[0008] An embodiment of the present disclosure relates to an apparatus for securing an integrated circuit against an invasive attack, the apparatus comprising: an array of conductive traces disposed over at least one topmost metal layer of the integrated circuit; a pseudorandom binary sequence generator for generating a plurality of bits; a true random number generator for providing an entropy source to at least one of a plurality of taps routed to the pseudorandom binary sequence generator;a comparison circuit connected to one end of the array of conductive traces, the comparison circuit determining whether at least one of the conductive traces has an expected value based on a bit generated by the pseudorandom binary sequence generator and received at one end of the at least one conductive trace; a demultiplexing circuit connecting the pseudorandom binary sequence generator to another end of the array of conductive traces;

[0009] In yet another embodiment, the apparatus for securing an integrated circuit against an invasive attack further comprises an alarm response system for determining whether to initiate one or more actions in response to the alarm signal generated by the comparison circuit.

[0010] In one or more other embodiments, systems and devices described herein may optionally include one or more of the following additional features: each of the plurality of bits generated by the pseudorandom binary sequence generator is unique from its neighboring bits when transferred to the array of traces; the pseudorandom binary sequence generator is a linear feedback shift register; a subset of the traces is switched according to a real-time clock period; the comparison circuit compares all of the traces each real-time clock cycle; the comparison circuit determines whether at least one of the traces has an expected value each real-time clock cycle; the demultiplexing circuit drives only one of the traces each real-time clock cycle, and the remaining traces are grounded;the comparison circuit detects one of a short-circuit fault, an open-circuit fault, and a stuck-circuit fault based on the signal at the second end of the at least one conductive trace; the comparison circuit generates an alarm signal in response to detecting one of a short-circuit fault, an open-circuit fault, and a stuck-circuit fault; the alarm response system determines whether a number of alarm signals generated by the comparison circuit meets a condition, and in response to determining that the number of alarm signals meets the condition, the alarm response system initiates the one or more actions; the alarm response system determines that the number of alarm signals meets the condition if the number of alarm signals generated by the comparison circuit exceeds a threshold number within a predetermined time period;the alarm response system determines that the number of alarm signals meets the condition if a time interval between the generation of each of the alarm signals is within a threshold time period; and / or the one or more actions include at least one of sending an interrupt to a processor of the integrated circuit and controlling a power supply of the integrated circuit.

[0011] It should be noted that embodiments of some or all of the processor and memory systems disclosed herein may also be configured to perform some or all of the method embodiments disclosed above. Additionally, embodiments of some or all of the method embodiments disclosed above may also be represented as instructions embodied on a non-transitory processor-readable storage medium, such as optical or magnetic storage.

[0012] Further applicability of the methods and systems of the present disclosure will become apparent from the detailed description provided below. However, it should be understood that the detailed description and specific examples, while indicating embodiments of the methods and systems, are given by way of illustration only, since various changes and modifications within the spirit and scope of the concepts disclosed herein will be apparent to those skilled in the art from this detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] These and other objects, features, and characteristics of the present disclosure will become more apparent to those skilled in the art from a study of the following detailed description in conjunction with the appended claims and drawings, all of which form a part of this specification. In the drawings: Fig. 1 is a block diagram illustrating an example system for defending against invasive attacks on an application-specific integrated circuit, in accordance with one or more embodiments described herein. Fig. 2 is a block diagram illustrating an exemplary arrangement of a security system and alarm response system for an integrated circuit according to one or more embodiments described herein. Fig. 3A- Fig. 3C illustrate example routing configurations for routing conductive traces across a layer of an integrated circuit in accordance with one or more embodiments described herein. Fig. 4 is a flow diagram illustrating an exemplary method for defending against invasive attacks on an application-specific integrated circuit, in accordance with one or more embodiments described herein.

[0014] The headings provided herein are for convenience only and do not necessarily affect the scope or meaning of what is claimed in the present disclosure.

[0015] For ease of understanding and convenience, the same reference numerals and any acronyms in the drawings identify elements or acts with the same or similar structure or functionality. The drawings will be described in detail in the course of the following detailed description. DETAILED DESCRIPTION

[0016] Various examples and embodiments of the methods and systems of the present disclosure will now be described. The following description provides specific details to fully understand and facilitate description of these examples. However, those skilled in the relevant art will understand that one or more embodiments described herein may be practiced without many of these details. Likewise, those skilled in the relevant art will also understand that one or more embodiments of the present disclosure may include other features not described in detail herein. In addition, some well-known structures or functions may be shown or described in detail below to avoid unnecessarily obscuring the relevant description.

[0017] Embodiments of the present disclosure relate to a defense mechanism or system designed to protect an integrated circuit (IC) (e.g., an ASIC) against, for example, probing attacks, FIBs, and other such sabotage. As will be described in more detail below, the defense mechanism may be an active physical security shield comprising an array of traces (e.g., conductive trace) on a high metal layer (e.g., at the one or two topmost metal layers available to entirely cover or substantially cover sensitive circuitry) of the IC, preferably covering a high percentage (e.g., 80%, 90%, 95%, etc.) of the surface area of ​​that layer, and a collection of digital logic components capable of driving signals across the traces.

[0018] According to at least one embodiment, signals (e.g., bits generated by a linear feedback register or similar) may be actively driven across the traces so that a short-circuit fault, an open-circuit fault (e.g., a broken trace), or a stuck-at fault (e.g., a signal or gate output is forced to a value of "0" or "1") on any of the traces can be detected within a short period of time. For example, according to at least one embodiment, the detection time for detecting a fault on one of the traces may be on the order of a few clock cycles, with the frequency being application-specific. For power-saving implementations, this may be on the order of a few microseconds for a gap to be detected. For example, at a frequency of 250 kHz, the detection time would be 1 / 250 kHz = 4 µs.

[0019] It should be noted that, according to one or more embodiments, there is a lower bound on fault detection times due to the propagation delay of signals over the wires (e.g., larger chips have larger propagation delays and therefore the detection times for such larger chips may be limited by the applicable propagation delay).

[0020] Furthermore, in one or more embodiments, the active safety system / mechanism of the present disclosure may be connected to include and / or otherwise be in communication with an associated alarm response mechanism or system (e.g., a particular processor of the integrated circuit) (e.g., via a direct or indirect connection via a wired or wireless network) such that a fault detected by the safety system may be indicated as an alarm sent to the alarm response mechanism. In at least one embodiment, the safety system and / or alarm response mechanism may be connected to or in communication with a processor of the IC. For example, if a safety system determines (e.g.,through the alarm response mechanism) that an actionable response should be made to address a potential threat to the IC, various protective or preventive measures are initiated, such as an interrupt for the processor, a complete shutdown of the IC, or similar.

[0021] Fig. 1 is an exemplary security system 100 for defending against invasive or intrusive attacks on an IC. According to at least one embodiment, the system 100 includes an M-bit PRBS (pseudo-random binary sequence) generator circuit 120, a true random number generator (TRNG) circuit 130 to provide an entropy source to the PRBS generator circuit 120, an N-wire bus 140 crossing a high metal layer of the IC (e.g., on one or two topmost metal layers available to entirely cover or substantially cover sensitive circuitry of the IC), a demultiplexer circuit 110 to convert M to N, and a comparator circuit 150 to check and ensure that the N wires have the correct (e.g., expected) value at a sample time.In addition, the system 100 may also include one or more registers to control various components of the system, as well as an alarm response mechanism or circuit (not shown).

[0022] According to one or more embodiments, other routing configurations for the N-wire bus 140 may be used in addition to or instead of the example configuration shown. These other routing configurations may depend on a variety of factors, including, for example, the number (N) of traces (e.g., 1000 wires, 1200 wires, 1485 wires, 1550 wires, etc.), the thickness of the wires, spacing between adjacent wires, and the like.

[0023] Examples of such other leadership configurations are in the Fig. 3A to Fig. 3C. For example, the array of conductive traces (of the N-wire bus 140) can be laid across the metal layer of the IC in a zigzag configuration (320 as shown in Fig. 3A) or in a labyrinth-like configuration (340 as shown in Fig. 3B). It should be understood that various other routing configurations may also be used, as long as such configurations ensure maximum coverage while also avoiding areas where simple cuts and jumps (with FIB + decomposition) can be performed over an area of ​​interest. For example, the N-wire bus 140 may be designed to contain as many unique traces covering the chip as possible, so that any reasonable opening requires a large number of cuts and jumps, which is expensive and difficult. Furthermore, in at least one embodiment, more than one topmost metal layer of the IC may be used for the wire bus. For example, with a topmost metal layer of the IC, conductive traces may be routed across a surface of the layer in a first direction (e.g.,horizontally or across the width of the layer), and for a metal layer just beneath the topmost layer, conductor tracks can be routed across the surface of the layer in a second direction perpendicular to the first direction (e.g. vertically or across the length of the layer). Fig. Figure 3C shows an example of such an arrangement (360).

[0024] According to at least one embodiment, the M-bit PRBS generator circuit 120 (where "M" is any value, such as 99) may be a linear feedback shift register (LFSR) where M-1 bits are shifted down, and the new bit shifted in is an exclusive-or (XOR) operation (e.g., using an XOR gate) of multiple taps in the register, including the bit shifted out and a bit tied to an entropy source (e.g., coming out of the TRNG 130) to increase randomness. It is known to those skilled in the art that a PRBS with the correct sequence of taps for any value M with a repetition period of 2 M-1 can be generated without an entropy source. However, with an entropy source, such as TRNG 130, there should be no predictable repetition.

[0025] It should be noted that, in order to minimize power consumption (e.g., since in at least one embodiment the number of traces crossing the chip may be relatively large, each with a reasonable amount of capacitance), shifting of the PRBS generator 120 may not be performed every core cycle. Rather, the PRBS generator 120 may be shifted according to a real-time clock (RTC) that cycles on the order of, for example, 250 kHz. According to at least one embodiment, the RTC may be separate from the main (core) clock of the chip. In such an embodiment, the RTC may be slower than the main clock to help reduce power consumption and on-chip noise.It should be noted that although a clock (RTC) may be used separately from the main clock for the security system (the shield), such a separate clock may not be strictly dedicated to the security system, but may instead serve additional purposes and / or components of the chip.

[0026] It should be understood that in the exemplary system described herein (e.g., system 100), the exact value of what is generated by the PRBS generator circuit 120 is of less significance than that each bit of the PRBS 120 changes in a relatively obscure manner and at a relatively frequent rate (e.g., 250 kHz updates) such that each bit (as transferred to the array of wires 140) is unique from its neighboring bits. The bits of the PRBS 120 are said to change in an "obscure" manner based on the fact that they change in an "obscure" manner, that the PRBS 120 is updated with the output of the TRNG 130. If the PRBS 120 were powered only at startup (or were repowered very infrequently), then an attacker could potentially predict future values ​​of the PRBS 120 based on previous values.Thus, the TRNG 130 is designed to obfuscate future values ​​of PRBS 120, making it much more difficult for attackers to guess future values ​​(which could then drive attackers to cut wires to avoid detection). While updates of 250 kHz are relatively slow (e.g., compared to core clock frequencies ten times higher than MHz), it should be understood that "frequently" in terms of the rate at which each bit of PRBS 120 can change may mean often enough that cutting and jumping may not be possible while the chip is active.

[0027] It should be noted that it is not necessary (although possible) for all of the traces to be switched at the same time. For example, in at least one implementation, the amount of switching may be reduced (e.g., 1 for 15 wires switches every RTC clock period) so as not to physically draw too much current on each RTC clock edge. In such an embodiment, the next adjacent wire (e.g., to the one that is switched) may be switched on the next clock cycle, and so on. According to one or more other embodiments, an additional PRBS may be used to randomly determine which one or more of the traces to switch during the next clock cycle, rather than linearly stepping through the traces as described above.

[0028] To reduce logic complexity and area, the size of PRBS generator circuit 120 may be significantly smaller than the number of wires (N) in wire bus 140 crossing the chip. To connect the M-bit PRBS 120 to the N wires crossing in the metal, system 100, in one or more embodiments, may include a demultiplexing logic circuit 110. For example, according to at least one embodiment, the ratio N:M is an integer denoted as R. In demultiplexing logic circuit 110, only one of R wires may be driven in each cycle, while the other wires remain grounded for that cycle (where "cycle" refers to the period of shifting of PRBS 140 in each RTC clock cycle). In each new cycle of PRBS 120, the next of the R wires may be driven.Such a technique effectively results in an assignment of the wires as follows (where such assignment is merely for illustrative purposes), where cur_sel is a register that holds a value from 0 to R-1, indicating which wire is to be driven within the container: for(a=0;a <M;a++) für(b=0;b<R;b++) DRÄHTE[a*R+b]=(cur_sel==b)& prbs[a].

[0029] According to at least one embodiment, more than one of the R wires may be driven per cycle of PRBS 120. However, depending on the particular implementation, power (e.g., battery-powered devices may have stringent power requirements) and / or signal integrity (e.g., whether the shield introduces too much noise that the main circuitry of the IC is affected) may limit the number of wires driven for a given cycle of PRBS 120. In an embodiment where more than one wire may be driven simultaneously, the wires may be physically separated so that power consumption is distributed across the entire power grid (and its bypass capacity) of the IC.

[0030] The physically drawn array of N wires (N-wire bus 140) crossing a high metal layer of the IC creates a physically and electrically dense grid designed to withstand various types of invasive attacks, including, for example, probing, visual inspection, and the like. The array of wires can be connected to the rest of the logic (e.g., demultiplexing circuit 110 and / or comparator circuit 150) via, for example, placement and routing.

[0031] The N-wire bus 140 may be connected to the comparator circuit 140 to ensure that all values ​​are as expected at a sample time. This includes not only the M active wires driving the PRBS values ​​(e.g., bit values), but also the NM wires, which should be set to a value of zero or grounded. For the comparator circuit 150 to determine whether the values ​​driven across the active wires are what they should be (and also to determine which wires should be grounded or set to a value of zero), the comparator circuit 150 may be connected to PRBS 120 to receive the expected values ​​(170). According to at least one embodiment, the comparator circuit 150 may be configured to perform the comparison logic on every RTC clock cycle, providing ample time for the signals to propagate across the wiring array 140.

[0032] According to at least one embodiment, a value mismatch on the wiring pad 140 may be an indication of a breach in the defense shield (e.g., the security system 100) or an attack on the ASIC. Such a value mismatch may be detected, for example, by the comparator circuit 150, which sends a signal to an associated alarm response mechanism (160). Depending on the implementation, the alarm response mechanism may be part of the security system 100, or connected to it and / or otherwise in communication therewith (e.g., via a direct or indirect connection over a wired or wireless network) such that the signal generated by the comparator circuit 150 (160) is received and processed by the alarm response mechanism in an efficient manner.

[0033] Fig. 2 shows an exemplary arrangement of a security system 210 and an alarm response system 220 for an integrated circuit. According to at least one embodiment, the security system 210 may be in communication with (e.g., via a network) or connected to (e.g., via a wired or wireless connection) the alarm response system 220, such that when the security system 210 detects a possible fault or a potential breach in the defense shield of the integrated circuit, the security system 210 may send (e.g., transmit, deliver, etc.) a signal to the alarm response system 220 (e.g., a signal (160) to the alarm response mechanism at Fig. 1), and the alarm response system 220 can determine whether any action should be taken, and if so, what specific action should be taken.

[0034] The alarm generated or the response made by the alarm response system 220, for example, in response to receiving a signal from the security system 210 (e.g., a signal (160) from the comparator circuit 150 of the Fig. 1 and described in detail above) may be handled in a number of configurable ways. For example, an alarm may be in the form of an actionable response, such as an interrupt to processor 230 or a partial or complete shutdown of the integrated circuit by controlling power supply 240. Depending on the particular attack, it may be best for the response to be slow and measured, or it may be better for the response to be fast and destructive. In another example, alarm response system 220 may be configured to make it appear as if nothing at all has happened, while in reality, the secrets of the device (e.g., the ASIC) are locked or otherwise secured.Thus, according to at least one embodiment, the security system 210 may include or operate in conjunction with an alarm response system (a mechanism 220) configured to have varying levels of response (e.g., allocating a particular type of response to a given threat).

[0035] It should be noted that even if the ASIC is switched off or in an “off” state, the security system (e.g. the one in Fig. 1) may continue to monitor activity every RTC clock cycle. For example, any detected intrusion may result in the incrementation of a counter active during a power-off state (e.g., using always-on logic). Upon returning from the power-off state (e.g., when the ASIC is powered up or otherwise switched to the "on" state), the non-always-on logic becomes available and immediately captures (e.g., determines) the value of the counter. If the value is non-zero, an alarm may be sent, and the value of the counter may be stored for subsequent use (e.g., to be retrieved by an associated program).

[0036] Fig. 4 is an exemplary process 400 for defending against invasive attacks on an application-specific integrated circuit.

[0037] At a block 405, a value (e.g., a random value) of PRBS (e.g., the PRBS generator circuit 120 in Fig. 1). For example, PRBS may be updated using an output generated by a TRNG (e.g., TRNG 130) to thereby provide a source of entropy to PRBS and make it more difficult for a potential attacker to guess future values ​​of PRBS.

[0038] At a block 410, the updated random value of PRBS can be transmitted via the wiring field (e.g., the N-wire bus 140 in the Fig. 1). According to at least one embodiment, the updated value of PRBS (from block 405) may be driven across one or more of the conductive traces forming the array.

[0039] At block 415, a determination may be made as to whether the value driven via the wiring array at block 410 matches (is the same as) the expected value. For example, according to at least one embodiment, the determination made at block 415 may be based on a comparison (e.g., performed by comparator circuit 150 at Fig. 1) of the value transferred to the array at one end with the value received at the other end of the array. Such a comparison may involve not only the one or more active wires of the array that drive the PRBS values ​​(e.g., the bit values ​​generated at block 405), but also the traces of the array that are set to a value of zero or ground. According to at least one embodiment, the comparison at block 415 may be performed every RTC clock cycle, allowing ample time for the signals to propagate across the wiring array (at block 410).

[0040] If it is determined at block 415 that the driven value is the same as the expected value, the process may return to block 405 where the PRBS value is updated again.

[0041] On the other hand, if it is determined at block 415 that the value driven across the wiring array does not match the expected value, then an alarm may be generated at a block 420. For example, according to at least one embodiment, a value mismatch on the wiring array (determined at block 415) may be an indication of a breach in the defense shield (e.g., the security system 100) or an attack on the ASIC. If such a value mismatch is detected at block 415 (e.g., by the comparator circuit 150), then an alarm signal (e.g., the signal (160) at the Fig. 1) at block 420. The alarm generated at block 420 may be sent to an alarm response mechanism or system associated with the security system (e.g., the alarm response system 220 as shown in Fig. 2) is associated with or is a part of.

[0042] At block 425, it may be determined whether, based on the alarm generated at block 420, a number of generated alarms meets a condition. For example, according to at least one embodiment, the determination made at block 425 may be a determination regarding whether a threshold number of alarms (e.g., 3 alarms, 5 alarms, 10 alarms, etc.) has been generated during a predetermined time period (e.g., 30 seconds, 2 minutes, 5 minutes, etc.), whether a threshold number of alarms has been generated within a specific time interval (e.g., 5 seconds, 30 seconds, etc.) of each other, which may be indicative of a certain type of potential attack on the chip, or the like. If it is determined at block 425 that the number of generated alarms does not meet the condition, the process may return to block 405, where a PRBS value is updated.

[0043] If, instead, it is determined at block 425 that the number of generated alarms meets the condition, then a determination may be made at block 430 as to whether an error or failure detection masking process or parameter is in place. If it is determined at block 430 that the detected error or failure should be masked, the process may return to block 405. For example, in accordance with at least one embodiment, the alarm response system (e.g., the alarm response system 220 as described in Fig. 2) to make it appear that nothing has happened at all (e.g., an error or failure detection masking at block 430), while in reality the secrets of the device (e.g., the ASIC) are locked or otherwise secured.

[0044] On the other hand, if it is determined at block 430 that no error or failure detection masking is in place, then at block 435, an actionable response to the alarm generated at block 420 may be initiated. Such an actionable response may be, for example, an interrupt to the chip's processor (e.g., processor 230) or a partial or complete shutdown of the chip by controlling the power supplied to the chip (e.g., controlling a power supply 240). Depending on the specific circumstances (e.g., the number of alarms generated within a time period, the time intervals between generated alarms, etc.), the response initiated at block 435 may be a slow and calculated response, or instead, the response may be fast and destructive.

[0045] The foregoing detailed description has set forth various embodiments of the devices and / or processes through the use of block diagrams, flowcharts, and / or examples. To the extent that such block diagrams, flowcharts, and / or examples include one or more functions and / or operations, it will be understood by those skilled in the art that each function and / or operation within such block diagrams, flowcharts, or examples may be implemented individually and / or collectively via a wide range of hardware, software, firmware, or virtually any combination thereof. According to at least one embodiment, various portions of the subject matter described herein may be implemented via one or more ASICs, field-programmable gate arrays (FPGAs), digital signal processors (DSPs), or other integrated formats.However, those skilled in the art will recognize that some aspects of the embodiments disclosed herein may be implemented in whole or in part equivalently in one or more integrated circuits, as one or more computer programs running on one or more computers, as one or more programs running on one or more processors, as firmware, or as virtually any combination thereof, and that developing the circuitry and / or writing code for the software and / or firmware would be well within the skill of one skilled in the art in light of this disclosure.

[0046] Additionally, those skilled in the art will recognize that the mechanisms of the subject matter described herein are capable of being distributed as a program product in a variety of forms, and that an illustrative embodiment of the subject matter described herein applies regardless of the particular type of non-transitory signal carrying a medium used to actually carry out the distribution. Examples of a medium carrying a non-transitory signal include, but are not limited to, a recording-type medium such as a floppy disk, a hard disk drive, a compact disc (CD), a digital video disc (DVD), a digital tape, computer memory, etc.

[0047] With respect to the use of substantially any plural and / or singular expressions herein, those skilled in the art may translate from the plural to the singular and / or from the singular to the plural as appropriate to the context and / or application. The various singular / plural substitutions may be expressly set forth herein for clarity.

[0048]

[0046] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve desired results. In addition, the processes shown in the accompanying figures do not necessarily require the particular order shown or a sequential order to achieve desired results. In certain implementations, multitasking and parallel processing may be advantageous.

[0049] According to embodiments, systems, methods, and devices are provided for protecting an integrated circuit against invasive attacks and various forms of sabotage. One defense mechanism is an active physical security shield that includes an array of traces on a high metal layer of the integrated circuit, covering a high percentage of the surface area of ​​that layer, and a collection of digital logic components that drive signals across the traces. Driving the signals across the traces is performed in an active manner such that a short-circuit, open-circuit, or stuck-in fault on any of the traces is detected within a very short period of time.The active safety system is connected to or in communication with an alarm response mechanism so that a fault detected by the safety system results in a signal being sent to the alarm response mechanism.

Claims

[1] A device for securing an integrated circuit against an invasive attack, the device comprising: an array of conductive traces arranged across at least one topmost metal layer of the integrated circuit; a pseudorandom binary sequence generator (120) for generating a plurality of bits; a true random number generator (130) for providing a source of entropy to at least one of a plurality of taps connected to the pseudorandom binary sequence generator (120); a comparison circuit connected to one end of the array of conductive traces, the comparison circuit determining whether at least one of the conductive traces has an expected value based on a bit generated by the pseudorandom binary sequence generator (120) and received at the one end of the at least one conductive trace; and a demultiplexing circuit (110) connecting the pseudorandom binary sequence generator (120) to another end of the array of conductor tracks. [2] The apparatus of claim 1, wherein each of the plurality of bits generated by the pseudorandom binary sequence generator (120) is unique from its neighboring bits when transferred to the array of conductive traces. [3] The apparatus of claim 1 or 2, wherein the pseudorandom binary sequence generator (120) is a linear feedback shift register. [4] The device of any one of claims 1 to 3, wherein a subset of the conductive lines is switched according to a real-time clock period. [5] The device of any one of claims 1 to 4, wherein the comparison circuit compares all of the conductive traces in each real-time clock cycle. [6] The apparatus of any one of claims 1 to 5, wherein the comparison circuit determines for each real-time clock cycle whether at least one of the conductive lines has an expected value. [7] The apparatus of claim 1, wherein the demultiplexing circuit (110) drives only one of the conductive lines in each real-time clock cycle, and the remaining conductive lines are grounded. [8] The device of any one of claims 1 to 7, wherein the comparison circuit detects one of a short circuit fault, an open circuit fault, and a stuck fault based on the bit received at the second end of the at least one conductive line. [9] The apparatus of claim 8, wherein the comparison circuit generates an alarm signal in response to detecting one of a short circuit fault, an open circuit fault, and a stuck fault. [10] The apparatus of claim 9, further comprising: an alarm response system (220) for determining whether to initiate one or more actions in response to the alarm signal generated by the comparison circuit. [11] The apparatus of claim 10, wherein the alarm response system (220) determines whether a number of alarm signals generated by the comparison circuit satisfies a condition, and in response to determining that the number of alarm signals satisfies the condition, the alarm response system (220) initiates the one or more actions. [12] The apparatus of claim 11, wherein the alarm response system (220) determines that the number of alarm signals satisfies the condition when the number of alarm signals generated by the comparison circuit exceeds a threshold number within a predetermined time period. [13] The apparatus of claim 11 or 12, wherein the alarm response system (220) determines that the number of alarm signals satisfies the condition when a time interval between the generation of each of the alarm signals is within a threshold time period. [14] The apparatus of any of claims 10 to 13, wherein the one or more actions include at least one of sending an interrupt to a processor (230) of the integrated circuit and controlling a power supply (240) of the integrated circuit.

Images