Physically obfuscated circuit

Abstract

A physically obfuscated circuit comprises several sub-circuits, each sub-circuit comprising: several series-connected transistors of a first conductivity type; at least one transistor of a second conductivity type, which is different from the first conductivity type; wherein the transistors are connected such that, if supplied with a first reference potential at their respective control terminals, the several series-connected transistors of the first conductivity type supply a second reference potential, which is different from the first reference potential, to the control terminal of the at least one transistor of the second conductivity type;and which, if supplied with a second reference potential at its control terminal, provides the first reference potential to the control terminal of each of the several series-connected transistors of the first conductivity type; and a pre-charge circuit configured to pre-charge the sub-circuit to a first state in which the potential at the control terminal of the at least one transistor of the second conductivity type is different from the second reference potential, and the potential at the control terminal of each of the several series-connected transistors of the first conductivity type is different from the first reference potential.

Description

[0001] The invention relates to a physically obfuscated circuit.

[0002] Piracy and reverse engineering of integrated circuits (ICs) are considered one of the most serious threats to the semiconductor industry, as they can be abused to steal and / or pirate a design: successful attackers can overbuild or fabricate ICs and sell similar, i.e., "cloned" ICs; they can illegally use or sell the extracted and stolen IP and sell competitors' trade secrets, etc. For all these reasons, it is desirable to develop concepts and techniques that prevent IC piracy and reverse engineering.

[0003] Embodiments of the invention are illustrated in the figures and are explained in more detail below.

[0004] It shows Fig. 1 a chip card as an example; Fig. 2 a TIE cell; Fig. 3 a POC cell with two TIE cells; Fig. 4 a time course diagram for the POC cell Fig. 3; Fig. 5 another POC cell, which is a variant of the POC cell from Fig. 3 can be viewed; Fig. 6 a POC cell according to another example; Fig. 7 shows a time course diagram for the POC cell Fig. 6; Fig. 8 a POC cell that is the CMOS complement of the POC cell from Fig. 3 can be; Fig. 9 a time course diagram for the POC cell Fig. 8; Fig. 10 illustrates a physically obfuscated circuit according to one embodiment.

[0005] The following detailed description refers to the accompanying drawings, which show specific details and aspects of this disclosure by way of illustration in which the invention may be practiced. Other aspects may be utilized, and structural, logical, and electrical changes may be made without departing from the scope of the invention. The various aspects of this disclosure are not necessarily mutually exclusive, as some aspects of this disclosure may be combined with one or more other aspects of this disclosure to form new aspects.

[0006] Throughout this description, the terms "connected," "attached," and "coupled" are used to describe both a direct and an indirect connection, a direct or indirect connection, and a direct or indirect coupling. In the figures, identical or similar elements are provided with identical reference numerals where appropriate.

[0007] A promising approach for reliable and secure identification and authentication of ICs involves using so-called physically random functions or physically obfuscated circuits (POCs) to securely generate on-chip secret keys for cryptographic algorithms. Ideally, silicon POCs generate chip-specific keys that are randomly repeatable but unpredictable and cannot be externally determined. This can be achieved by exploiting random variations in IC manufacturing processes while simultaneously suppressing global process, temperature, and supply voltage variations and noise.

[0008] Because these POCs can be integrated together on-chip with dedicated control logic, any attempt to physically access the POC circuitry itself can be very effectively and efficiently restricted. This significant resistance to physical attacks is the main advantage of using controlled silicon POCs.

[0009] In addition, only weak POCs are required for secret key generation, i.e. POCs that generate POC values ​​for only a limited number of challenge-response pairs (compared to other possible challenge-response pairs).

[0010] A POC value P can be thought of as a kind of fingerprint of a physical object. Using the true POC value P, i.e., the POC value at its registration, the physical object can be uniquely identified, and, for example, a key can be produced based on the identification. The physical object can be a controller or a microcontroller. It can also be a chip card IC (integrated circuit) of a chip card, such as a smart card with any form factor, e.g., for a passport or for a SIM (Subscriber Identity Module).

[0011] Fig. 1 shows a chip card 100 as an example.

[0012] The chip card 100, which is illustrated here in the card format but may have any form factor, comprises a carrier 101 and a chip card module 102.

[0013] The chip card module 102 includes various components, such as, for example, a non-volatile memory 103 and a CPU (central processing unit) 104. In various embodiments, the chip card includes a component 105 that serves as a POC source, for example, a circuit including multiple subcircuits, where an output of a subcircuit specifies (or is used as a basis for) one or more bits of a POC value. It should be noted that the chip card 100 using a POC is only an example and may be a device including any type of integrated circuit.

[0014] The POC value P can be considered an identification number for the chip card 100 (more precisely, for the chip card module 102 within the chip card 100). For example, the chip card module 102 has a cryptoprocessor that derives a cryptographic key unique to a chip card 100 from this identification number, or the CPU 104 itself derives a cryptographic key from it.

[0015] For security reasons, neither the true POC value P nor the cryptographic key derived from it are stored on the chip card 100. Instead, a so-called POC module 106 is located on the chip card 100 and is connected to the physical object 105. If the POC value P is required (e.g., for key generation), a so-called POC request is made to the POC module 106, whereupon the POC module 106 determines the POC value again in each case (by means of an internal electronic operation). In other words, the POC module 106 responds to a POC request by outputting a POC value P', which may deviate to a greater or lesser extent from the true POC value P, i.e., the POC value upon registration thereof, depending on the bit stability of the bits provided by the POC source 105.

[0016] There are different approaches to realizing controlled silicon-based POCs (ie, POC sources 105), e.g., SRAM-based, sense amplifier-based, butterfly-based, and latch-based POC arrays on the one hand, and delay-based POCs, such as ring oscillator POCs and arbiter POCs on the other hand.

[0017] Approaches such as SRAM POCs (based on the process variation-induced tendency of single-bit cells to preferentially adopt one of their two stable states upon power-up) typically suffer from severe limitations, such as poor bit stability and high vulnerability to semi-invasive attacks, such as electrical and optical probing, and / or inadequate statistical quality.

[0018] Regarding delay-based POCs, such as ring oscillator (RO) and arbiter POCs (which compare the delays of two ideally identically implemented delay lines), there are similar limitations regarding bit stability and statistical quality, whereas their known weakness against model-building attacks is irrelevant for on-chip cryptographic key generation because the very small number of controlled silicon POC challenge-response pairs is never directly exposed and cannot be determined externally.

[0019] Implementing silicon arbiter POCs typically results in relatively poor statistical quality and POC bit stability. On the one hand, irregular placement and automated routing of the arbiter POC elements leads to asymmetric wiring and, consequently, systematic delay distortions, i.e., poor statistical quality. On the other hand, the delay differences between the two paths with the same nominal layout length depend only on the small process variations of the involved gates and wiring representing the competing delay paths, resulting in poor bit stability. This, in turn, requires the generation of so-called helper data during POC enrollment, i.e., together with initial key generation, as well as expensive and time-consuming (in terms of gate and area count, as well as energy dissipation) error correction during in-field key reconstruction.

[0020] For example, POC bit stability can be increased by a so-called stable bit marking or a pre-selection of POC bits (whereby non-stable bits are discarded during entry and are no longer considered during reconstruction).

[0021] In the following, approaches are described for realizing a secure and cost-effective POC, e.g., for secret key generation, which has significantly improved security against physical attacks and demonstrates a reproducibility so high that error correction is not necessary (which is a considerably expensive measure and typically indispensable for conventional POCs).

[0022] These features are achieved by a POC circuitry that exploits extremely nonlinear electrothermal deep subthreshold relaxation processes from nonequilibrium to confined equilibrium states.

[0023] In particular, according to various embodiments, the POC source 105 is based on so-called TIE cells, as in Fig. 2 is illustrated.

[0024] Fig. 2 shows a TIE cell 200.

[0025] The TIE cell 200 includes a p-channel field-effect transistor (FET) 201, whose source (as an example of a controlled terminal) is connected to a high supply potential (e.g., VDD), whose gate (as an example of a control terminal) is connected to the drain of an n-channel field-effect transistor 202, and whose drain (as an example of another controlled terminal) is connected to the gate of the n-channel field-effect transistor 202. The source of the n-channel field-effect transistor 202 is connected to a low supply potential (e.g., VSS). It should be noted that all FETs mentioned here can be, for example, MOSFETs (metal-oxide-semiconductor field-effect transistors) and can be formed using CMOS (complementary MOS) technology.

[0026] The node (or connection) connecting the gate of p-channel field-effect transistor 201 to the drain of n-channel field-effect transistor 202 is hereinafter referred to as TN, and the node (or connection) connecting the gate of n-channel field-effect transistor 202 to the drain of p-channel field-effect transistor 201 is hereinafter referred to as T. For simplicity, the state of a node is referred to by the name of the node; e.g., T also refers to the state (or signal) at node T.

[0027] First, the case of limited electrothermal equilibrium is considered. It is assumed that the supply potential difference VDD-VSS is high enough so that, in steady-state equilibrium, the two FETs 201 and 202 operate with strong inversion (i.e., they exhibit fully developed channel inversion): VDD−VSS>Vth(n−channel FET 202)+|Vth(p−channel FET 201)| where Vth(FET) is the threshold voltage of the FET shown in parentheses.

[0028] Then the expected values ​​of the node voltage are the steady-state values ​​V(T) = VDD and V(TN) = VSS. This means that even for time-varying voltages VDD and VSS, the time-averaged values ​​are the steady-state (and time-averaged) values ​​V(T) = VDD and V(TN) = VSS given above.

[0029] In addition, the relaxation time of the circuit ranges from a few hundred ps to the nanosecond regime, depending on the process technology, supply voltage, and temperature. This means that the potentials V(T) and V(TN) relax from small perturbations (deviations from their steady-state values) to their steady-state values ​​VDD and VSS with relaxation times in the (sub-)nanosecond regime.

[0030] However, for large deviations of V(T) and V(TN) from their equilibrium values, a completely different behavior of the TIE cell circuit components results. In particular, the extreme case of the following initial condition is considered: V(T)=VSS and V(TN)=VDD at time t=0.

[0031] That is, the node voltages are first held at the "inverse" values ​​relative to their equilibrium values ​​above, so that initially the two FETs 201, 202 are OFF, i.e., they are both in their deep subthreshold domain.

[0032] If the initial condition is then released for t > 0 (i.e., nodes T and TN are no longer forced to their initial values), the circuit arrangement 200 is initially in a non-equilibrium state, namely, a state as far as possible from its steady-state state described above. Consequently, the potentials of nodes T and TN move in the direction of their equilibrium (steady-state) values ​​V(T) = VDD and V(TN) = VSS due to unavoidable (deep) sub-threshold currents. However, the transition is an extremely nonlinear transition that strongly depends on the VDD voltage level relative to VSS, on the temperature T, and in particular on the unavoidable manufacturing process variations of the circuit components (here, FETs 201, 202), so that two instances (copies) of the "same" TIE cell will, with a very high probability, differ in their relaxation times.

[0033] According to various embodiments, two (or more than two, see examples described below) copies of circuits exhibiting the above TIE cell behavior upon relaxation from a state far from equilibrium are used for a POC circuit. Such circuits are particularly suitable for a POC circuit due to the extremely broad statistical distribution of deep subthreshold relaxation times due to manufacturing variations.

[0034] In particular, a dedicated circuit arrangement based on the above-described deep subthreshold TIE cell relaxation from non-equilibrium states far from their steady states is introduced (e.g., as in the POC source 105), such as in Fig. 3 is illustrated.

[0035] Fig. 3 shows a POC cell 300.

[0036] Like all POC cells described herein, multiple POC cells 300 may be included in a circuit configured to generate one or more POC values, e.g., POC source 105.

[0037] The POC cell 300 includes a first TIE cell 312. The first TIE cell 312 comprises a series connection of a first p-channel FET 301 and a second p-channel FET 314, and a first n-channel FET 302. The first p-channel FET 301 and the second p-channel FET 314 are cross-coupled to the first n-channel FET 302 and connected to VDD and VSS, respectively, as described with reference to Fig. 2, but the p-channel FET 201 there is replaced by a series connection of the first p-channel FET 301 and the second p-channel FET 314. Furthermore, the POC cell 300 additionally includes a first precharge control circuit arrangement for the first TIE cell 312, which is formed by a second n-channel FET 304 and a third n-channel FET 305.

[0038] Furthermore, the POC cell 300 optionally comprises an input inverter 303 and a first buffer 316 and a second buffer 317 arranged in series between an input S and the first precharge control circuitry and a second precharge control circuitry (which will be explained in more detail below).

[0039] The output of the first buffer 316 (which is connected to an input of the second buffer 317) is connected to the series connection of p-channel FETs 301, 314 of the first TIE cell (in particular to the source of the first FET 701 in the series) and to the series of p-channel FETs 307, 315 of the second TIE cell (in particular to the source of the third p-channel FET 307 in the series connection).

[0040] The first buffer 316 receives the control input signal S (hereinafter also referred to as control input S) and buffers it. On the output side, the first buffer 316 provides a first buffered control input signal SD to an input of the second buffer 317. The second buffer 317 receives the first buffered control input signal SD (which is thus delayed in time relative to the control input signal S) from the first buffer 316 and also buffers it. On the output side, the second buffer 317 provides a second buffered control input signal SDD (which is thus additionally delayed in time relative to the control input signal S) to an input of the input inverter 303. The input inverter 303 receives the second buffered control input signal SDD from the second buffer 317 and inverts it to an inverted control signal SN, which it supplies to the gate of the second n-channel FET 304 and to the gate of the third n-channel FET 305.

[0041] The drain of the second n-channel FET 304 is connected to the source of the first p-channel FET 301, and its source is connected to the gate of the first p-channel FET 301 and to the gate of the second p-channel FET 314. The source of the third n-channel FET 305 is connected to the source of the first n-channel FET 302, and its drain is connected to the gate of the first n-channel FET 302.

[0042] The drain of the second p-channel FET 314 is further connected to an input of a first output inverter 306, whose output Z1 is one of the outputs of the POC cell 300. The drain of the third n-channel FET 305 is also connected to the input of a first output inverter 306.

[0043] The POC cell 300 further includes a second TIE cell 313. The second TIE cell 313 comprises a series connection of a third p-channel FET 307 and a fourth p-channel FET 315, as well as a fourth n-channel field-effect transistor 308. The third p-channel FET 307 and the fourth p-channel FET 315 are cross-coupled to the fourth n-channel field-effect transistor 308 and connected to VDD and VSS, respectively, as described with reference to Fig. 2, but the p-channel FET 201 there is replaced by a series connection of the third p-channel FET 307 and the fourth p-channel FET 315. Furthermore, the POC cell 300 additionally includes a second precharge control circuit arrangement for the second TIE cell 313, which is formed by a fifth n-channel FET 309 and a sixth n-channel FET 310.

[0044] The gate of the fifth n-channel FET 309 receives the inverted control input signal SN. The inverted control signal SN is further supplied to the gate of the sixth n-channel FET 310.

[0045] The drain of the fifth n-channel FET 309 is connected to the source of the third p-channel FET 307 and its source is connected to the gate of the third p-channel FET 307 and to the gate of the fourth p-channel FET 315.

[0046] The source of the sixth n-channel FET 310 is connected to the source of the fourth n-channel FET 308 and its drain is connected to the gate of the fourth n-channel FET 308.

[0047] The drain of the fourth p-channel FET 315 is further connected to an input of a second output inverter 311, whose output Z0 is another of the outputs of the POC cell 300. The drain of the sixth n-channel FET 310 is also connected to the input of the second output inverter 311.

[0048] The nodes TN and T of the first TIE cell 312 are denoted as Y1 and Y1N, respectively. The nodes TN and T of the second TIE cell 313 are denoted as Y0 and Y0N, respectively.

[0049] The POC cell 300 can be used (e.g., in the POC source 105) to generate one bit of a POC value. It can therefore also be referred to as a POC bit cell. As explained, it has two subcircuits, each containing a TIE cell 312, 313 and precharge circuitry for enforcing and releasing the non-equilibrium initial condition.

[0050] If the control input S is set to logic “0” (i.e., the VSS level), the first precharge circuitry and the second precharge circuitry (for the two TIE cells 312, 313) enforce TIE cell initial conditions V(Y1)=VDD, V(Y1N)=VSS, and V(Y0)=VDD,V(Y0N)=VSS, since then all precharge transistors 304, 305, 309, 310 for the TIE cell nodes Y1, Y1n and Y0, Y0N are in their respective ON states (with the FETs 304, 305, 309, 310 in strong inversion).

[0051] Fig. 4 shows a timing diagram 400 of a precharge and subsequent relaxation (ie, a precharge and relaxation process sequence) for the POC cell 300 of Fig. 3.

[0052] The signals S, Y1, Y1N, Y0, Y0N, Z1, Z0 are shown with time from left to right (where in each case a line at the top represents a higher potential (e.g. equal to or close to the high operating potential VDD) and a line further down represents a lower potential (e.g. equal to or close to the low operating potential VSS)).

[0053] First, the precharge circuitry for the two TIE cells 312, 313 enforces the TIE cell initial conditions V(Y1)=VDD,V(Y1N)=VSS, V(Y0)=VDD,V(Y0N)=VSS.

[0054] This state is referred to as the reset state 401 or the initial state. Then, the control input S is set to logic "1" (denoted by reference numeral 403), initiating a POC access state 402. After the POC access, the control input S is reset to logic "0," causing the circuit to re-enter its reset state 401.

[0055] The extremely nonlinear relaxation from the deep subthreshold non-equilibrium state of nodes Y1, Y1N and Y0, Y0N after the constraints have been released with S = logic “1” (i.e. during the POC access phase 402) is shown in Fig. 4 illustrates.

[0056] Due to manufacturing variations of the relevant FETs 301, 314, 302 of the first TIE cell 312 and the FETs 307, 315, 308 of the second TIE cell 313, the electrothermal relaxation times of Y1, Y1N and Y0, Y0N typically differ significantly (also strongly dependent on (VDD - VSS) and temperature, on the order of several ns to several µs). Consequently, the output signals Z1 and Z0 switch to logic "1" at different times.

[0057] This is in Fig. 4 by a time difference 404, denoted as ΔtRelax, which specifies the difference between the time 405 when the first TIE cell 312 reaches its steady state (Z1 switches to logic "1") and the time 406 when the second TIE cell 313 reaches its steady state (Z0 switches to logic "1").

[0058] Since the geometric dimensions (i.e., gate lengths and gate widths) of the TIE cell components 301, 314, 302, 307, 315, 308 can be chosen to be very small, they can be made extremely sensitive to manufacturing process variations. This extreme sensitivity to variation of the TIE cells 312, 313 is typically large enough to enable very effective so-called stable bit marking or adjustable preselection of POC bits that exhibit a predetermined minimum bit stability, also with respect to environmental variations (such as temperature and supply voltage) as well as aging.

[0059] A first connection node 318 between the two series-connected first p-channel FETs 301 and second p-channel FETs 314 of the first TIE cell 312 is a floating node with an undefined electrical potential. Furthermore, a second connection node 320 between the two series-connected third p-channel FETs 307 and fourth p-channel FETs 315 of the second TIE cell 313 is also a floating node with an undefined electrical potential. These undefined electrical potentials increase the error rate within the POC cell 300.

[0060] For example, if only the transistor widths were adjusted to increase stability, the TIE cells 312, 313 would become very slow in some operating ranges.

[0061] According to various aspects of this disclosure, in order to reduce the error rate in the POC cell 300, a diverter circuit 322, 324 is provided in one or both TIE cells 312, 313, by means of which the previously undefined electrical potential at the first connection node 318 is fixed to a predetermined or predefined reference potential (for example, the lower reference potential VSS, e.g., the ground potential) during the precharge state of the POC cell 300.

[0062] For example, the first TIE cell 312 has a first diverting circuit 322, which is connected on the one hand to the first connection node 318 and on the other hand to the low reference potential VSS and is configured for the controlled diverting of electrical charge from the first connection node 318. The first diverting circuit 322 has or is formed by a first diverting transistor (for example an n-FET) 322, the drain of which is connected (e.g. directly) to the first connection node 318 and the source of which is connected (e.g. directly) to the low reference potential VSS. The control terminal (e.g. gate) of the first diverting transistor 318 is connected (e.g. directly) to the input S and is controlled by the control input S.The first diverting circuit 322 thus clearly forms a switch that is closed during the precharging process of the POC cell 300 and thus diverts electrical charge located on the first connection node 318 to the low reference potential VSS. Upon completion of the precharging process, the switch is opened again, i.e., for example, the first diverting transistor 322 is turned off, and thus the first connection node 318 is electrically separated, for example, isolated, from the low reference potential VSS.

[0063] Furthermore, for example, the second TIE cell 313 has a second bypass circuit 324, which is connected on the one hand to the second connection node 330 and on the other hand to the low reference potential VSS and is configured for the controlled discharge of electrical charge from the second connection node 320. The second bypass circuit 324 has or is formed by a second bypass transistor (for example an n-FET) 324, the drain of which is connected (e.g. directly) to the second connection node 320 and the source of which is connected (e.g. directly) to the low reference potential VSS. The control terminal (e.g. gate) of the second bypass transistor 320 is connected (e.g. directly) to the input S and is controlled by the control input S.The second diverting circuit 324 thus clearly also forms a switch that is closed during the precharging process of the POC cell 300 and thus diverts electrical charge located on the second connection node 320 to the low reference potential VSS. Upon completion of the precharging process, the switch is opened again, i.e., for example, the second diverting transistor 324 is blocked, and thus the second connection node 320 is electrically separated, for example, isolated, from the low reference potential VSS.

[0064] Alternatively, the control terminals (e.g. gates) of the bypass transistors 322, 324 can also be connected to a separate terminal (i.e. not to the input S) and controlled with a different control signal, but in such a way that the bypass transistors 322, 324 are closed during the precharging process and thus electrically connect the respective connection node 318, 320 to the low reference potential VSS and are open during normal operation (i.e., for example, when generating a cryptographic secret key) and thus electrically separate the respective connection node from the low reference potential.

[0065] During the precharge process, the control input S is logic "1" (illustratively a high-level signal, for example, 5 V). Thus, the first bypass transistor 322 and the second bypass transistor 324 are switched on, and any electrical charges located on the first connection node 318 or the second connection node 320 are diverted to the low reference potential VSS (for example, the ground potential). In other words, the respective connection node 318, 320 is electrically connected to the low reference potential VSS. In this case, the signal SN provided by the input inverter 303 is logic "0" (illustratively a low-level signal, for example, 0 V). Thus, the second n-channel FET 304 and the third n-channel FET 305 of the first precharge control circuitry are blocked, and thus the first TIE cell 312 is deactivated.Furthermore, the fifth n-channel FET 309 and the sixth n-channel FET 310 of the second precharge control circuitry are also blocked and thus the second TIE cell 313 is also deactivated.

[0066] As soon as the POC cell 300 is to be started to generate a secret (e.g., a cryptographic secret key), the control input S is set to logic "0" (illustratively, a low-level signal, e.g., 0 V). Thus, the first bypass transistor 322 and the second bypass transistor 324 are electrically switched off, and the first connection node 318 and the second connection node 320, respectively, are electrically isolated from the low reference potential VSS (e.g., ground potential). In other words, the respective connection node 318, 320 is electrically isolated from the low reference potential VSS.

[0067] In this case, the signal SN provided by the input inverter 303 is logic "1" (illustratively a high-level signal, for example, 5 V). Thus, the second n-channel FET 304 and the third n-channel FET 305 of the first precharge control circuitry are turned on, thus activating the first TIE cell 312. Furthermore, the fifth n-channel FET 309 and the sixth n-channel FET 310 of the second precharge control circuitry are also turned on, thus also activating the second TIE cell 313. However, the signal SN provided by the input inverter 303 is delayed in time relative to the control input S (from the first buffer 316 and the second buffer 317 and the input inverter 303) before the signal SN starts the generation of the secret by means of the TIE cells 312, 313.This delay is dimensioned sufficiently long so that the first bypass transistor 318 and the second bypass transistor 320 have sufficient time to complete their respective turn-off processes.

[0068] Referring again to Fig. 4 also shows the signals SD (output of the first buffer 316) and SN (output of the input inverter 303).

[0069] The buffers 316, 317 together with the input inverter 303 and the n-channel FETs 304, 305, 309, 310 clearly form a circuit arrangement for forcing and releasing the non-equilibrium initial condition.

[0070] If the control input S is set to logic “0” (i.e., the VSS level, e.g., by a corresponding controller, e.g., the POC module 106), the TIE cell initial conditions V(Y1)=VSS,V(Y1N)=VSS, V(Y0)=VSS,V(Y0N)=VSS, now forced, since the upper supply voltage (for example high reference potential VDD in Fig. 3) the TIE cells 312, 313 are replaced with SD = logic “0”, and all precharge transistors 304, 305, 309, 310 for the TIE cell nodes Y1, Y1N and Y0, Y0N are in their respective ON states (strong inversion).

[0071] This reset state 401 is in Fig. 4 is specified as the initial state before the control input S is set to logic "1," initiating the POC access. Afterward, the POC access signal is reset to logic "0," causing the circuit to re-enter its reset state.

[0072] The POC access is initiated with the rising edge 403 from the control input S (S = logic "0" -> logic "1"), which first changes SD, which is the upper supply of the TIE cells 312, 313, to logic "1" (i.e., the VDD level), so that the nodes Y1 and Y0 are pulled up via the n-channel FETs 304, 309 to voltage levels of approximately VDD - Vth(n-channel FET 304) and VDD - Vth(n-channel FET 309), respectively. Shortly thereafter, the signal SN changes to logic "0" and turns off the precharge transistors 304, 305, 309, 310 for the TIE cell nodes Y1, Y1N and Y0, Y0N, whereby the node voltages of the latter drop slightly by a difference ΔVcc and a difference ΔVcc', respectively, due to capacitive coupling from the signal SN.

[0073] Then, the relaxation of the node pairs Y1, Y1N and Y0, Y0N takes place: Y1 and Y0 start from ((VDD - Vth) (n-channel FET 304) - ΔVcc) and ((VDD - Vth) (n-channel FET 309) - ΔVcc), respectively, and Y1N and Y0N start from (VSS - ΔVcc'). This initially leads to generally shorter relaxation times (since the n-channel FETs 301, 314 and the n-channel FETs 307, 315 start in a comparatively less deep subthreshold state).

[0074] Negative feedback with respect to temperature variations is also realized: since Vth(n-channel FET 304) and Vth(n-channel FET 309) increase with decreasing temperature, the starting values ​​of the voltages at nodes Y1 and Y0 decrease at lower temperatures, thereby increasing the relaxation rate and counteracting the decrease in the relaxation rate due to higher threshold voltages of the n-channel FETs 301, 314, 302 and 307, 315, 308.

[0075] The extremely nonlinear relaxation from the deep subthreshold non-equilibrium state of nodes Y1, Y1N and Y0, Y0N after the constraints have been released with S = logic “1” (i.e. during the POC access phase 402) is shown in Fig. 4 is specified.

[0076] Due to manufacturing variations of the relevant transistors 301, 314, 302 (of the first TIE cell 312) as well as transistors 307, 315, and 308 (of the second TIE cell 313), the electrothermal relaxations of Y1, Y1N and Y0, Y0N typically differ significantly in their relaxation times (on the order of several ns to several tens of ns). As a result, the output signals Z1 and Z0 change to logic "1" at different times, which is indicated by a time difference 404, which is Fig. 4 is given as ΔtRelax.

[0077] Fig. 5 shows another POC cell 500, which is a variant of the POC cell 300 of Fig. 3 can be seen.

[0078] The POC Cell 500 differs from the POC Cell 300 Fig. 3 in that the input inverter 503 does not receive its input signal via a second buffer 317, but receives an activation signal E (and accordingly a signal EN instead of SN in Fig. 3 generated).

[0079] Accordingly, the only difference to Fig. 3 illustrates the decoupling of the timing of S and SN, which enables an adjustable starting level of the voltages of nodes Y1 and Y0 by introducing a second input control signal E, which is inverted to EN and controls the turn-off of the precharge transistors 504, 505, 509, 510 for the TIE cell nodes Y1, Y1N and Y0, Y0N. Accordingly, variable timing for the rising edges of S and E allows for a longer or shorter time for setting Y1 and Y0 high after the rising edge of S and before the rising edge of E.

[0080] Again, the two drain circuits 322, 324 (for example in the form of drain transistors 322, 324) are provided for draining electrical charge from the connection nodes 318, 320 during the precharging process.

[0081] Fig. 6 shows a POC cell 600 according to another example.

[0082] Similar to the POC Cell 300 from Fig. 3, the POC cell 600 includes a first TIE cell 601 formed by a first p-channel FET 602 and a second p-channel FET 603 in series and a first n-channel FET 604 and provided with a first output inverter 605, and a second TIE cell 606 formed by a third p-channel FET 607 and a fourth p-channel FET 608 in series and a second n-channel FET 609.

[0083] In addition, there is also a circuit arrangement for forcing and releasing the non-equilibrium initial condition, which includes a first input inverter 611 with an input S and an output SN, a second input inverter 612 with an input SN and an output SD, a first buffer 613 with an input SN and an output SND, a third input inverter 614 with an input SND and an output SD2, a second buffer 615 with an input SD2 and an output SDD, a fourth inverter 616 with an input SDD and an output SNDD and (nMOS only) precharge transistors 617 to 620 for the TIE cell nodes Y1, Y1N and Y0, Y0N, respectively.

[0084] For example, the first precharge n-channel FET 617 is supplied with SND at its gate and SD at its source and is coupled to Y1 at its drain, the second precharge n-channel FET 618 is supplied with SNDD at its gate and VSS at its source and is coupled to Y1N at its drain, the third precharge n-channel FET 619 is supplied with SND at its gate and SD at its source and is coupled to Y0 at its drain, and the fourth precharge n-channel FET 620 is supplied with SNDD at its gate and VSS at its source and is coupled to Y0N at its drain.

[0085] Also in this example, the two discharge circuits 322, 324 (for example in the form of discharge transistors 322, 324) are provided for discharging electrical charge from the connection nodes 318, 320 during the precharging process.

[0086] Fig. 7 shows a timing diagram 700 for the POC cell 600 from Fig. 6.

[0087] Similar to Fig. 4, the signals S, SD, SDD, SND, SNDD, Y1, Y1N, Z1, Y0, Y0N, and Z0 are shown from left to right with time. As shown in Fig. 4, the signals for reset states 701 and a POC access state 702 are shown.

[0088] If the control input S is set to logic “0” (ie, for example, the VSS level, e.g. by a corresponding controller, e.g. the POC module 106), the TIE cell initial conditions V(Y1)=VSS,V(Y1N)=VSS, V(Y0)=VSS,V(Y0N)=VSS, forced, since the upper supply voltage (VDD in Fig. 3) the TIE cells are replaced with SDD = logic “0”, and all precharge FETs 617, 618, 619 and 620 for the TIE cell nodes Y1, Y1N and Y0, Y0N are in their respective ON states (strong inversion).

[0089] This reset state is in Fig. 7 is specified as the initial state before the control input S is set to logic "1," initiating the POC access. Afterward, the POC access signal is reset to logic "0," causing the circuit to re-enter its reset state.

[0090] A POC access is initiated with the rising edge 703 of S (S = logic "0" → logic "1"), which first changes SD, the precharge value for nodes Y1 and Y0, to logic "1" (i.e., for example, the VDD level), thereby pulling nodes Y1 and Y0 up to voltage levels of approximately ((VDD - Vth) (precharge FET 617) and (VDD - Vth) (precharge FET 619)) via the first precharge FET 617 and the third precharge FET 619, respectively, since the signal SND controlling the gates of these precharge FETs 617, 619 remains at the VDD level for a short time interval due to the first delay buffer 613. After that, SND changes to logic “0” and turns off the precharge FETs 617, 619 for the TIE cell nodes Y1 and Y0, causing the node voltages of the latter to drop slightly by ΔVcc due to capacitive coupling of SND.Finally, SNDD changes to logic “0” and turns off the second precharge FET 618 and the fourth precharge FET 619 for nodes Y1N and Y0N, causing the node voltages of the latter to drop slightly by ΔVcc due to capacitive coupling of SNDD.

[0091] Then, the relaxation of the node pairs Y1, Y1N and Y0, Y0N takes place, but with different initial conditions: Y1 and Y0 start from (VDD - Vth(precharge FET 617) - ΔVcc) and (VDD - Vth(precharge FET 619) - ΔVcc)), respectively, and Y1N and Y0N start from VSS - ΔVcc' instead of VSS. This initially leads to generally shorter relaxation times (since the p-channel FETs 602, 603, 607, 608 of the TIE cells start in a comparatively less deep subthreshold state).

[0092] In addition, and particularly importantly, a negative feedback with respect to temperature variations is also realized: since Vth (precharge FET 617) and Vth (precharge FET 619) increase with decreasing temperature, the starting values ​​of the voltages at nodes Y1 and Y0 decrease at lower temperatures, thereby increasing the relaxation rate and counteracting the decrease in the relaxation rate due to higher threshold voltages of the FETs 602, 603, 604, 607, 608, 609 of the TIE cells.

[0093] The extremely nonlinear relaxation from the deep subthreshold nonequilibrium state of nodes Y1, Y1N and Y0, Y0N after the constraints have been released with S = 1 (i.e., during the POC access phase 702) is shown in Fig. 7 is specified.

[0094] Due to manufacturing variations of the relevant transistors 602, 603, 604 (first TIE cell 601) as well as transistors 607, 608, 609 (second TIE cell 602), the electrothermal relaxations of Y1, Y1N and Y0, Y0N typically differ significantly in their relaxation times (on the order of several ns to several tens of ns). As a result, the output signals Z1 and Z0 change to logic "1" at different times, which is indicated by a time difference 704, which in Fig. 7 is given as ΔtRelax.

[0095] Fig. Figure 8 shows a POC cell 800 which serves as the CMOS complement of the POC cell 300 of Fig. 3 can be seen.

[0096] This means that the TIE cells 812, 813 are each connected by a p-channel FET 801, 807 and a series connection of n-channel FETs 802, 814, 808, 815 (instead of the other way around, as in Fig. 3) and the precharge FETs 804, 805, 809, 810 are p-channel FETs (instead of n-channel FETs).

[0097] The POC cell 800 further differs from the POC cell 300 in that it includes a first input inverter 803 that receives the input signal S and outputs SN to the source of the second precharge FET 805 and the fourth precharge FET 810, and a second input inverter 816 that receives SN, inverts it to SD, and supplies SD to the gates of the precharge FETs 804 to 810.

[0098] The input inverters 803, 816 and the precharge FETs 804, 805 (for Y1 and Y1N) and 809, 810 (for Y0 and Y0N) form the circuitry for forcing and releasing the non-equilibrium initial condition.

[0099] A third connection node 818 between the two series-connected seventh n-channel FETs 802 and eighth n-channel FETs 814 of the first TIE cell 812 is a floating node with an undefined electrical potential. Furthermore, a second connection node 820 between the two series-connected ninth n-channel FETs 808 and tenth n-channel FETs 815 of the second TIE cell 813 is also a floating node with an undefined electrical potential. These undefined electrical potentials increase the error rate within the POC cell 800.

[0100] According to various aspects of this disclosure, in order to reduce the error rate in the POC cell 300, a diverter circuit 822, 824 is provided in one or both TIE cells 812, 813, by means of which the previously undefined electrical potential at the third connection node 318 is fixed to a predetermined or predefined reference potential (for example, the lower reference potential VSS, e.g., the ground potential) during the precharge state of the POC cell 800.

[0101] For example, the first TIE cell 812 has a third diverting circuit 822, which is connected on the one hand to the third connection node 818 and on the other hand to the high reference potential VDD and is configured for the controlled diverting of electrical charge from the third connection node 818. The third diverting circuit 822 has or is formed by a third diverting transistor (for example a p-channel FET) 822, the drain of which is connected (e.g. directly) to the third connection node 818 and the source of which is connected (e.g. directly) to the high reference potential VDD. The control terminal (e.g. gate) of the third diverting transistor 818 is connected (e.g. directly) to the input S and is controlled by the control input S.The third diverting circuit 822 thus clearly forms a switch that is closed during the precharging process of the POC cell 800 and thus diverts electrical charge located on the third connection node 818 to the high reference potential VDD. Upon completion of the precharging process, the switch is opened again, i.e., for example, the third diverting transistor 822 is turned off, and thus the third connection node 818 is electrically separated, for example, isolated, from the high reference potential VDD.

[0102] Furthermore, for example, the second TIE cell 813 has a fourth diverting circuit 824, which is connected on the one hand to the fourth connection node 820 and on the other hand to the high reference potential VDD and is configured for the controlled diverting of electrical charge from the fourth connection node 820. The fourth diverting circuit 824 has or is formed by a fourth diverting transistor (for example a p-channel FET) 824, the drain of which is connected (e.g. directly) to the fourth connection node 820 and the source of which is connected (e.g. directly) to the high reference potential VDD. The control terminal (e.g. gate) of the fourth diverting transistor 820 is connected (e.g. directly) to the input S and is controlled by the control input S.The fourth diverting circuit 824 thus clearly also forms a switch that is closed during the precharging process of the POC cell 800 and thus diverts electrical charge located on the fourth connection node 820 to the high reference potential VDD. Upon completion of the precharging process, the switch is opened again, i.e., for example, the fourth diverting transistor 824 is turned off, and thus the fourth connection node 820 is electrically separated, for example, isolated, from the high reference potential VDD.

[0103] Alternatively, the control terminals (e.g. gates) of the bypass transistors 822, 824 can also be connected to a separate terminal (i.e. not to the input S) and controlled with a different control signal, but in such a way that the bypass transistors 822, 824 are closed during the precharging process and thus electrically connect the respective connection node 818, 820 to the high reference potential VDD and are open during normal operation (i.e., for example, when generating a cryptographic secret key) and thus electrically separate the respective connection node from the high reference potential VDD.

[0104] During the precharge process, the control input S is logic "0" (illustratively a low-level signal, for example, 0 V). Thus, the third bypass transistor 822 and the fourth bypass transistor 824 are turned on, and any electrical charges located on the third connection node 818 or the fourth connection node 820 are diverted to the high reference potential VDD. In other words, the respective connection node 818, 820 is electrically conductively connected to the high reference potential VDD. In this case, the signal SN provided by the input inverter 803 is logic "1" (illustratively a high-level signal, for example, 5 V). Thus, the p-channel FET 804 and the p-channel FET 805 of the first precharge control circuitry are blocked, and thus the first TIE cell 812 is deactivated.Furthermore, the p-channel FET 809 and the p-channel FET 810 of the second precharge control circuitry are also blocked and thus the second TIE cell 813 is also deactivated.

[0105] As soon as the POC cell 800 is to be started to generate a secret (e.g., a cryptographic secret key), the control input S is set to logic "1" (illustratively, a high-level signal, e.g., 5 V). Thus, the third bypass transistor 822 and the fourth bypass transistor 824 are electrically switched off, and the third connection node 818 and the fourth connection node 820, respectively, are electrically isolated from the high reference potential VDD. In other words, the respective connection node 818, 820 is electrically isolated from the high reference potential VDD.

[0106] In this case, the signal SN provided by the input inverter 803 is logic "0" (illustratively a low-level signal, for example, 0 V). Thus, the p-channel FET 804 and the p-channel FET 805 of the first precharge control circuitry are turned on, and thus the first TIE cell 812 is activated. Furthermore, the p-channel FET 809 and the p-channel FET 810 of the second precharge control circuitry are also turned on, and thus the second TIE cell 813 is also activated. However, the signal SN provided by the input inverter 803 is delayed in time relative to the control input S (from the first buffer 816 and the input inverter 803) before the signal SN starts the generation of the secret by means of the TIE cells 812, 813. This delay is dimensioned sufficiently long so that the third bypass transistor 818 and the fourth bypass transistor 820 have sufficient time to complete their respective turn-off processes.

[0107] Fig. 9 shows a timing diagram 900 for the POC cell 800 from Fig. 8.

[0108] Similar to Fig. 4 and Fig. 7, the signals S, SN, SD, Y1, Y1N, Z1, Y0, Y0N and Z0 are shown from left to right with time. As shown in Fig. 4 and Fig. 7, the signals for reset states 901 and a POC access state 902 are shown.

[0109] If the control input S is set to logic “0” (ie, for example, the VSS level), e.g. by a corresponding controller, e.g. the POC module 106, the TIE cell initial conditions V(Y1)=VDD,V(Y1N)=VDD, V(Y0)=VDD,V(Y0N)=VDD, forced, because the lower supply voltage (VSS in Fig. 3) of the TIE cells is replaced with SN = logic “1”, and all precharge FETs 804, 805, 809, 810 for the TIE cell nodes Y1, Y1N and Y0, Y0N are in their respective ON states (strong inversion).

[0110] This reset state is in Fig. 9 is specified as the initial state before the control input S is set to logic "1," initiating the POC access. Afterward, the POC access signal is reset to logic "0," causing the circuit to re-enter its reset state.

[0111] The POC access is initiated with the rising edge 1303 of S (S = logic "0" -> logic "1" of S), which first changes SN, the lower supply of the TIE cells 812, 813, to logic "0" (VSS level), so that the nodes Y1N and Y0N are brought down via the second precharge FET 805 and the fourth precharge FET 810 to voltage levels of approximately |Vth(Precharge FET 805)| and |Vth(Precharge FET 810)|, respectively.

[0112] Shortly thereafter, SD changes to logic "1" and turns off the precharge FETs 804, 805, 809, 810 for the TIE cell nodes Y1, Y1N and Y0, Y0N, causing the node voltages of the latter to increase slightly by ΔVcc and ΔVcc', respectively, due to capacitive coupling of SN.

[0113] Then the relaxation of the node pairs Y1, Y1N and Y0, Y0N takes place, but with the following initial conditions: Y1N and Y0N no longer start from VSS, but from |Vth(precharge FET 805)|+ ΔVcc or |Vth(precharge FET 810)|+ ΔVcc and Y1 and Y0 start from VDD+ΔVcc' instead of VDD.

[0114] This first leads to generally shorter relaxation times (since the n-channel FETs 802, 814, 808, 815 of the TIE cells start in a comparatively less deep subthreshold state).

[0115] Furthermore, and most importantly, a negative feedback with respect to temperature variations is also realized: since |Vth(precharge FET 805)| and |Vth(precharge FET 810)| increase with decreasing temperature, the starting values ​​of the voltages at nodes Y1N and Y0N increase at lower temperatures, thereby increasing the relaxation rate and counteracting the decrease in the relaxation rate due to higher threshold voltages of the FETs 801, 802, 814, 807, 808, 815 of the TIE cells.

[0116] The extremely nonlinear relaxation from the deep subthreshold non-equilibrium state of nodes Y1, Y1N and Y0, Y0N after the constraints have been released with S = logic “1” (i.e. during the POC access phase 902) is shown in Fig. 9 is given.

[0117] Due to manufacturing variations of the relevant FETs 801, 802, 804 (of the first TIE cell 812) as well as the FETs 807, 808, 815 (of the second TIE cell 813), the electrothermal relaxations of Y1, Y1N and Y0, Y0N typically differ significantly in their relaxation times (on the order of several ns to several tens of ns). As a result, the output signals Z1 and Z0 change to logic "1" at different times, which is indicated by a time difference 904, which in Fig. 9 is given as ΔtRelax.

[0118] In summary, according to various embodiments, a physically obfuscated circuit (POC) circuit as in Fig. 10 is provided as an illustration.

[0119] Fig. 10 shows a physically obfuscated circuit 1000 according to one embodiment.

[0120] The physically obfuscated circuit 1000 includes a plurality of subcircuits 1001, wherein each subcircuit 1001 includes at least one p-channel field-effect transistor 1002, at least one n-channel field-effect transistor 1003, a first power supply terminal 1004 configured to receive a first supply voltage having an upper supply potential, and a second power supply terminal 1005 configured to receive a second supply voltage having a lower supply potential.

[0121] The at least one p-channel field-effect transistor 1002 and the at least one n-channel field-effect transistor 1003 are connected in such a way that the at least one n-channel field-effect transistor 1003, if supplied with the upper supply potential at its gate, supplies the lower supply potential to the gate of the at least one p-channel field-effect transistor 1002 and the at least one p-channel field-effect transistor 1002, if supplied with the lower supply potential at its gate, supplies the upper supply potential to the gate of the at least one n-channel field-effect transistor 1003.

[0122] Each subcircuit 1001 further includes a precharge circuit 1006 configured to precharge the subcircuit to a first state in which the potential at the gate of the at least one n-channel field-effect transistor 1003 is lower than the upper supply potential and the potential at the gate of the at least one p-channel field-effect transistor 1002 is higher than the lower supply potential.

[0123] The physically obfuscated circuit 1000 further includes a physically obfuscated circuit value bit generation circuit 1007 configured to generate at least one physically obfuscated circuit value bit depending on which of the subcircuits 1001 first enters a second state in which the potential at the gate of the at least one n-channel field-effect transistor 1003 is the upper potential and the potential at the gate of the at least one p-channel field-effect transistor 1002 is the lower potential.

[0124] For example, the physically obfuscated circuit (POC) circuit 1000 may correspond to the POC source 105 together with the POC module 106.

[0125] In other words, according to various embodiments, two (or more) TIE cells (referred to above as a "subcircuit"), each having at least one p-channel FET and at least one n-channel FET that maintain each other in a steady state by turning each other on, are each precharged to an inverse state. The inverse state is inverse to the steady state in the sense that the FETs are off. A POC bit is generated based on which TIE cell reaches its steady state first. If there are more than two TIE cells, multiple POC bits may be generated by the POC bit generation circuit based on the order in which the TIE cells reach the steady state.

[0126] The first state can be a state when the FETs are off, and the second state can be a state when the FETs are on. Note that there can be a "relaxation state" between the first state and the second state, that is, a state that each subcircuit has when transitioning from the first state to the second state. The first state (possibly together with the relaxation state) can be considered a "non-equilibrium" state.

[0127] For example, the relaxation state of a subcircuit begins when the precharge circuit completes precharging the circuit, i.e., releases the subcircuit from the first state (enforced by the precharge). For example, in the first state, the precharge circuit forces the subcircuit to be in (and remain in) the first state and then "releases" the subcircuit to transition to its second state. The subcircuits can then be seen as "racing" to the second state, and the POC bit generation circuit generates one or more POC bits based on which subcircuit "wins the race" (or, in the case of more than two TIE cells, possibly based on the order in which the TIE cells complete their respective relaxations).

[0128] Various aspects of the revelation are explained below: Example 1 is a physically obfuscated circuit. The physically obfuscated circuit has a plurality of subcircuits, each subcircuit comprising: a plurality of series-connected transistors of a first conductivity type; and at least one transistor of a second conductivity type that is different from the first conductivity type.The transistors are connected such that the plurality of series-connected transistors of the first conductivity type, if supplied with a first reference potential at their respective control terminal, supplies a second reference potential, different from the first reference potential, to the control terminal of the at least one transistor of the second conductivity type; and that the at least one transistor of the second conductivity type, if supplied with a second reference potential at its control terminal, supplies the first reference potential to the control terminal of each transistor of the plurality of series-connected transistors of the first conductivity type.The physically obfuscated circuit further comprises a precharge circuit configured to precharge the subcircuit to a first state in which the potential at the control terminal of the at least one transistor of the second conductivity type is different than the second reference potential and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is different than the first reference potential.The physically obfuscated circuit further comprises a physically obfuscated circuit value bit generation circuit configured to generate at least one physically obfuscated circuit value bit depending on which of the subcircuits first enters a second state in which the potential at the control terminal of the at least one transistor of the second conductivity type is the second reference potential and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is the first reference potential. At least one subcircuit of the plurality of subcircuits comprises a drain circuit connected to a connection node between two transistors of the plurality of series-connected transistors of the first conductivity type for the controlled draining of electrical charge from the connection node.

[0129] In Example 2, the subject matter of Example 1 can optionally include that the second reference potential is higher than the first reference potential; and that the precharge circuit is configured to precharge the subcircuit to the first state in which the potential at the control terminal of the at least one transistor of the second conductivity type is lower than the second reference potential and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is higher than the first reference potential.

[0130] In Example 3, the subject matter of Example 2 can optionally include that the first conductivity type is a p-type conductivity type; and that the second conductivity type is an n-type conductivity type.

[0131] In Example 4, the subject matter of Example 1 can optionally include that the second reference potential is lower than the first reference potential; and that the precharge circuit is configured to precharge the subcircuit to the first state in which the potential at the control terminal of the at least one transistor of the second conductivity type is higher than the second reference potential and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is lower than the first reference potential.

[0132] In Example 5, the subject matter of Example 4 can optionally include that the first conductivity type is an n-type conductivity type; and that the second conductivity type is a p-type conductivity type.

[0133] In Example 6, the subject matter of any of Examples 1 to 5 can optionally include each subcircuit of the plurality of subcircuits comprising a drain circuit coupled to a connection node between two transistors of the plurality of series-connected transistors of the first conductivity type for controllably draining electrical charge from the connection node.

[0134] In Example 7, the subject matter of any of Examples 1 to 6 can optionally include that the shunt circuit includes a switch that connects the connection node to the first reference potential or disconnects it from the first reference potential.

[0135] In Example 8, the subject matter of Example 7 can optionally include that the switch comprises or is formed by a transistor of the second conductivity type.

[0136] In Example 9, the subject matter of any of Examples 1 to 8 can optionally include the at least one transistor of the second conductivity type comprising a plurality of transistors of the second conductivity type connected in series.

[0137] In Example 10, the subject matter of Example 9 can optionally include at least one subcircuit of the plurality of subcircuits comprising an additional drain circuit connected to an additional connection node between two transistors of the plurality of series-connected transistors of the second conductivity type for controllably draining electrical charge from the additional connection node.

[0138] In Example 11, the subject matter of any of Examples 1 to 10 can optionally include the precharge circuit being configured to initiate a transition of the subcircuit from the first state to the second state after precharging the subcircuit to the first state.

[0139] In Example 12, the subject matter of any of Examples 1 to 11 can optionally include that the precharge circuit is configured to initiate a transition of the subcircuits from the first state to the second state by providing a common input signal to the subcircuits.

[0140] In Example 13, the subject matter of any of Examples 1 to 12 can optionally include the precharge circuitry being configured to precharge the circuitry to the first state in response to receiving a request for a physical obfuscated circuitry value.

[0141] In Example 14, the subject matter of any of Examples 1 to 13 can optionally include the second state being a stationary state of the subcircuit and the first state being an inverse state of the second state.

[0142] In Example 15, the subject matter of any of Examples 1 to 14 can optionally include that, in the first state, the potential at the control terminal of the at least one transistor of the second conductivity type is the first reference potential and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is the second reference potential.

[0143] In Example 16, the subject matter of any of Examples 1 to 15 can optionally include that, in the first state, the potential at the control terminal of the at least one transistor of the second conductivity type is a potential for turning off the at least one transistor of the second conductivity type, and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is a potential for turning off each of the plurality of series-connected transistors of the first conductivity type.

[0144] In Example 17, the subject matter of any of Examples 1 to 16 can optionally include the physically obfuscated circuit value bit generation circuit being configured to receive from each subcircuit a signal indicating the state of the subcircuit.

[0145] In Example 18, the subject matter of Example 14 can optionally include that the physically obfuscated circuit value bit generation circuit comprises a latch circuit supplied with the signal indicating the state of the subcircuit from each subcircuit and configured to be switched depending on which of the subcircuits enters the second state first.

[0146] In Example 19, the subject matter of any of Examples 1 to 18 can optionally include wherein the plurality of subcircuits comprises three or more subcircuits, and the physical obfuscated circuit value bit generation circuit is configured to generate a plurality of physical obfuscated circuit value bits depending on an order in which the subcircuits enter the second state.

[0147] In Example 20, the subject matter of any of Examples 1 to 19 can optionally include the physically obfuscated circuit further comprising a key generator configured to generate a cryptographic key based on the physically obfuscated circuit value bit.

[0148] In Example 21, the subject matter of any of Examples 1 to 20 can optionally include that, in the first state, the potential at the control terminal of the at least one transistor of the second conductivity type depends on a transistor threshold voltage of a transistor of the precharge circuit.

[0149] In Example 22, the subject matter of any of Examples 1 to 21 can optionally include that, in the first state, the potential at the control terminal of each transistor of the plurality of series-connected transistors of the first conductivity type depends on a transistor threshold voltage of a transistor of the precharge circuit.

[0150] In Example 23, the subject matter of any of Examples 1 to 22 can optionally include that, in the first state, the potential at the control terminal of the at least one transistor of the second conductivity type is the first operating potential plus or minus a transistor threshold voltage of a transistor of the precharge circuit.

[0151] In Example 24, the subject matter of any of Examples 1 to 23 can optionally include that, in the first state, the potential at the control terminal of each transistor of the plurality of series-connected transistors of the first conductivity type is the second operating potential plus or minus a transistor threshold voltage of a transistor of the precharge circuit.

Claims

[1] Physically obfuscated circuit that has the following: several subcircuits, each subcircuit comprising: • several transistors of a first conductivity type connected in series; • at least one transistor of a second conductivity type that is different from the first conductivity type; • the transistors are connected in such a way that - the plurality of series-connected transistors of the first conductivity type, if supplied with a first reference potential at their respective control terminal, supplies a second reference potential, which is different from the first reference potential, to the control terminal of the at least one transistor of the second conductivity type; and - the at least one transistor of the second conductivity type, if supplied with a second reference potential at its control terminal, supplies the first reference potential to the control terminal of each transistor of the plurality of series-connected transistors of the first conductivity type; and - a precharge circuit configured to precharge the subcircuit to a first state in which the potential at the control terminal of the at least one transistor of the second conductivity type is different from the second reference potential and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is different from the first reference potential; • wherein the physically obfuscated circuit further comprises a physically obfuscated circuit value bit generation circuit configured to generate at least one physically obfuscated circuit value bit depending on which of the subcircuits first enters a second state in which the potential at the control terminal of the at least one transistor of the second conductivity type is the second reference potential and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is the first reference potential; and • wherein at least one subcircuit of the plurality of subcircuits comprises a drain circuit connected to a connection node between two transistors of the plurality of series-connected transistors of the first conductivity type for controllably draining electrical charge from the connection node. [2] Physically obfuscated circuit according to claim 1, • wherein the second reference potential is higher than the first reference potential; and • wherein the precharge circuit is configured to precharge the subcircuit to the first state in which the potential at the control terminal of the at least one transistor of the second conductivity type is lower than the second reference potential and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is higher than the first reference potential. [3] Physically obfuscated circuit according to claim 2, • wherein the first conductivity type is a p-conductivity type; and • where the second conductivity type is an n-conductivity type. [4] Physically obfuscated circuit according to claim 1, • wherein the second reference potential is lower than the first reference potential; and • wherein the precharge circuit is configured to precharge the subcircuit to the first state in which the potential at the control terminal of the at least one transistor of the second conductivity type is higher than the second reference potential and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is lower than the first reference potential. [5] Physically obfuscated circuit according to claim 4, • wherein the first conductivity type is an n-conductivity type; and • where the second conductivity type is a p-conductivity type. [6] A physically obfuscated circuit according to any one of claims 1 to 5, wherein each subcircuit of the plurality of subcircuits comprises a drain circuit connected to a connection node between two transistors of the plurality of series-connected transistors of the first conductivity type for controllably draining electrical charge from the connection node. [7] A physically obfuscated circuit according to any one of claims 1 to 6, wherein the shunt circuit comprises a switch that connects the connection node to the first reference potential or disconnects it from the first reference potential. [8] A physically obfuscated circuit according to claim 7, wherein the switch comprises or is formed by a transistor of the second conductivity type. [9] A physically obfuscated circuit according to any one of claims 1 to 8, wherein the at least one transistor of the second conductivity type comprises a plurality of transistors of the second conductivity type connected in series. [10] A physically obfuscated circuit according to claim 9, wherein at least one subcircuit of the plurality of subcircuits comprises an additional drain circuit connected to an additional connection node between two transistors of the plurality of series-connected transistors of the second conductivity type for controllably draining electrical charge from the additional connection node. [11] The physically obfuscated circuit of any one of claims 1 to 10, wherein the precharge circuit is configured to initiate a transition of the subcircuit from the first state to the second state after precharging the subcircuit to the first state. [12] A physically obfuscated circuit according to any one of claims 1 to 11, wherein the precharge circuit is configured to initiate a transition of the subcircuits from the first state to the second state by providing a common input signal to the subcircuits. [13] The physically obfuscated circuit of any one of claims 1 to 12, wherein the precharge circuit is configured to precharge the circuit to the first state in response to receiving a request for a physically obfuscated circuit value. [14] A physically obfuscated circuit according to any one of claims 1 to 13, wherein the second state is a stationary state of the subcircuit and the first state is an inverse state of the second state. [15] A physically obfuscated circuit according to any one of claims 1 to 14, wherein in the first state the potential at the control terminal of the at least one transistor of the second conductivity type is the first reference potential and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is the second reference potential. [16] A physically obfuscated circuit according to any one of claims 1 to 15, wherein in the first state, the potential at the control terminal of the at least one transistor of the second conductivity type is a potential for turning off the at least one transistor of the second conductivity type and the potential at the control terminal of each of the plurality of series-connected transistors of the first conductivity type is a potential for turning off each of the plurality of series-connected transistors of the first conductivity type. [17] A physically obfuscated circuit according to any one of claims 1 to 16, wherein the physically obfuscated circuit value bit generation circuit is configured to receive from each subcircuit a signal indicating the state of the subcircuit. [18] A physically obfuscated circuit according to claim 14, wherein the physically obfuscated circuit value bit generation circuit comprises a latch circuit supplied with the signal indicating the state of the subcircuit from each subcircuit and configured to be switched depending on which of the subcircuits enters the second state first. [19] The physically obfuscated circuit of any one of claims 1 to 18, wherein the plurality of subcircuits comprises three or more subcircuits, and the physically obfuscated circuit value bit generation circuit is configured to generate a plurality of physically obfuscated circuit value bits depending on an order in which the subcircuits enter the second state. [20] A physically obfuscated circuit according to any one of claims 1 to 19, further comprising: a key generator configured to generate a cryptographic key based on the physical obfuscated circuit value bit. [21] A physically obfuscated circuit according to any one of claims 1 to 20, wherein in the first state the potential at the control terminal of the at least one transistor of the second conductivity type depends on a transistor threshold voltage of a transistor of the precharge circuit. [22] A physically obfuscated circuit according to any one of claims 1 to 21, wherein in the first state the potential at the control terminal of each transistor of the plurality of series-connected transistors of the first conductivity type depends on a transistor threshold voltage of a transistor of the precharge circuit. [23] A physically obfuscated circuit according to any one of claims 1 to 22, wherein in the first state the potential at the control terminal of the at least one transistor of the second conductivity type is the first operating potential plus or minus a transistor threshold voltage of a transistor of the precharge circuit. [24] A physically obfuscated circuit according to any one of claims 1 to 23, wherein in the first state the potential at the control terminal of each transistor of the plurality of series-connected transistors of the first conductivity type is the second operating potential plus or minus a transistor threshold voltage of a transistor of the precharge circuit.

Images