Physically obfuscated circuit

Abstract

Physically obfuscated circuit (106) comprising: several subcircuits (312, 313), each subcircuit comprising: • several transistors (301,314) of a first conductivity type connected in series; • at least one transistor (302) of a second conductivity type that is different from the first conductivity type; • wherein the transistors are connected in such a way that - the several series-connected transistors (301, 314) of the first conductivity type, if they are supplied with a first reference potential (VSS) at their respective control terminals, supply a second reference potential (VDD), which is different from the first reference potential (VSS), to the control terminal of at least one transistor (302) of the second conductivity type; and - which, if supplied with a second reference potential (VDD) at its control terminal, provides the first reference potential (VSS) to the control terminal of each of the several series-connected transistors (301, 314) of the first conductivity type; and - a pre-charge circuit (304) configured to pre-charge the sub-circuit (312, 313) to a first state in which the potential at the control terminal of the at least one second conductivity type transistor (302) is different from the second reference potential (VDD) and the potential at the control terminal of each of the several series-connected first conductivity type transistors (301, 314) is different from the first reference potential (VSS); • wherein the physically obfuscated circuit further comprises a physically obfuscated circuit value bit generation circuit (1007) which generates at least one physically obfuscated circuit value bit depending on which of the sub-circuits (312, 313) first enters a second state in which the potential at the control terminal of the at least one transistor of the second conductivity type is the second reference potential (VDD) and the potential at the control terminal of each of the several series-connected transistors (301, 314) of the first conductivity type is the first reference potential (VSS);and wherein at least one sub-circuit of the several sub-circuits has a drain circuit (322) which is connected to a junction node (318) between two transistors (301, 314) of the several series-connected transistors (301, 314) of the first conductivity type for controlled draining of electrical charge from the junction node (318).

Description

[0001] The invention relates to a physically obfuscated circuit.

[0002] Piracy and reverse engineering (RE) of integrated circuits (ICs) are considered one of the most serious threats to the semiconductor industry, as they can be misused to steal and / or pirate designs: successful attackers can overbuild or manufacture ICs and sell similar, i.e., "cloned" ICs; they can illegally use or sell the extracted and stolen IP and sell competitors' trade secrets, etc. For all these reasons, it is desirable to develop concepts and techniques that prevent IC piracy and reverse engineering.

[0003] DE 10 2019 123 555 B4 discloses a physically obfuscated circuit with two sub-circuits, wherein the physically obfuscated circuit comprises a physically obfuscated circuit value bit generation circuit which generates at least one physically obfuscated circuit value bit depending on which of the sub-circuits first enters a second state in which the potential at the control terminal of a transistor of the second conductivity type is the second reference potential and the potential at the control terminal of each of several series-connected transistors of the first conductivity type is the first reference potential.

[0004] DE 698 21 292 T2 shows an IC driver with two transistors connected in series, which are controlled separately, with a leakage circuit provided that precharges the node between the two transistors to a predetermined voltage.

[0005] US 11 265 001 B1 shows a leakage circuit in a digital-to-analog converter.

[0006] Exemplary embodiments of the invention are shown in the figures and are explained in more detail below.

[0007] They show Fig. 1. A chip card as an example; Fig. 2 a TIE cell; Fig. 3 a POC cell with two TIE cells; Fig. 4 a time-course diagram for the POC cell from Fig. 3; Fig. 5 another POC cell, which is a variant of the POC cell from Fig. 3 can be viewed; Fig. 6 a POC cell according to another example; Fig. 7 a time-series diagram for the POC cell from Fig. 6; Fig. 8 a POC cell that is the CMOS complement of the POC cell from Fig. 3 can be; Fig. 9 a time-series diagram for the POC cell from Fig. 8; Fig. 10 a physically obfuscated circuit according to one embodiment.

[0008] The following detailed description refers to the accompanying drawings, which illustrate specific details and aspects of this disclosure in which the invention can be practiced. Other aspects may be used, and structural, logical, and electrical modifications may be made without deviating from the scope of protection of the invention. The various aspects of this disclosure are not necessarily mutually exclusive, since some aspects of this disclosure may be combined with one or more other aspects of this disclosure to form new aspects.

[0009] Within the scope of this description, the terms "connected," "attached," and "coupled" are used to describe both direct and indirect connections, direct or indirect links, and direct or indirect couplings. In the figures, identical or similar elements are labeled with identical reference symbols where appropriate.

[0010] A promising approach for the reliable and secure identification and authentication of integrated circuits (ICs) involves the use of so-called physically random functions or physically obfuscated circuits (POCs) to securely generate on-chip secret keys for cryptographic algorithms. Ideally, silicon POCs generate chip-specific keys that are arbitrarily repeatable but unpredictable and cannot be externally determined. This can be achieved by exploiting random variations in IC manufacturing processes while simultaneously suppressing global process, temperature, and supply voltage variations and noise.

[0011] Because these POCs can be integrated together on the chip with dedicated control logic, any attempt to physically access the POC circuitry itself can be very effectively and efficiently restricted. This significant resistance to physical attacks is the main advantage of using controlled silicon POCs.

[0012] Furthermore, only weak POCs are needed for secret key generation, i.e., POCs that generate POC values ​​for only a limited number of challenge-response pairs (compared to other possible challenge-response pairs).

[0013] A POC value (Point of Control) can be thought of as a kind of fingerprint of a physical object. Using the true POC value P, i.e., the POC value at the time of its registration, the physical object can be uniquely identified, and a key can be produced based on this identification. The physical object could be a controller or a microcontroller. It could also be a chip card IC (integrated circuit) of a chip card, such as a smart card of any form factor, e.g., for a passport or a SIM (Subscriber Identity Module).

[0014] Fig. Figure 1 shows a chip card 100 as an example.

[0015] The chip card 100, illustrated here in card format but capable of any form factor, comprises a carrier 101 and a chip card module 102. The chip card module 102 includes various components, such as non-volatile memory 103 and a CPU (central processing unit) 104. In various embodiments, the chip card includes a component 105 that serves as a POC source, for example, a circuit including several sub-circuits, wherein an output of a sub-circuit specifies (or serves as a basis for) one or more bits of a POC value. It should be noted that the chip card 100 using a POC is only an example and could be a device including any type of integrated circuit.

[0016] The POC value P can be considered an identification number for the chip card 100 (more precisely, for the chip card module 102 within the chip card 100). For example, the chip card module 102 has a crypto processor that derives a unique cryptographic key for a chip card 100 from this identification number, or the CPU 104 itself derives a cryptographic key from it.

[0017] For security reasons, neither the true POC value P nor the cryptographic key derived from it is stored on the chip card 100. Instead, a so-called POC module 106 is located on the chip card 100 and is connected to the physical object 105. If the POC value P is required (e.g., for key generation), a so-called POC request is made to the POC module 106, whereupon the POC module 106 recalculates the POC value in every case (by means of an internal electronic operation). In other words, the POC module 106 responds to a POC request by outputting a POC value P', which may deviate from the true POC value P, i.e., the POC value at the time of registration, to a greater or lesser extent, depending on the bit stability of the bits provided by the POC source 105.

[0018] There are various approaches to realizing controlled silicon-based POCs (i.e., from POC sources 105), e.g., on the one hand, SRAM-based, read amplifier-based, butterfly-based, and latch-based POC fields, and on the other hand, delay-based POCs, such as ring oscillator POCs and arbiter POCs.

[0019] Approaches such as SRAM-POCs (based on the process-variation-induced tendency of single-bit cells to preferentially assume one of their two stable states upon power-up) typically suffer from severe limitations, such as poor bit stability and high vulnerability to semi-invasive attacks, such as electrical and optical probing, and / or inadequate statistical quality.

[0020] Regarding delay-based POCs, such as ring oscillator (RO) and arbiter POCs (which compare the delays of two ideally identically implemented delay lines), there are similar limitations in terms of bit stability and statistical quality, whereas their known weakness to model-building attacks is irrelevant for cryptographic on-chip key generation because the very low number of controlled silicon POC challenge-response pairs is never directly exposed and cannot be determined externally.

[0021] The implementation of silicon arbiter proof-of-concept (POCs) typically results in relatively poor statistical quality and POC bit stability. This is because, on the one hand, irregular placement and automated routing of the arbiter POC elements lead to asymmetrical wiring and, consequently, systematic delay distortions, i.e., poor statistical quality. On the other hand, the delay differences between the two paths with the same nominal layout length depend only on the small process variations of the gates and wiring involved, which represent the competing delay paths, resulting in poor bit stability. This, in turn, necessitates the generation of so-called helper data during a POC entry, i.e., along with an initial key generation, as well as costly and time-consuming error correction (in terms of gate and area count as well as energy dissipation) during key reconstruction in the field.

[0022] For example, POC bit stability can be increased by a so-called stable bit marking or a preselection of POC bits (which discards unstable bits when they are entered and prevents them from being considered during reconstruction).

[0023] The following describes approaches to realizing a secure and cost-effective POC, e.g., for secret key generation, which exhibits significantly improved security against physical attacks and demonstrates reproducibility so high that no error correction is necessary (which is a considerably expensive measure and typically indispensable for conventional POCs).

[0024] These features are achieved through a POC circuit arrangement that exploits extremely nonlinear electrothermal deep subthreshold relaxation processes from non-equilibrium states to states with limited equilibrium.

[0025] In particular, the POC source 105, according to various embodiments, is based on so-called TIE cells, as in Fig. 2 is illustrated.

[0026] Fig. Figure 2 shows a TIE cell 200.

[0027] The TIE cell 200 contains a p-channel field-effect transistor (FET) 201, whose source (as an example of a controlled terminal) is connected to a high supply potential (e.g., VDD), whose gate (as an example of a control terminal) is connected to the drain of an n-channel field-effect transistor 202, and whose drain (as an example of another controlled terminal) is connected to the gate of the n-channel field-effect transistor 202. The source of the n-channel field-effect transistor 202 is connected to a low supply potential (e.g., VSS). It should be noted that all the FETs mentioned here can be, for example, MOSFETs (metal-oxide-semiconductor field-effect transistors) and can be manufactured using CMOS (complementary MOS) technology.

[0028] The node (or connection) that connects the gate of the p-channel field-effect transistor 201 to the drain of the n-channel field-effect transistor 202 is hereby referred to as TN, and the node (or connection) that connects the gate of the n-channel field-effect transistor 202 to the drain of the p-channel field-effect transistor 201 is hereby referred to as T. For the sake of simplicity, the state of a node will hereafter be referred to by the name of the node; e.g., T also refers to the state (or signal) at node T.

[0029] First, the case of a limited electrothermal equilibrium is assumed. It is assumed that the supply potential difference VDD-VSS is high enough that, in steady-state equilibrium, the two FETs 201 and 202 operate with strong inversion (i.e., they exhibit fully developed channel inversion): VDD−VSS>Vth(n-channel FET 202)+|Vth(p-channel FET 201)| where Vth(FET) denotes the threshold voltage of the FET specified in parentheses.

[0030] Then the expected values ​​of the node voltage are the steady-state values ​​V(T) = VDD and V(TN) = VSS. That is, even for time-varying voltages VDD and VSS, the time-averaged values ​​are the steady-state (and time-averaged) values ​​V(T) = VDD and V(TN) = VSS given above.

[0031] Furthermore, the relaxation time of the circuit ranges from a few hundred ps to the nanosecond range, depending on the process technology, the supply voltage, and the temperature. This means that the potentials V(T) and V(TN) relax from small disturbances (deviations from their steady-state values) to their steady-state values ​​VDD and VSS with relaxation times in the (sub-)nanosecond range.

[0032] However, for large deviations of V(T) and V(TN) from their equilibrium values, the TIE cell circuit components exhibit completely different behavior. In particular, the extreme case of the following initial condition is considered: V(T)=VSS and V(TN)=VDD at time t=0.

[0033] This means that the node voltages are initially held at the “inverse” values ​​relative to their equilibrium values ​​above, so that initially both FETs 201, 202 are switched OFF, i.e., they are both in their deep subthreshold domain.

[0034] If the initial condition is then released for t > 0 (i.e., nodes T and TN are no longer confined to their initial values), the circuit arrangement 200 is initially in a non-equilibrium state, namely a state as far removed as possible from its steady state described above. Consequently, the potentials of nodes T and TN move in the direction of their equilibrium (steady-state) values ​​V(T) = VDD and V(TN) = VSS due to unavoidable (low) subthreshold currents. However, the transition is an extremely nonlinear one, strongly dependent on the VDD voltage level relative to VSS, the temperature T, and especially the unavoidable manufacturing process variations of the circuit components (here FETs 201, 202), so that two instances (copies) of the "same" TIE cell will very likely differ with respect to their relaxation times.

[0035] According to various embodiments, two (or more than two, see examples described below) copies of circuits exhibiting the above TIE cell behavior during relaxation from a state far from equilibrium are used for a POC circuit arrangement. Such circuits are particularly suitable for a POC circuit arrangement due to the extremely wide statistical distribution of depth-subthreshold relaxation times resulting from manufacturing variations.

[0036] In particular, a dedicated circuit arrangement based on the deep subthreshold TIE cell relaxation described above is introduced from non-equilibrium states far from their steady states (e.g., as in the POC source 105), as for example in Fig. 3 is illustrated.

[0037] Fig. Figure 3 shows a POC cell 300.

[0038] Like all POC cells described here, multiple POC cells 300 can be contained in a circuit configured to generate one or more POC values, e.g., the POC source 105.

[0039] The POC cell 300 includes a first TIE cell 312. The first TIE cell 312 has a series connection of a first p-channel FET 301 and a second p-channel FET 314, as well as a first n-channel FET 302. The first p-channel FET 301 and the second p-channel FET 314 are cross-coupled with the first n-channel FET 302 and connected to VDD and VSS, respectively, as described in [reference to...]. Fig. 2 is explained, however, the p-channel FET 201 there is replaced by a series connection of the first p-channel FET 301 and the second p-channel FET 314. Furthermore, the POC cell 300 additionally includes a first pre-charge control circuit arrangement for the first TIE cell 312, which is formed by a second n-channel FET 304 and a third n-channel FET 305.

[0040] Furthermore, the POC cell 300 optionally features an input inverter 303 as well as a first buffer 316 and a second buffer 317, which are arranged in series between an input S and the first pre-charge control circuit arrangement and a second pre-charge control circuit arrangement (which will be explained in more detail below).

[0041] The output of the first buffer 316 (which is connected to an input of the second buffer 317) is connected to the series connection of the p-channel FETs 301, 314 of the first TIE cell (in particular to the source of the first FET 701 in the series) and to the series of p-channel FETs 307, 315 of the second TIE cell (in particular to the source of the third p-channel FET 307 in the series).

[0042] The first buffer 316 receives the control input signal S (hereinafter also referred to as control input S) and stores it temporarily. On its output side, the first buffer 316 provides a first buffered control input signal SD to an input of the second buffer 317. The second buffer 317 receives the first buffered control input signal SD (which is thus time-delayed relative to the control input signal S) from the first buffer 316 and also stores it temporarily. On its output side, the second buffer 317 provides a second buffered control input signal SDD (which is thus additionally time-delayed relative to the control input signal S) to an input of the input inverter 303. The input inverter 303 receives the second buffered control input signal SDD from the second buffer 317 and inverts it to an inverted control signal SN, which it supplies to the gate of the second n-channel FET 304 and to the gate of the third n-channel FET 305.

[0043] The drain of the second n-channel FET 304 is connected to the source of the first p-channel FET 301, and its source is connected to the gate of the first p-channel FET 301 and to the gate of the second p-channel FET 314. The source of the third n-channel FET 305 is connected to the source of the first n-channel FET 302, and its drain is connected to the gate of the first n-channel FET 302.

[0044] The drain of the second p-channel FET 314 is further connected to an input of a first output inverter 306, whose output Z1 is one of the outputs of the POC cell 300. The drain of the third n-channel FET 305 is also connected to the input of a first output inverter 306.

[0045] The POC cell 300 further includes a second TIE cell 313. The second TIE cell 313 features a series connection consisting of a third p-channel FET 307 and a fourth p-channel FET 315, as well as a fourth n-channel field-effect transistor 308. The third p-channel FET 307 and the fourth p-channel FET 315 are cross-coupled with the fourth n-channel field-effect transistor 308 and connected to VDD and VSS, respectively, as described in [reference to...]. Fig. 2 is explained, however, the p-channel FET 201 there is replaced by a series connection of the third p-channel FET 307 and the fourth p-channel FET 315. Furthermore, the POC cell 300 additionally includes a second pre-charge control circuit arrangement for the second TIE cell 313, which is formed by a fifth n-channel FET 309 and a sixth n-channel FET 310.

[0046] The gate of the fifth n-channel FET 309 receives the inverted control input signal SN. The inverted control signal SN is then supplied to the gate of the sixth n-channel FET 310.

[0047] The drain of the fifth n-channel FET 309 is connected to the source of the third p-channel FET 307 and its source is connected to the gate of the third p-channel FET 307 and to the gate of the fourth p-channel FET 315.

[0048] The source of the sixth n-channel FET 310 is connected to the source of the fourth n-channel FET 308 and its drain is connected to the gate of the fourth n-channel FET 308.

[0049] The drain of the fourth p-channel FET 315 is further connected to an input of a second output inverter 311, whose output Z0 is another of the outputs of the POC cell 300. The drain of the sixth n-channel FET 310 is also connected to the input of the second output inverter 311.

[0050] The nodes TN and T of the first TIE cell 312 are designated Y1 and Y1N, respectively. The nodes TN and T of the second TIE cell 313 are designated Y0 and Y0N, respectively.

[0051] The POC cell 300 can be used (e.g., in the POC source 105) to generate one bit of a POC value. It can therefore also be referred to as a POC bit cell. As explained, it has two sub-circuits, each containing a TIE cell 312, 313, and a pre-load circuit arrangement for forcing and releasing the non-equilibrium initial condition.

[0052] If the control input S is set to logic “0” (i.e., the VSS level), the first pre-charge circuit arrangement and the second pre-charge circuit arrangement (for the two TIE cells 312, 313) enforce TIE cell start conditions. V(Y1)=VDD, V(Y1N)=VSS, and V(Y0)=VDD, V(Y0N)=VSS, because all pre-charge transistors 304, 305, 309, 310 for the TIE cell nodes Y1, Y1n and Y0, Y0N are then in their respective ON states (with FETs 304, 305, 309, 310 being in strong inversion).

[0053] Fig. Figure 4 shows a time course diagram 400 of a precharge and subsequent relaxation (i.e. a precharge and relaxation process sequence) for the POC cell 300 from Fig. 3.

[0054] The signals S, Y1, Y1N, Y0, Y0N, Z1, Z0 are shown over time from left to right (where in each case a line at the top represents a higher potential (e.g. equal to or near the high operating potential VDD) and a line further down represents a lower potential (e.g. equal to or near the low operating potential VSS)).

[0055] First, the pre-charge circuit arrangement for the two TIE cells 312, 313 enforces the TIE cell start-up conditions. V(Y1)=VDD, V(Y1N)=VSS, V(Y0)=VDD, V(Y0N)=VSS.

[0056] This state is referred to as reset state 401 or the initial state. The control input S is then set to logic "1" (designated by reference 403), initiating a POC access state 402. After the POC access, the control input S is reset to logic "0", causing the circuit to return to its reset state 401.

[0057] The extremely nonlinear relaxation from the deep subthreshold non-equilibrium state of nodes Y1, Y1N and Y0, Y0N, after the constraints were released with S = logical "1" (i.e., during the POC access phase 402), is in Fig. 4 illustrates.

[0058] Due to manufacturing variations in the relevant FETs 301, 314, 302 of the first TIE cell 312 and the FETs 307, 315, 308 of the second TIE cell 313, the electrothermal relaxations of Y1, Y1N and Y0, Y0N typically deviate significantly with respect to their relaxation times (also strongly dependent on (VDD - VSS) and temperature, on the order of a few nanoseconds to several microseconds). Consequently, the output signals Z1 and Z0 switch to logic "1" at different times.

[0059] This is in Fig. 4 is specified by a time difference 404, which is called ΔtRelax and specifies the difference between time 405, when the first TIE cell 312 reaches its steady state (Z1 switches to logic “1”), and time 406, when the second TIE cell 313 reaches its steady state (Z0 switches to logic “1”).

[0060] Since the geometric dimensions (i.e., gate lengths and gate widths) of the TIE cell components 301, 314, 302, 307, 315, and 308 can be chosen to be very small, they can be made extremely sensitive to manufacturing process variations. This extreme sensitivity to variation of the TIE cells 312 and 313 is typically large enough to enable a very effective so-called stable bit marking, or customizable preselection of POC bits that exhibit a predetermined minimum bit stability, even with respect to environmental variations (such as temperature and supply voltage) as well as aging.

[0061] A first connection node 318 between the two series-connected first p-channel FETs 301 and 314 of the first TIE cell 312 is a floating node with an undefined electrical potential. Furthermore, a second connection node 320 between the two series-connected third p-channel FETs 307 and 315 of the second TIE cell 313 is also a floating node with an undefined electrical potential. These undefined electrical potentials increase the error rate within the POC cell 300.

[0062] If, for example, only the transistor widths were adjusted to increase stability, then the TIE cells 312, 313 would become very slow in some operating ranges.

[0063] According to various aspects of this disclosure, to reduce the error rate in the POC cell 300, a leakage circuit 322, 324 is provided in one or both TIE cells 312, 313, by means of which the hitherto undefined electrical potential at the first connection node 318 during the pre-charging state of the POC cell 300 is fixed to a predetermined or predefined reference potential (for example, the lower reference potential VSS, e.g., the ground potential).

[0064] For example, the first TIE cell 312 has a first leakage circuit 322, which is connected on one side to the first connection node 318 and on the other side to the low reference potential VSS, and is configured for the controlled leakage of electrical charge from the first connection node 318. The first leakage circuit 322 includes or is formed by a first leakage transistor (e.g., an n-FET) 322, whose drain (e.g., directly) is connected to the first connection node 318 and whose source (e.g., directly) is connected to the low reference potential VSS. The control terminal (e.g., gate) of the first leakage transistor 318 is connected (e.g., directly) to the input S and is controlled by means of the control input S.The first leakage circuit 322 thus figuratively forms a switch that is closed during the pre-charging process of the POC cell 300, thereby diverting the electrical charge located at the first connection node 318 to the low reference potential VSS. When the pre-charging process is complete, the switch is opened again, i.e., the first leakage transistor 322 is switched off, and thus the first connection node 318 is electrically disconnected from the low reference potential VSS, for example, by isolating it.

[0065] Furthermore, the second TIE cell 313, for example, has a second leakage circuit 324, which is connected on one side to the second connection node 330 and on the other side to the low reference potential VSS, and is configured for the controlled leakage of electrical charge from the second connection node 320. The second leakage circuit 324 has or is formed by a second leakage transistor (e.g., an n-FET) 324, whose drain (e.g., directly) is connected to the second connection node 320 and whose source (e.g., directly) is connected to the low reference potential VSS. The control terminal (e.g., gate) of the second leakage transistor 320 is connected (e.g., directly) to the input S and is controlled by means of the control input S.The second leakage circuit 324 thus also acts as a switch, which is closed during the pre-charging process of the POC cell 300 and therefore discharges the electrical charge located at the second connection node 320 to the low reference potential VSS. When the pre-charging process is complete, the switch is opened again, i.e., the second leakage transistor 324 is switched off, and thus the second connection node 320 is electrically disconnected from the low reference potential VSS, for example, by isolating it.

[0066] Alternatively, the control terminals (e.g., gates) of the leakage transistors 322, 324 can also be connected to a separate terminal (i.e., not to the input S) and controlled with a different control signal, but in such a way that the leakage transistors 322, 324 are closed during the pre-charging process and thus electrically connect the respective connection node 318, 320 to the low reference potential VSS and are open during normal operation (i.e., for example, when generating a cryptographic secret key) and thus electrically disconnect the respective connection node from the low reference potential.

[0067] During the pre-charging process, the control input S is logic "1" (visually a high-level signal, for example, 5 V). Thus, the first leakage transistor 322 and the second leakage transistor 324 are switched on, and any electrical charges present on the first junction node 318 or the second junction node 320 are shunted to the low reference potential VSS (for example, ground potential). In other words, the respective junction node 318, 320 is electrically connected to the low reference potential VSS. In this case, the signal SN provided by the input inverter 303 is logic "0" (visually a low-level signal, for example, 0 V). Therefore, the second n-channel FET 304 and the third n-channel FET 305 of the first pre-charging control circuit arrangement are switched off, and thus the first TIE cell 312 is deactivated.Furthermore, the fifth n-channel FET 309 and the sixth n-channel FET 310 of the second pre-charge control circuit arrangement are also blocked, and thus the second TIE cell 313 is also deactivated.

[0068] As soon as the POC cell 300 is to be started to generate a secret (e.g., a cryptographic key), the control input S is set to logic "0" (visually a low-level signal, for example, 0 V). Thus, the first leakage transistor 322 and the second leakage transistor 324 are electrically blocked, and the first connection node 318 and the second connection node 320 are electrically isolated from the low reference potential VSS (e.g., ground potential). In other words, the respective connection node 318, 320 is electrically isolated from the low reference potential VSS.

[0069] In this case, the SN signal provided by input inverter 303 is logic "1" (visually a high-level signal, for example, 5 V). Thus, the second n-channel FET 304 and the third n-channel FET 305 of the first pre-charge control circuit are switched on, and the first TIE cell 312 is activated. Furthermore, the fifth n-channel FET 309 and the sixth n-channel FET 310 of the second pre-charge control circuit are also switched on, and the second TIE cell 313 is also activated. However, the SN signal provided by input inverter 303 is delayed relative to the control input S (by the first buffer 316, the second buffer 317, and input inverter 303) before the SN signal initiates the generation of the secret using TIE cells 312 and 313.This delay is dimensioned to be sufficiently long so that the first leakage transistor 318 and the second leakage transistor 320 have enough time to complete their respective turn-off process.

[0070] Referring again to Fig. Figure 4 also shows the signals SD (output of the first buffer 316) and SN (output of the input inverter 303).

[0071] The buffers 316, 317 together with the input inverter 303 and the n-channel FETs 304, 305, 309, 310 form a clear circuit arrangement for forcing and releasing the non-equilibrium initial condition.

[0072] If the control input S is set to logical "0" (i.e., the VSS level, e.g., by a corresponding controller, e.g., the POC module 106), the TIE cell initial conditions are V(Y1)=VSS, V(Y1N)=VSS, V(Y0)=VSS, V(Y0N)=VSS, now forced, since the upper supply voltage (for example, high reference potential VDD in Fig. 3) the TIE cells 312, 313 are replaced with SD = logic “0”, and all pre-charge transistors 304, 305, 309, 310 for the TIE cell nodes Y1, Y1N and Y0, Y0N are in their respective ON states (strong inversion).

[0073] This reset state 401 is in Fig. 4 is specified as the initial state before the control input S is set to logic "1", thereby initiating the POC access. Afterwards, the POC access signal is reset to logic "0", thus returning the circuit to its reset state.

[0074] The POC access is initiated with the rising edge 403 from the control input S (S = logic “0” -> logic “1”), which first switches SD, which is the upper supply of the TIE cells 312, 313, to logic “1” (i.e. the VDD level), so that the nodes Y1 and Y0 are raised via the n-channel FETs 304, 309 to voltage levels of approximately VDD - Vth(n-channel FET 304) and VDD - Vth(n-channel FET 309), respectively. Shortly thereafter, the SN signal switches to logic "0" and switches off the pre-charge transistors 304, 305, 309, 310 for the TIE cell accounts Y1, Y1N and Y0, Y0N, causing the node voltages of the latter to drop slightly by a difference ΔVcc or a difference ΔVcc' due to capacitive coupling from the SN signal.

[0075] Then the relaxation of the node pairs Y1, Y1N and Y0, Y0N takes place: Y1 and Y0 begin from ((VDD - Vth) (n-channel FET 304) - ΔVcc) and ((VDD - Vth) (n-channel FET 309) - ΔVcc), respectively, and Y1N and Y0N begin from (VSS - ΔVcc'). This leads, firstly, to generally shorter relaxation times (since the n-channel FETs 301, 314 and the n-channel FETs 307, 315 begin in a comparatively shallower subthreshold state).

[0076] A negative feedback loop is also implemented with respect to temperature variations: since Vth(n-channel FET 304) and Vth(n-channel FET 309) increase with decreasing temperature, the initial voltage values ​​at nodes Y1 and Y0 decrease at lower temperatures, thereby increasing the relaxation rate and counteracting the decrease in relaxation rate due to higher threshold voltages of the n-channel FETs 301, 314, 302 and 307, 315, 308.

[0077] The extremely nonlinear relaxation from the deep subthreshold non-equilibrium state of nodes Y1, Y1N and Y0, Y0N, after the constraints were released with S = logical "1" (i.e., during the POC access phase 402), is in Fig. 4 indicated.

[0078] Due to manufacturing variations in the relevant transistors 301, 314, 302 (of the first TIE cell 312) and transistors 307, 315, and 308 (of the second TIE cell 313), the electrothermal relaxations of Y1, Y1N and Y0, Y0N typically deviate significantly with respect to their relaxation times (on the order of a few nanoseconds to several tens of nanoseconds). As a result, the output signals Z1 and Z0 transition to logic "1" at different times, which is indicated by a time difference of 404, as shown in Fig. 4 is given as ΔtRelax.

[0079] Fig. Figure 5 shows another POC cell 500, which is a variant of the POC cell 300. Fig. 3 can be seen.

[0080] The POC cell 500 differs from the POC cell 300 in that Fig. 3 in that the input inverter 503 does not receive its input signal via a second buffer 317, but receives an activation signal E (and accordingly a signal EN instead of SN in Fig. 3 generated).

[0081] Accordingly, the only difference to Fig. 3. Decoupling the timing of S and SN allows for an adjustable initial voltage level of nodes Y1 and Y0 by introducing a second input control signal E, which is inverted to EN and controls the switching off of the pre-charge transistors 504, 505, 509, 510 for the TIE cell nodes Y1, Y1N and Y0, Y0N. Accordingly, variable timing for the rising edges of S and E allows for a longer or shorter time to raise Y1 and Y0 after the rising edge of S and before the rising edge of E.

[0082] Again, the two leakage circuits 322, 324 (for example in the form of leakage transistors 322, 324) are provided for leaking electrical charge from the connection nodes 318, 320 during the pre-charging process.

[0083] Fig. Figure 6 shows a POC cell 600 according to another example.

[0084] Similar to the POC cell 300 from Fig. 3 the POC cell 600 includes a first TIE cell 601, which is formed by a first p-channel FET 602 and a second p-channel FET 603 in series and a first n-channel FET 604 and is equipped with a first output inverter 605, and a second TIE cell 606, which is formed by a third p-channel FET 607 and a fourth p-channel FET 608 in series and a second n-channel FET 609.

[0085] In addition, there is also a circuit arrangement for forcing and releasing the non-equilibrium initial condition, which includes a first input inverter 611 with an input S and an output SN, a second input inverter 612 with an input SN and an output SD, a first buffer 613 with an input SN and an output SND, a third input inverter 614 with an input SND and an output SD2, a second buffer 615 with an input SD2 and an output SDD, a fourth inverter 616 with an input SDD and an output SNDD, and (nMOS only) pre-charge transistors 617 to 620 for the TIE cell nodes Y1, Y1N and Y0, Y0N respectively.

[0086] For example, the first pre-charge n-channel FET 617 is supplied with SND at its gate and SD at its source and is coupled to Y1 at its drain, the second pre-charge n-channel FET 618 is supplied with SNDD at its gate and VSS at its source and is coupled to Y1N at its drain, the third pre-charge n-channel FET 619 is supplied with SND at its gate and SD at its source and is coupled to Y0 at its drain, and the fourth pre-charge n-channel FET 620 is supplied with SNDD at its gate and VSS at its source and is coupled to Y0N at its drain.

[0087] In this example, too, the two leakage circuits 322, 324 (for example in the form of leakage transistors 322, 324) are provided for leaking electrical charge from the connection nodes 318, 320 during the pre-charging process.

[0088] Fig. Figure 7 shows a time-series diagram 700 for the POC cell 600 from Fig. 6.

[0089] Similar to Fig. The signals S, SD, SDD, SND, SNDD, Y1, Y1N, Z1, Y0, Y0N and Z0 are shown from left to right in chronological order. As in Fig. Figure 4 shows the signals for reset states 701 and a POC access state 702.

[0090] If the control input S is set to logical "0" (i.e., for example, the VSS level, e.g., by a corresponding controller, e.g., the POC module 106), the TIE cell initial conditions are V(Y1)=VSS, V(Y1N)=VSS, V(Y0)=VSS, V(Y0N)=VSS, forced, since the upper supply voltage (VDD in Fig. 3) the TIE cells with SDD = logic “0” is replaced, and all precharge FETs 617, 618, 619 and 620 for the TIE cell nodes Y1, Y1N and Y0, Y0N are in their respective ON states (strong inversion).

[0091] This reset state is in Fig. 7 is specified as the initial state before the control input S is set to logic "1", thereby initiating the POC access. Afterwards, the POC access signal is reset to logic "0", thus returning the circuit to its reset state.

[0092] A POC access is initiated with the rising edge 703 of S (S = logic "0" -> logic "1"), which first changes SD, the precharge value for nodes Y1 and Y0, to logic "1" (i.e., for example, the VDD level), thereby setting nodes Y1 and Y0 to voltage levels of approximately ((VDD - Vth) (precharge FET 617) and (VDD - Vth) (precharge FET 619)) via the first precharge FET 617 and the third precharge FET 619, respectively, since the signal SND, which controls the gates of these precharge FETs 617, 619, remains at the VDD level for a short time interval due to the first delay buffer 613. Afterwards, SND switches to logic “0” and switches off the pre-charge FETs 617, 619 for the TIE cell nodes Y1 and Y0, causing the node voltages of the latter to drop slightly by ΔVcc due to capacitive coupling of SND.Finally, SNDD switches to logic “0” and turns off the second pre-charge FET 618 and the fourth pre-charge FET 619 for nodes Y1N and Y0N, causing the node voltages of the latter to drop slightly by ΔVcc due to capacitive coupling of SNDD.

[0093] Then the relaxation of the node pairs Y1, Y1N and Y0, Y0N takes place, but with different initial conditions: Y1 and Y0 start from (VDD - Vth(precharge FET 617) - ΔVcc) and (VDD - Vth(precharge FET 619) - ΔVcc)), respectively, and Y1N and Y0N start from VSS - ΔVcc' instead of VSS. This leads, firstly, to generally shorter relaxation times (since the p-channel FETs 602, 603, 607, 608 of the TIE cells start in a comparatively shallower subthreshold state).

[0094] Furthermore, and particularly importantly, negative feedback with respect to temperature variations is also implemented: since Vth(precharge-FET 617) and Vth(precharge-FET 619) increase with decreasing temperature, the initial values ​​of the voltages at nodes Y1 and Y0 decrease at lower temperatures, thereby increasing the relaxation rate and counteracting the decrease in relaxation rate due to higher threshold voltages of FETs 602, 603, 604, 607, 608, 609 of the TIE cells.

[0095] The extremely nonlinear relaxation from the deep subthreshold non-equilibrium state of nodes Y1, Y1N and Y0, Y0N, after the constraints were released with S = 1 (i.e., during the POC access phase 702), is in Fig. 7 is given.

[0096] Due to manufacturing variations in the relevant transistors 602, 603, 604 (first TIE cell 601) and transistors 607, 608, 609 (second TIE cell 602), the electrothermal relaxations of Y1, Y1N and Y0, Y0N typically deviate significantly with respect to their relaxation times (on the order of a few nanoseconds to several tens of nanoseconds). As a result, the output signals Z1 and Z0 transition to logic "1" at different times, which is indicated by a time difference of 704, as shown in Fig. 7 is specified as ΔtRelax.

[0097] Fig. Figure 8 shows a POC cell 800, which is the CMOS complement of the POC cell 300. Fig. 3 can be seen.

[0098] This means that the TIE cells 812, 813 are each connected by a p-channel FET 801, 807 and a series connection of n-channel FETs 802, 814, 808, 815 (instead of the other way around, as in Fig. 3) are formed and the pre-charge FETs 804, 805, 809, 810 are p-channel FETs (instead of n-channel FETs).

[0099] The POC cell 800 further differs from the POC cell 300 in that it has a first input inverter 803, which receives the input signal S and outputs SN to the source of the second pre-charge FET 805 and the fourth pre-charge FET 810, and a second input inverter 816, which receives SN, inverts it to SD and supplies SD to the gates of the pre-charge FETs 804 to 810.

[0100] The input inverters 803, 816 and the pre-charge FETs 804, 805 (for Y1 and Y1N) and 809, 810 (for Y0 and Y0N) form the circuit arrangement for forcing and releasing the non-equilibrium initial condition.

[0101] A third connection node 818 between the two series-connected seventh n-channel FETs 802 and eighth n-channel FETs 814 of the first TIE cell 812 is a floating node with an undefined electrical potential. Furthermore, a second connection node 820 between the two series-connected ninth n-channel FETs 808 and tenth n-channel FETs 815 of the second TIE cell 813 is also a floating node with an undefined electrical potential. These undefined electrical potentials increase the error rate within the POC cell 800.

[0102] According to various aspects of this disclosure, to reduce the error rate in the POC cell 300, a leakage circuit 822, 824 is provided in one or both TIE cells 812, 813, by means of which the hitherto undefined electrical potential at the third connection node 318 during the pre-charging state of the POC cell 800 is fixed to a predetermined or predefined reference potential (for example, the lower reference potential VSS, e.g., the ground potential).

[0103] For example, the first TIE cell 812 has a third leakage circuit 822, which is connected on one side to the third connection node 818 and on the other side to the high reference potential VDD, and is configured for the controlled leakage of electrical charge from the third connection node 318. The third leakage circuit 822 includes or is formed by a third leakage transistor (e.g., a p-channel FET) 822, whose drain (e.g., directly) is connected to the third connection node 818 and whose source (e.g., directly) is connected to the high reference potential VDD. The control terminal (e.g., gate) of the third leakage transistor 818 is connected (e.g., directly) to the input S and is controlled by the control input S.The third leakage circuit 822 thus acts as a switch that is closed during the pre-charging process of the POC cell 800, thereby diverting the electrical charge located at the third connection node 818 to the high reference potential VDD. When the pre-charging process is complete, the switch is opened again, i.e., the third leakage transistor 822 is switched off, and thus the third connection node 818 is electrically disconnected from the high reference potential VDD, for example, by isolating it.

[0104] Furthermore, the second TIE cell 813, for example, has a fourth leakage circuit 824, which is connected on one side to the fourth connection node 820 and on the other side to the high reference potential VDD, and is configured for the controlled leakage of electrical charge from the fourth connection node 820. The fourth leakage circuit 824 includes or is formed by a fourth leakage transistor (for example, a p-channel FET) 824, whose drain (e.g., directly) is connected to the fourth connection node 820 and whose source (e.g., directly) is connected to the high reference potential VDD. The control terminal (e.g., gate) of the fourth leakage transistor 820 is connected (e.g., directly) to the input S and is controlled by means of the control input S.The fourth leakage circuit 824 thus also acts as a switch, which is closed during the pre-charging process of the POC cell 800 and therefore discharges the electrical charge located at the fourth connection node 820 to the high reference potential VDD. When the pre-charging process is complete, the switch is opened again, i.e., the fourth leakage transistor 824 is switched off, and thus the fourth connection node 820 is electrically disconnected from the high reference potential VDD, for example, by isolating it.

[0105] Alternatively, the control terminals (e.g., gates) of the leakage transistors 822, 824 can also be connected to a separate terminal (i.e., not to the input S) and controlled by a different control signal, but in such a way that the leakage transistors 822, 824 are closed during the pre-charging process and thus electrically connect the respective connection node 818, 820 to the high reference potential VDD and are open during normal operation (i.e., for example, when generating a cryptographic secret key) and thus electrically disconnect the respective connection node from the high reference potential VDD.

[0106] During the pre-charging process, the control input S is logic "0" (visually a low-level signal, for example, 0 V). Thus, the third leakage transistor 822 and the fourth leakage transistor 824 are switched on, and any electrical charges present on the third connection node 818 or the fourth connection node 820 are discharged to the high reference potential VDD. In other words, the respective connection node 818, 820 is electrically connected to the high reference potential VDD. In this case, the signal SN provided by the input inverter 803 is logic "1" (visually a high-level signal, for example, 5 V). Therefore, the p-channel FET 804 and the p-channel FET 805 of the first pre-charging control circuit arrangement are switched off, and thus the first TIE cell 812 is deactivated.Furthermore, the p-channel FET 809 and the p-channel FET 810 of the second pre-charge control circuit arrangement are also blocked, and thus the second TIE cell 813 is also deactivated.

[0107] As soon as the POC cell 800 is to be started to generate a secret (e.g., a cryptographic key), the control input S is set to logic "1" (visually, a high-level signal, for example, 5 V). Thus, the third leakage transistor 822 and the fourth leakage transistor 824 are switched off, and the third connection node 818 and the fourth connection node 820 are electrically isolated from the high reference potential VDD. In other words, the respective connection node 818, 820 is electrically isolated from the high reference potential VDD.

[0108] In this case, the SN signal provided by input inverter 803 is logic "0" (visually a low-level signal, for example, 0 V). Thus, the p-channel FETs 804 and 805 of the first pre-charge control circuit are switched on, and the first TIE cell 812 is activated. Furthermore, the p-channel FETs 809 and 810 of the second pre-charge control circuit are also switched on, and the second TIE cell 813 is also activated. However, the SN signal provided by input inverter 803 is delayed relative to the control input S (by the first buffer 816 and input inverter 803) before the SN signal starts the generation of the secret using TIE cells 812 and 813. This delay is dimensioned to be sufficiently long so that the third leakage transistor 818 and the fourth leakage transistor 820 have enough time to complete their respective turn-off process.

[0109] Fig. Figure 9 shows a time series diagram 900 for the POC cell 800 from Fig. 8.

[0110] Similar to Fig. 4 and Fig. The signals S, SN, SD, Y1, Y1N, Z1, Y0, Y0N and Z0 are shown from left to right in chronological order. As in Fig. 4 and Fig. Figure 7 shows the signals for reset states 901 and a POC access state 902.

[0111] If the control input S is set to logical "0" (i.e., for example, the VSS level), e.g., by a corresponding controller, e.g., the POC module 106, the TIE cell initial conditions will be V(Y1)=VDD, V(Y1N)=VDD, V(Y0)=VDD, V(Y0N)=VDD, forced, since the lower supply voltage (VSS in Fig. 3) the TIE cells with SN = logic “1” is replaced, and all precharge FETs 804, 805, 809, 810 for the TIE cell nodes Y1, Y1N and Y0, Y0N are in their respective ON states (strong inversion).

[0112] This reset state is in Fig. 9 is specified as the initial state before the control input S is set to logic "1", thereby initiating the POC access. Afterwards, the POC access signal is reset to logic "0", thus returning the circuit to its reset state.

[0113] The POC access is initiated with the rising edge 1303 of S (S = logical “0” -> logical “1” of S), which first switches SN, the lower supply of the TIE cells 812, 813, to logical “0” (VSS level), so that the nodes Y1N and Y0N are reduced via the second pre-charge FET 805 and the fourth pre-charge FET 810 to voltage levels of approximately |Vth(pre-charge FET 805)| and |Vth(pre-charge FET 810)| respectively.

[0114] Shortly thereafter, SD switches to logic "1" and switches off the pre-charge FETs 804, 805, 809, 810 for the TIE cell accounts Y1, Y1N and Y0, Y0N, causing the node voltages of the latter to increase slightly by ΔVcc or ΔVcc' due to capacitive coupling of SN.

[0115] Then the relaxation of the node pairs Y1, Y1N and Y0, Y0N takes place, but with the following initial conditions: Y1N and Y0N no longer start from VSS, but from |Vth(Vorlade-FET 805) |+ ΔVcc or |Vth(Vorlade-FET 810)|+ ΔVcc and Y1 and Y0 start from VDD+ΔVcc' instead of VDD.

[0116] This leads firstly to generally shorter relaxation times (since the n-channel FETs 802, 814, 808, 815 of the TIE cells start in a comparatively less deep subthreshold state).

[0117] Furthermore, and particularly importantly, negative feedback is also implemented with respect to temperature variations: since |Vth(precharge-FET 805)| and |Vth(precharge-FET 810)| increase with decreasing temperature, the initial voltage values ​​at nodes Y1N and Y0N increase at lower temperatures, thereby increasing the relaxation rate and counteracting the decrease in relaxation rate due to higher threshold voltages of FETs 801, 802, 814, 807, 808, 815 of the TIE cells.

[0118] The extremely nonlinear relaxation from the deep subthreshold non-equilibrium state of nodes Y1, Y1N and Y0, Y0N, after the constraints were released with S = logical "1" (i.e., during the POC access phase 902), is in Fig. 9 is indicated.

[0119] Due to manufacturing variations in the relevant FETs 801, 802, 804 (of the first TIE cell 812) and FETs 807, 808, 815 (of the second TIE cell 813), the electrothermal relaxations of Y1, Y1N and Y0, Y0N typically deviate significantly with respect to their relaxation times (on the order of a few nanoseconds to several tens of nanoseconds). As a result, the output signals Z1 and Z0 transition to logic "1" at different times, which is indicated by a time difference of 904, as shown in Fig. 9 is specified as ΔtRelax.

[0120] In summary, according to various embodiments, a physically obfuscated circuit (POC) as described in Fig. 10 illustrated examples provided.

[0121] Fig. Figure 10 shows a physically obfuscated circuit 1000 according to one embodiment.

[0122] The physically obfuscated circuit 1000 comprises several sub-circuits 1001, each sub-circuit 1001 comprising at least one p-channel field-effect transistor 1002, at least one n-channel field-effect transistor 1003, a first power supply terminal 1004 configured to receive a first supply voltage with an upper supply potential, and a second power supply terminal 1005 configured to receive a second supply voltage with a lower supply potential.

[0123] The at least one p-channel field-effect transistor 1002 and the at least one n-channel field-effect transistor 1003 are connected such that the at least one n-channel field-effect transistor 1003, if supplied with the upper supply potential at its gate, provides the lower supply potential to the gate of the at least one p-channel field-effect transistor 1002, and the at least one p-channel field-effect transistor 1002, if supplied with the lower supply potential at its gate, provides the upper supply potential to the gate of the at least one n-channel field-effect transistor 1003.

[0124] Each sub-circuit 1001 further includes a pre-charge circuit 1006, which is configured to pre-charge the sub-circuit to a first state in which the potential at the gate of the at least one n-channel field-effect transistor 1003 is lower than the upper supply potential and the potential at the gate of the at least one p-channel field-effect transistor 1002 is higher than the lower supply potential.

[0125] The physically obfuscated circuit 1000 further includes a physically obfuscated circuit value bit generation circuit 1007, which generates at least one physically obfuscated circuit value bit depending on which of the sub-circuits 1001 first enters a second state in which the potential at the gate of the at least one n-channel field-effect transistor 1003 is the upper potential and the potential at the gate of the at least one p-channel field-effect transistor 1002 is the lower potential.

[0126] The physically obfuscated circuit (POC) circuit 1000 can, for example, correspond to the POC source 105 together with the POC module 106.

[0127] In other words, according to various embodiments, two (or more) TIE cells (referred to above as a "sub-circuit"), each containing at least one p-channel FET and at least one n-channel FET, which maintain each other in a steady state by mutually turning them on, are each pre-charged to an inverse state. The inverse state is the opposite of the steady state in that the FETs are off. A POC bit is generated based on which TIE cell reaches its steady state first. If there are more than two TIE cells, multiple POC bits can be generated by the POC bit generation circuit based on the order in which the TIE cells reach the steady state.

[0128] The first state can be a state when the FETs are off, and the second state can be a state when the FETs are on. It should be noted that there can be a "relaxation state" between the first and second states; that is, a state that each subcircuit has when transitioning from the first to the second state. The first state (possibly together with the relaxation state) can be considered a "non-equilibrium" state.

[0129] The relaxation state of a subcircuit begins, for example, when the pre-charge circuit completes the pre-charging of the circuit, i.e., releases the subcircuit from the first state (which is enforced by the pre-charge). For example, in the first state, the pre-charge circuit forces the subcircuit to be in (and remain in) the first state and then "releases" the subcircuit to transition to its second state. The subcircuits can then be seen as "racing" to the second state, and the POC bit generation circuit generates one or more POC bits based on which subcircuit "wins the race" (or, in the case of more than two TIE cells, possibly based on the order in which the TIE cells complete their respective relaxations).

[0130] The following explains various aspects of the revelation: Example 1 is a physically obfuscated circuit. The physically obfuscated circuit has several subcircuits, each subcircuit comprising: several series-connected transistors of a first conductivity type; and at least one transistor of a second conductivity type that is different from the first conductivity type. The transistors are connected such that the several series-connected transistors of the first conductivity type, if supplied with a first reference potential at their respective control terminals, provide a second reference potential. which is different from the first reference potential, is supplied to the control terminal of at least one transistor of the second conductivity type; and that the at least one transistor of the second conductivity type, if supplied with a second reference potential at its control terminal, supplies the first reference potential to the control terminal of each of the several series-connected transistors of the first conductivity type. The physically obfuscated circuit further comprises a pre-charge circuit configured to pre-charge the sub-circuit to a first state in which the potential at the control terminal of the at least one transistor of the second conductivity type is different from the second reference potential, and the potential at the control terminal of each of the several series-connected transistors of the first conductivity type is different from the first reference potential.The physically obfuscated circuit further features a physically obfuscated circuit value bit generation circuit. which generates at least one physically obfuscated circuit value bit depending on which of the sub-circuits first enters a second state, in which the potential at the control terminal of at least one transistor of the second conductivity type is the second reference potential and the potential at the control terminal of each of the several series-connected transistors of the first conductivity type is the first reference potential. At least one sub-circuit of the several sub-circuits has a drain circuit which is connected to a junction node between two transistors of the several series-connected transistors of the first conductivity type for controlled draining of electrical charge from the junction node. In Example 2, the subject of Example 1 may optionally feature that the second reference potential is higher than the first reference potential; and that the pre-charge circuit for pre-charging the sub-circuit is configured to the first state in which the potential at the control terminal of the at least one second conductance type transistor is lower than the second reference potential and the potential at the control terminal of each of the several first conductance type transistors connected in series is higher than the first reference potential. In Example 3, the subject of Example 2 may optionally have the first conductivity type being a p-conductivity type; and the second conductivity type being an n-conductivity type. In Example 4, the subject of Example 1 may optionally feature that the second reference potential is lower than the first reference potential; and that the pre-charge circuit for pre-charging the sub-circuit is configured to the first state in which the potential at the control terminal of the at least one second conductance type transistor is higher than the second reference potential and the potential at the control terminal of each of the several first conductance type transistors connected in series is lower than the first reference potential. In Example 5, the subject of Example 4 may optionally have that the first conductivity type is an n-conductivity type; and that the second conductivity type is a p-conductivity type. In Example 6, the subject of any of Examples 1 to 5 may optionally include that each sub-circuit of the multiple sub-circuits has a drain circuit connected to a junction node between two transistors of the multiple series-connected transistors of the first conductivity type for controlled draining of electrical charge from the junction node. In Example 7, the object of any of Examples 1 to 6 may optionally include a switching circuit that connects or disconnects the connection node from the first reference potential. In Example 8, the subject of Example 7 may optionally include the switch having or being formed by a transistor of the second conductivity type. In Example 9, the item of any of Examples 1 to 8 may optionally have that the at least one transistor of the second conductivity type has several transistors of the second conductivity type connected in series. In Example 10, the subject of Example 9 may optionally include at least one sub-circuit of the several sub-circuits having an additional drain circuit which is connected to an additional junction node between two transistors of the several series-connected transistors of the second conductivity type for controlled draining of electrical charge from the additional junction node. In Example 11, the item of any of Examples 1 to 10 may optionally have the pre-charge circuit configured to initiate a transition of the sub-circuit from the first state to the second state after the sub-circuit has been pre-charged to the first state. In Example 12, the item of any of Examples 1 to 11 may optionally have the pre-charge circuit configured to initiate a transition of the sub-circuits from the first state to the second state by supplying a common input signal to the sub-circuits. In Example 13, the item of any of Examples 1 to 12 may optionally have the preload circuit configured to preload the circuit to the first state in response to receiving a request for a Physically Obfuscated Circuit value. In Example 14, the object can optionally exhibit any of Examples 1 to 13 such that the second state is a stationary state of the subcircuit and the first state is an inverse state of the second state. In Example 15, the object of any of Examples 1 to 14 may optionally have such that in the first state the potential at the control terminal of the at least one transistor of the second conductivity type is the first reference potential and the potential at the control terminal of each of the several series-connected transistors of the first conductivity type is the second reference potential. In Example 16, the subject of any of Examples 1 to 15 may optionally have such that, in the first state, the potential at the control terminal of the at least one transistor of the second conductivity type is a potential to turn off the at least one transistor of the second conductivity type, and the potential at the control terminal of each of the several series-connected transistors of the first conductivity type is a potential to turn off each of the several series-connected transistors of the first conductivity type. In Example 17, the object of any of Examples 1 to 16 may optionally include the Physically Obfuscated Circuit Value Bit Generation Circuit configured to receive a signal from each sub-circuit indicating the state of the sub-circuit. In Example 18, the subject of Example 14 may optionally include a physically obfuscated circuit value bit generation circuit comprising a latch circuit which is supplied with the signal indicating the state of the sub-circuit by each sub-circuit and is configured to switch depending on which of the sub-circuits enters the second state first. In Example 19, the subject of any of Examples 1 to 18 may optionally include that the multiple subcircuits comprise three or more subcircuits and that the Physical Obfuscated Circuit Value Bit Generating Circuit is configured to generate multiple Physical Obfuscated Circuit Value Bits depending on an order in which the subcircuits enter the second state. In Example 20, the subject of any of Examples 1 to 19 may optionally include that the physically obfuscated circuit further comprises a key generator configured to generate a cryptographic key based on the Physically Obfuscated Circuit Value Bit. In Example 21, the object of any of Examples 1 to 20 may optionally have such that, in the first state, the potential at the control terminal of the at least one transistor of the second conductivity type depends on a transistor threshold voltage of a transistor of the pre-charge circuit. In Example 22, the object of any of Examples 1 to 21 may optionally have such that, in the first state, the potential at the control terminal of each transistor of the several series-connected transistors of the first conductance type depends on a transistor threshold voltage of a transistor of the pre-charge circuit. In Example 23, the object of any of Examples 1 to 22 may optionally have such that, in the first state, the potential at the control terminal of the at least one transistor of the second conductivity type is the first operating potential plus or minus a transistor threshold voltage of a transistor of the pre-charge circuit. In Example 24, the object of any of Examples 1 to 23 may optionally have such that, in the first state, the potential at the control terminal of each of the several series-connected transistors of the first conductivity type is the second operating potential plus or minus a transistor threshold voltage of a transistor of the pre-charge circuit.

Claims

[1] Physically obfuscated circuit (106) comprising: several subcircuits (312, 313), each subcircuit comprising: • several transistors (301,314) of a first conductivity type connected in series; • at least one transistor (302) of a second conductivity type that is different from the first conductivity type; • wherein the transistors are connected in such a way that - the several series-connected transistors (301, 314) of the first conductivity type, if they are supplied with a first reference potential (VSS) at their respective control terminals, supply a second reference potential (VDD), which is different from the first reference potential (VSS), to the control terminal of at least one transistor (302) of the second conductivity type; and - which, if supplied with a second reference potential (VDD) at its control terminal, provides the first reference potential (VSS) to the control terminal of each of the several series-connected transistors (301, 314) of the first conductivity type; and - a pre-charge circuit (304) configured to pre-charge the sub-circuit (312, 313) to a first state in which the potential at the control terminal of the at least one second conductivity type transistor (302) is different from the second reference potential (VDD) and the potential at the control terminal of each of the several first conductivity type transistors (301, 314) connected in series is different from the first reference potential (VSS); • wherein the physically obfuscated circuit further comprises a physically obfuscated circuit value bit generation circuit (1007) which generates at least one physically obfuscated circuit value bit depending on which of the sub-circuits (312, 313) first enters a second state in which the potential at the control terminal of the at least one transistor of the second conductivity type is the second reference potential (VDD) and the potential at the control terminal of each of the several series-connected transistors (301, 314) of the first conductivity type is the first reference potential (VSS);and wherein at least one sub-circuit of the several sub-circuits has a drain circuit (322) which is connected to a junction node (318) between two transistors (301, 314) of the several series-connected transistors (301, 314) of the first conductivity type for controlled draining of electrical charge from the junction node (318). [2] Physically obfuscated circuit (106) according to claim 1, • where the second reference potential (VDD) is higher than the first reference potential (VSS); and • wherein the pre-charge circuit (304) is configured to pre-charge the sub-circuit in the first state in which the potential at the control terminal of the at least one second conductivity type transistor (302) is lower than the second reference potential (VDD) and the potential at the control terminal of each of the several series-connected first conductivity type transistors (301,314) is higher than the first reference potential (VSS). [3] Physically obfuscated circuit according to claim 2, • where the first conductivity type is a p-conductivity type; and • where the second conductivity type is an n-conductivity type. [4] Physically obfuscated circuit (800) according to claim 1, • where the second reference potential (VSS) is lower than the first reference potential (VDD); and • wherein the pre-charge circuit for pre-charging the sub-circuit is configured to the first state in which the potential at the control terminal of the at least one second conductivity type transistor (801) is higher than the second reference potential and the potential at the control terminal of each of the multiple series-connected first conductivity type transistors (802, 814) is lower than the first reference potential (VDD). [5] Physically obfuscated circuit according to claim 4, • where the first conductivity type is an n-conductivity type; and • where the second conductivity type is a p-conductivity type. [6] Physically obfuscated circuit according to any one of claims 1 to 5, wherein each sub-circuit (312, 313) of the multiple sub-circuits has a leakage circuit (322, 324) which is connected to a junction node (318, 320) between two transistors of the multiple series-connected transistors of the first conductivity type for controlled leakage of electrical charge from the junction node (322, 324). [7] Physically obfuscated circuit according to any one of claims 1 to 6, wherein the leakage circuit (322, 324) has a switch that connects the connection node (318, 320) to the first reference potential or disconnects it from the first reference potential. [8] Physically obfuscated circuit according to claim 7, wherein the switch comprises or is formed by a transistor of the second conductivity type. [9] Physically obfuscated circuit according to any one of claims 1 to 8, wherein the at least one second conductivity type transistor comprises several second conductivity type transistors connected in series. [10] Physically obfuscated circuit according to claim 9, wherein at least one sub-circuit (313) of the several sub-circuits has an additional drain circuit which is connected to an additional junction node between two transistors of the several series-connected transistors of the second conductivity type for controlled draining of electrical charge from the additional junction node. [11] Physically obfuscated circuit according to any one of claims 1 to 10, wherein the pre-charge circuit (304, 309, 310) is configured to initiate a transition of the sub-circuit from the first state to the second state after pre-charging the sub-circuit to the first state. [12] Physically obfuscated circuit according to any one of claims 1 to 11, wherein the pre-charge circuit (304, 309, 310) is configured to initiate a transition of the sub-circuits from the first state to the second state by supplying a common input signal to the sub-circuits. [13] Physically obfuscated circuit according to any one of claims 1 to 12, wherein the preload circuit (304, 309, 310) is configured to preload the circuit to the first state in response to receiving a request for a physically obfuscated circuit value (1007). [14] Physically obfuscated circuit according to any one of claims 1 to 13, wherein the second state is a stationary state of the sub-circuit (312,313) and the first state is an inverse state of the second state. [15] Physically obfuscated circuit according to any one of claims 1 to 14, wherein in the first state the potential at the control terminal of the at least one transistor (302) of the second conductivity type is the first reference potential (VSS) and the potential at the control terminal of each of the several series-connected transistors of the first conductivity type is the second reference potential (VDD). [16] Physically obfuscated circuit according to any one of claims 1 to 15, wherein in the first state the potential at the control terminal of the at least one transistor (302) of the second conductivity type is a potential to turn off the at least one transistor (302) of the second conductivity type and the potential at the control terminal of each of the several series-connected transistors (301, 314) of the first conductivity type is a potential to turn off each of the several series-connected transistors of the first conductivity type. [17] Physically obfuscated circuit according to any one of claims 1 to 16, wherein the physically obfuscated circuit value bit generation circuit (1007) is configured to receive a signal from each sub-circuit (312, 313) indicating the state of the sub-circuit (312, 313). [18] Physically obfuscated circuit according to claim 14, wherein the physically obfuscated circuit value bit generation circuit (1007) comprises a latch circuit which is supplied with the signal indicating the state of the sub-circuit (312,313) by each sub-circuit (312,313) and is configured to be switched depending on which of the sub-circuits (312,313) enters the second state first. [19] Physically obfuscated circuit according to any one of claims 1 to 18, wherein the multiple sub-circuits (312, 313) comprise three or more sub-circuits and the physically obfuscated circuit value bit generation circuit (1007) is configured to generate multiple physically obfuscated circuit value bits depending on a sequence in which the sub-circuits enter the second state. [20] Physically obfuscated circuit according to any one of claims 1 to 19, further comprising: a key generator configured to to generate a cryptographic key based on the Physically Obfuscated Circuit Value Bit. [21] Physically obfuscated circuit according to any one of claims 1 to 20, wherein in the first state the potential at the control terminal of the at least one transistor (302) of the second conductivity type depends on a transistor threshold voltage of a transistor (304, 209, 310) of the pre-charge circuit. [22] Physically obfuscated circuit according to one of claims 1 to 21, wherein in the first state the potential at the control terminal of each transistor (301, 314) of the several series-connected transistors of the first conductivity type depends on a transistor threshold voltage of a transistor (304, 209, 310) of the pre-charge circuit. [23] Physically obfuscated circuit according to any one of claims 1 to 22, wherein in the first state the potential at the control terminal of the at least one transistor (302) of the second conductivity type is the first operating potential plus or minus a transistor threshold voltage of a transistor (304, 209, 310) of the pre-charge circuit. [24] Physically obfuscated circuit according to any one of claims 1 to 23, wherein in the first state the potential at the control terminal of each transistor of the several series-connected transistors (301, 314) of the first conductivity type is the second operating potential plus or minus a transistor threshold voltage of a transistor of the pre-charge circuit.

Images