METHOD FOR PROVIDING CONFIGURATION INFORMATION FOR THE GENERATION OF PHYSICALLY OBFUSKED INFORMATION ON A CHIP

Abstract

According to one embodiment, a method for providing configuration information for generating physically obfuscated information on a chip with a set of circuits having multiple delay stages, wherein each delay stage has at least two delay elements, the method comprises determining, for each of the circuits, for each delay stage, which of the delay elements of the delay stage has the least delay among the delay elements of the delay stage, determining, depending on the determined delay elements, configuration information that specifies for each of the circuits a configuration of the circuit in which the delay elements of different delay stages are cascaded such that at least one path from an input of the circuit to an output of the circuit is formed, and storing the determined configuration information.

Description

[0001] Embodiments generally relate to methods for providing configuration information for generating physically obfuscated information on a chip.

[0002] Reverse engineering of integrated circuits (ICs), also referred to as "chips," is considered one of the most serious threats to the semiconductor industry because it can be abused to copy a design: successful attackers can use and sell similar, i.e., "cloned," ICs. Therefore, techniques are desirable that make it possible to prevent the reverse engineering (and especially the copying or "cloning") of integrated circuits, or at least make it so difficult that it is no longer profitable. One possibility is the use of physically obfuscated information, e.g., physically obfuscated values ​​("POC values"), which act like a fingerprint of a chip and thus prevent its cloning. However, these should be generated as robustly as possible to prevent an authentic chip from being mistakenly identified as a clone or to require complex error correction.

[0003] The publication DE 10 2020 106 346 A1 describes an integrated circuit having a plurality of subcircuits with different signal transfer response times, a control circuit configured to form two competing paths from the plurality of subcircuits in response to a control signal, an input circuit configured to supply an input signal to the two competing paths, and an output circuit configured to generate an output value depending on which of the competing paths has transferred the input signal with a shorter response time.

[0004] Publication US 2022 / 0 303 145 A1 discloses a method and an electronic device for configuring a PUF (Physically Uncloneable Function), wherein PUF cells are configured to use a signal path, a winner of a race between pairs of PUF cells is determined in a first round and in a second round, wherein the winners of the first round compete against each other, the first and second rounds are repeated for different signal paths, a comparison metric is determined for each signal path, wherein the comparison metric is based on the number of outputs of the PUF cells that have the common signal path, an optimal signal path for the PUF is determined from the respective comparison metrics, and the PUF is configured to use the optimal signal path.

[0005] Publication CN 1 07 145 804 A discloses a PUF circuit in which a selector selects which of two inverters transmits a signal. Due to uncontrollable variations in the chip manufacturing process, the signal time delays of the two inverters differ. This is exploited for PUF generation.

[0006] According to one embodiment, a method is provided for providing configuration information for generating physically obfuscated information on a chip (i.e., in an integrated circuit), the chip comprising a set of circuits each comprising a plurality of delay stages, each delay stage comprising at least two delay elements, and the method comprising: • Determining, for each of the circuits, for each delay stage, which of the delay elements of the delay stage has the shortest delay among the delay elements of the delay stage. (With two delay elements per delay stage, this is equivalent to determining which of the delay elements of the delay stage has the longer delay.) Each delay element has a delay element bypass, and determining the delay elements with the shortest delay comprises cascading the delay stages into multiple paths, bypassing the delay elements of all delay stages of the circuit except one delay stage, whose delay element with the shortest delay is to be determined, and detecting which path an input signal propagated through most quickly. • Determining, depending on the determined delay elements, configuration information which specifies a circuit configuration for each of the circuits, in which the delay elements of different delay stages are connected in series such that (e.g. by means of the determined delay elements) at least one path is formed from an input of the circuit to an output of the circuit (e.g. so that the delay elements form a path which, in each delay stage, leads through the delay element with the lowest delay among the delay elements of the delay stage; with two delay elements per stage, this is equivalent to configuring the circuit so that the delay elements with the higher delay also form a path) • Save the determined configuration information.

[0007] The figures do not represent actual dimensions but are intended to illustrate the principles of the various embodiments. Various embodiments are described below with reference to the following figures. Fig. 1 shows a chip card as an example of a device with an IC. Fig. Figure 2 shows an example of a delay element, a Schmitt trigger. Fig. 3 shows a POC circuit element with a series connection of two delay stages. Fig. 4 shows a delay circuit in which, in addition to a delay element, a bypass element is provided in parallel. Fig. 5 shows a POC circuit element with a series connection of two delay stages by means of a multiplexer. Fig. Figure 6 shows an RS flip-flop 600 based on two NOR gates. Fig. Figure 7 shows a transfer gate, also called a differential feedback transfer gate. Fig. Figure 8 shows the temporal behavior when switching the input node pair of the transmission gate of Fig. 7. Fig. 9 shows a flow diagram illustrating a method for providing configuration information for generating physically obfuscated information on a chip. Fig. 10 shows a chip according to one embodiment.

[0008] The following detailed description refers to the accompanying figures, which show details and exemplary embodiments. These exemplary embodiments are described in such detail that those skilled in the art can carry out the invention. Other embodiments are also possible, and the exemplary embodiments can be modified structurally, logically, and electrically without departing from the scope of the invention. The various exemplary embodiments are not necessarily mutually exclusive, but different embodiments can be combined with one another to create new embodiments. In this description, the terms "connected," "connected," and "coupled" are used to describe both a direct and an indirect connection, a direct or indirect connection, and a direct or indirect coupling.

[0009] A promising approach for the reliable and secure identification and authentication of ICs (and thus for preventing copies of ICs from being used instead of original ICs) involves the use of so-called physical random functions or physically obfuscated circuits (POCs) to securely generate secret information (e.g., keys for cryptographic algorithms) on the respective chip. Ideally, POCs generate chip-specific keys (i.e., POC values ​​consisting of a specific number of POC bits, e.g., 128 bits) that are arbitrarily repeatable but unpredictable for any given chip and cannot be determined from outside the chip.This can be achieved by exploiting random variations in IC manufacturing processes while ensuring that the POC value generation remains robust to process variations and is robust to temperature and supply voltage variations.

[0010] Because POCs can be integrated on-chip along with dedicated control logic, any attempt to physically access the POC circuitry itself can be very effectively and efficiently restricted. This significant resistance to physical attacks is the main advantage of using controlled POCs on chips.

[0011] A POC value P can be thought of as a kind of fingerprint of a physical object. Using the true POC value P, i.e., the POC value at its registration, the physical object can be uniquely identified and, for example, a key can be created based on the identification. The physical object can be a controller or a microcontroller. It can also be a chip card IC (integrated circuit, i.e., chip) of a chip card such as a smart card with any form factor, e.g., for a passport or for a SIM (Subscriber Identity Module).

[0012] Fig. 1 shows a chip card 100 as an example of a device with an IC (ie, a chip).

[0013] The chip card 100, which is shown here in card format but can have any form factor, has a carrier 101 and a chip card module 102 (i.e., an IC / chip). The chip card module 102 has various components, such as a non-volatile memory 103 and a CPU (central processing unit) 104. In various embodiments, the chip card has a component 105 that serves as a POC source, e.g., a circuit having a plurality of subcircuits, wherein an output of a subcircuit specifies (or is used as the basis for) one or more bits of a POC value. The chip card using a POC is only an example and can be a device having any type of integrated circuit.

[0014] The POC value P can be viewed as an identification number for the chip card 100 (more precisely: for the chip card module 102 in the chip card 100). The chip card module 102, for example, has a cryptoprocessor that derives a chip card-specific cryptographic key from this identification number, or the CPU 104 itself derives a cryptographic key from it.

[0015] For security reasons, neither the true POC value P nor the cryptographic key derived from it are stored on the chip card 100. Instead, the chip card 100 contains a so-called POC module 106, which is connected to the POC source 105. If the POC value P is required (e.g., for key generation), a so-called POC request is sent to the POC module 106, whereupon the POC module 106 redetermines the POC value each time (through an internal electronic process). In other words: the POC module 106 responds to a POC request by outputting a POC value P', which, depending on the bit stability of the bits supplied by the POC source 105, may deviate more or less significantly from the true POC value P, i.e., the POC value when it was registered. In order to determine the true POC value P from P', error correction may be performed, for which auxiliary data may be stored on the chip 100.However, it is desirable that the POC value generation is as robust as possible so that P' agrees with P as well as possible and no overly complex error correction or excessively extensive auxiliary data need to be provided.

[0016] According to various embodiments, a POC or POC generation is provided that is highly robust, especially against voltage and temperature fluctuations. This allows the effort (in terms of computing time, required chip area, memory, etc.) for error correction to be kept to a minimum.

[0017] Furthermore, the POC value generation is performed in such a way that an IC-specific value, referred to below as a password, is required to correctly generate the POC value (i.e., a POC value that at least largely matches the true POC value). Using this password, the POC value can then be retrieved during use of the chip. In the event of an unauthorized access attempt, which can be detected by the fact that the generated POC value deviates significantly from the true POC value and can therefore be assumed to have occurred without the correct password, an alarm signal can be issued or other security measures can be taken, e.g., blocking one or more circuits of the IC, etc.A verification circuit can therefore be provided on a chip which is designed to check whether the generated POC value deviates from the true POC value by more than a predetermined amount and, if necessary, triggers safety measures (alarm, deactivation of circuit parts or functions, etc.).

[0018] According to various embodiments, the POC generation is based on pairs of delay elements with identical design (or sets with a larger number of delay elements, but pairs are used as an example below), whose delays (e.g. first delay element: delay τ, second delay element: delay τ') depend on local process variations (e.g. by using MOSFETs (metal oxide semiconductor field effect transistors) with small widths and lengths, e.g. according to the technology used, minimal widths and lengths).

[0019] As a result, the difference Δτ = τ-τ' between the two delay elements varies considerably more than the delays of conventional buffer circuits.

[0020] Fig. Figure 2 shows an example of a delay element, a Schmitt trigger (or “Schmitt trigger buffer circuit”) 200.

[0021] The Schmitt trigger 200 includes two series-connected pMOS (i.e., p-channel MOS) FETs 201, 202, which in turn are connected in series (between a high supply potential 205 and a low supply potential 206) with two series-connected nMOS FETs 203, 204 by means of a connection node 208. The gate of each of the FETs 201-204 is connected to an input 207 (input signal A) of the Schmitt trigger 200. The connection node 208 forms the output of the Schmitt trigger 200 (output signal Z). This is connected to the gate of a third pMOS FET 209 and the gate of a third nMOS FET 210.

[0022] The third pMOS-FET 209 has its drain connected to the low supply potential 206 and its source connected to the connection node of the series-connected pMOS-FETs 201, 202.

[0023] The third nMOS-FET 210 has its drain connected to the high supply potential 205 and its source connected to the connection node of the series-connected nMOS-FETs 203, 204.

[0024] The series-connected pMOS-FETs 201, 202 and the series-connected nMOS-FETs 203, 204 have (except for process variations) the same small widths w (e.g., minimal according to the chip manufacturing technology used), so that their properties (across multiple such Schmitt triggers) vary greatly with process variations. The third pMOS-FET 209 and the fourth nMOS-FET 210, on the other hand, have large widths W, so that their properties (across multiple such Schmitt triggers) vary only slightly. Overall, the delay (from a logic level change of the input signal A to a logic level change of the output signal Z) caused by the Schmitt trigger 200 depends on process variations.

[0025] Delay elements with different delays are then combined into pairs (or sets of more than two delay elements). Each pair forms a delay stage, and several (two or more) such delay stages are connected in series to generate the POC value (by appropriately configured multiplexers or, more generally, "delay element connecting circuits") in such a way that the differences in the delays within the delay stages constructively overlap, i.e., so that two paths are formed through the delay stages, with the first path per delay stage containing the delay element with the respective lower delay, and the second path per delay stage containing the delay element with the respective higher delay.

[0026] Fig. 3 shows a POC circuit element 300 (e.g. part of the POC source 105) with a series connection, by means of a multiplexer 307, of two delay stages 301, 302, each having two delay elements 303-306.

[0027] The individual delays τ 11 , τ 12 , τ 21 , τ 22 are not known after the manufacture of the chip containing the POC circuit element 300 due to the unavoidable process variations, but it can be determined for each delay stage which delay element has the lower delay, ie the signs of the delay differences Δτ1 = τ 11 -τ 12 and Δτ1 = τ 11 -τ 12 can be determined (as described below).

[0028] The multiplexer 307 can then be configured (i.e., controlled) accordingly, i.e., a control bit value for the multiplexer 307 can be determined such that it connects the two faster delay elements together and connects the two slower delay elements together. This control bit value is the control bit value for the multiplexer for this POC circuit element 300 to generate the (ideally true, but in practice subject to errors) POC value P' and, together with the control bit values ​​for other such POC circuit elements, forms the password, which can then be used in use to set the multiplexers to generate the POC value. The POC circuit element 300 and others of its type are thus used both for registering the password ("enrollment") and later for POC value generation.

[0029] In order to be able to determine which delay element of a delay stage has the shorter delay, according to one embodiment, each delay element is provided with a bypass element whose delay varies little with process fluctuations (across the delay elements) and can thus be used to "deactivate" (i.e., make irrelevant) delay differences between individual delay stages, so that the sign of the delay difference (i.e., which delay element has the longer delay) of another delay stage can be read out. Thus, instead of the delay elements themselves, delay circuits are used, each of which has a bypass in addition to the delay element.

[0030] Fig. 4 shows a delay circuit 400 in which, in addition to a delay element 401 (e.g. as described with reference to Fig. 1) in parallel thereto a bypass element 402 (which itself, for example, as described with reference to Fig. 1, but whose delay has a low dependence on process fluctuations).

[0031] By means of a control signal S (and the complementary control signal S), it can be set whether the input signal A is propagated through the delay element 401 or through the bypass element 402. If all delay elements in a delay stage are set such that the input signals are propagated through the bypass elements, the difference in the delay stage is then very small (due to the low process fluctuation dependence of the delay of the bypass elements).

[0032] Fig. 5 shows a POC circuit element 500 (e.g. part of the POC source 105) with a series connection of two delay stages 501, 502 by means of a multiplexer 507.

[0033] The delay stages 501, 502 each contain two delay circuits 503-506 with bypass, ie two delay elements each provided with a bypass.

[0034] During the registration phase, a control circuit 508 sets one of the delay stages to bypass mode, i.e., such that its input signal (e.g., a signal edge supplied by the control circuit 508 in the case of the first delay stage 501 or by the multiplexer 507 in the case of the second delay stage 502) is propagated through the bypass by both delay circuits. The multiplexer 507 is set to a default setting. Then, by detecting which delay circuit 505, 506 of the second delay stage 502 first supplies the input signal (i.e., the signal edge), it can be determined which delay element of the delay stage that has not been switched to bypass mode has the shorter delay.This is done sequentially (successively) for both delay stages (or for POC circuit elements 500 with more than two stages, all but one delay stage are switched to bypass mode to determine which delay element of that delay stage has the lower delay).

[0035] The detection of which delay circuit 505, 506 of the second delay stage 502 first supplies the input signal (ie the signal edge) can be carried out, for example, by means of an RS flip-flop 509.

[0036] Fig. Figure 6 shows an RS flip-flop 600 based on two NOR gates 601, 602. If the RS flip-flop 509 is implemented in this way, both paths are precharged to the high logic level (by the control circuit 508) and a falling edge is sent as the input signal. If the above input (S1) switches first, the output of the RS flip-flop is Y. <1> =1, Y <0> =0, otherwise Y <1> =0, Y <0> =1. In other implementations (e.g., an implementation based on NAND gates), the situation may be reversed.

[0037] In the case of two delay stages as in the example of Fig. 5, the results of the two determinations (i.e., measurements) of which delay element is faster can be XOR-combined to determine the control bit value for the POC circuit element 500: If the same delay element is the faster one both times (i.e. both Δτ1 and Δτ2 are negative or both Δτ1 and Δτ2 are positive), the control bit value corresponds to the setting of the multiplexer 507 that it switches the paths "straight" (e.g. control bit value 0) and otherwise (Δτ1 and Δτ2 have different signs) the setting of the multiplexer 507 that it switches the paths "crosswise" (e.g. control bit value 1).

[0038] The control bit value can therefore be determined simply by XORing the two values ​​of Y <1> for both measurements. With more than two delay stages, this can be done in a similar way (by treating consecutive delay stages accordingly).

[0039] In this way, the control bit values ​​and thus the password can be determined for all POC circuit elements 500 of the POC source 105. This can then be stored in the respective chip (e.g., in memory 103) or externally. It should be noted that knowledge of the password in itself does not provide any information about the POC value. An attacker who can trigger POC value generation but does not know the password (i.e., uses a random password) is then able to correctly generate, on average, approximately three out of four bits of the POC value. Compared to POC value generation without the described password mechanism, this significantly increases security, because in this case, all bits of the POC value would be correctly generated.

[0040] After the registration described above, the POC value can be retrieved by adjusting the multiplexers of the POC circuit elements according to the control bits of the password stored on-chip or externally. With two stages, the total delay difference between the two paths of the POC circuit element is Δτ = + / - {| Δτ1| + | Δτ2|} = Δτ1 + / - Δτ2, where the delays are constructively additive because the control bits were chosen accordingly. This results in high robustness against voltage fluctuations and temperature fluctuations and reduced error correction effort (e.g., less auxiliary data and also less overhead for auxiliary data generation).Due to the high robustness, as described above, a POC value with a high number of errors can also be regarded as unauthorized POC value generation (with an incorrect password), and a verification circuit configured to detect this can trigger an alarm or deactivate functionalities of the respective chip in such a case.

[0041] In addition to the use of Schmitt triggers as delay elements and corresponding pairs of Schmitt triggers for delay stages, other delay elements or delay stages can also be used, e.g.: • Delay stages consisting of two sense amplifiers or several sense amplifiers connected in series • Tie cells, i.e., circuits each comprising at least one p-channel FET and at least one n-channel FET, which maintain each other in a steady state by turning each other on, and which are precharged to an inverse state. The inverse state is the opposite of the steady state in the sense that the FETs are off. The one of two TIE cells that reaches its steady state first from the precharge state (triggered by a corresponding level change) is the delay element with the shorter delay. • Differential feedback transfer gates, as described below with reference to Fig. 7 and Fig. 8 described • Other delay elements that have sufficient sensitivity to process variations and that can be connected in pairs (even more than two) to form a delay stage with two (or more) paths with different delay.

[0042] Fig. 7 shows a transfer gate 700, also referred to as a differential feedback transfer gate (DFTG).

[0043] The transmission gate 700 has a first input node 701 designated X1, a second input node 702 designated X0, a first output node 703 designated Y1, and a second output node 704 designated Y0.

[0044] A first p-channel field-effect transistor 705 (denoted as TP1) is connected between the first input node 701 and the first output node 703. In parallel, a first n-channel field-effect transistor 706 (denoted as TN1) is connected between the first input node 701 and the first output node 703.

[0045] A second n-channel field-effect transistor 707 (denoted as TN0) is connected between the second input node 702 and the second output node 704. In parallel, a second p-channel field-effect transistor 708 (denoted as TP0) is connected between the second input node 702 and the second output node 704.

[0046] The first output node 703 is fed back to the gates of the second n-channel field-effect transistor 707 and the second p-channel field-effect transistor 708.

[0047] The second output node 704 is fed back to the gates of the first p-channel field-effect transistor 705 and the first n-channel field-effect transistor 706.

[0048] In the following it is assumed that the logical value 0 corresponds to the lower supply potential VSS and that the logical value 1 corresponds to the upper supply potential VDD.

[0049] It is also assumed that the node pairs (X1,X0) and (Y1,Y0) can each assume the two complementary equilibrium states (1,0) and (0,1), and that switching back and forth between these two states takes place (by suitable external control via (X1,X0) (or (Y1,Y0)), whereby in the mode of operation described below (X1,X0) forms the input node pair and (Y1,Y0) the output node pair.

[0050] As from Fig. 7, the transmission gate 700 is constructed symmetrically with regard to the exchange of the nodes X1 and X0 (as well as Y1 and Y0), so that without loss of generality it is sufficient to consider the transition of (X1,X0) from (1,0) to (0,1) and the resulting temporal behavior of (Y1,Y0) during the transition from (1,0) to (0,1).

[0051] Fig. Figure 8 shows the temporal behavior when switching the input node pair (X1, X0) from (1,0) to (0,1).

[0052] A first diagram 801 shows the level curve of X1 in a first curve and the level curve of Y1 in a second (dashed) curve 804.

[0053] A second diagram 802 shows the level curve of X0 in a third curve 805 and the level curve of Y0 in a fourth (dashed) curve 806.

[0054] In diagrams 801, 802, time increases from left to right and the level (ie the respective node potential) increases from bottom to top, moving between VSS and VDD according to the assumed logic levels.

[0055] As in Fig. As shown in Figure 8, the transition from (Y1,Y0) from (1,0) to (0,1) does not occur like that from (X1,X0), i.e. not with switching times t r or t f . The input signals for the input nodes 701, 702 are provided, for example, by means of standard CMOS gates.

[0056] After a short initial phase, during which the first p-channel transistor 705 and the second n-channel transistor 707 are still in strong inversion (SI for strong inversion), and after which the potential of Y1 has dropped by ΔV1 and that of Y0 has risen by ΔV0, all four transistors 705, 706, 707, 708 are in weak inversion (WI for weak inversion) and thus operate below their respective threshold voltages (the threshold voltages are designated as Vth(P1), Vth(N1), Vth(P0), Vth(N0) according to the designations of the transistors).

[0057] The resulting comparatively low channel currents in turn mean that the electrical (load) capacitances C Y(for example, having the respective gate capacitances of the transistors and capacitances of nodes connected to the transmission gate 700 on the output side) can only be recharged very slowly, so that a significantly longer time interval Δt WI elapses until the potentials at Y1 and Y0 have reached values ​​that enable the transition from weak inversion to strong inversion of the first n-channel transistor 706 and the second p-channel transistor 708: Y0 has then risen to approximately Vth(N1) and Y1 has fallen to approximately VDD-|Vth(P0)|.

[0058] It follows that from the mutual negative feedback of Y1 to the gate terminals of the second p-channel transistor 708 and the second n-channel transistor 707 respectively and from Y0 to the gate terminals of the first p-channel transistor 705 and the first n-channel transistor 706 (whereby via the gate capacitances of the transistors 705, 706, 707, 708 there is also a capacitive coupling between Y1 and Y0, which in Fig. 7 by the overshoot of Y1 during t f is indicated) initially results in a mutual hindrance of the charge transport, but that the same negative feedback also means mutual support for the Δ t WIpermanent non-equilibrium state (i.e. the phase of weak inversion, during which none of the transistors 705, 706, 707, 708 is in strong inversion) in the direction of the new equilibrium state (in which (Y1,Y0) assumes the state (0,1)) until one of the threshold voltages of the first n-channel transistor 706 or the second p-channel transistor 708 is reached, whereupon the other threshold voltage is also exceeded very quickly and in the immediate sequence (Y1,Y0) is set to (0,1).

[0059] The DFTG switching operations from (1,0) to (0,1) and from (0,1) to (1,0) are therefore almost exclusively dependent on the weak inversion behavior of the transistors 705, 706, 707, 708 (whereby after reaching ΔV1 or ΔV0, the first p-channel transistor 705 and the second n-channel transistor 707 very quickly contribute only little to the recharging of the output nodes 703, 704 due to their then reverse-biased source diodes and drain bulk diodes).

[0060] In the following it is assumed that the transistors 705, 706, 707, 708 are MOSFETs (Metal Oxide Semiconductor Field Effect Transistors).

[0061] For the channel current of an nMOS transistor (ie n-channel MOSFET) in the weak inversion region, IDS=2μ⋅CoxWL(kTe)2eeVGS−VthkT{eeVGS−VthkT−ee−VDBkT}, with the mobility µ, the specific gate capacitance C ox, the width W and the length L of the gate, the Boltzmann constant k, the temperature T, the elementary charge e, the threshold voltage V th , as well as the voltages V GS , V SB and V DB between gate and source, source and bulk (substrate) or drain and bulk.

[0062] There are therefore exponential dependencies of the channel current on T and V th as well as the terminal voltages V GS , V SB and V DB , in contrast to the linear or quadratic dependencies in the area of ​​strong inversion.

[0063] In summary, according to various embodiments, a method is provided as described in Fig. 9 is shown.

[0064] Fig. 9 shows a flowchart 900 illustrating a method for providing configuration information for generating physically obfuscated information (e.g., configuration information, secrets, or POC values) on a chip.

[0065] The chip comprises a set of (physical obfuscated value generation sub-)circuits (also referred to above as POC circuit elements), each with a plurality of delay stages, where each delay stage comprises at least two delay elements.

[0066] In 901, for each of the circuits and for each delay stage (of the respective circuit), it is determined which of the delay elements of the delay stage has the shortest delay among the delay elements of the delay stage. With two delay elements per delay stage, this is equivalent to determining which of the delay elements of the delay stage has the longer delay. With more than two delay elements per delay stage, the order of the delays can also be determined, although this would require increased circuit complexity, since a pairwise comparison of the delays would then have to be performed.

[0067] In 902, configuration information is determined as a function of the determined delay elements, which configuration information specifies a circuit configuration for each of the circuits, in which the delay elements of different (i.e. not the same) delay stages are connected in series in such a way that (e.g. by means of the determined delay elements) at least one path is formed from an input of the circuit to an output of the circuit (e.g. so that the delay elements form a path which, in each delay stage, leads through the delay element with the lowest delay among the delay elements of the delay stage; with two delay elements per stage, this is equivalent to the circuit being configured in such a way that the delay elements with the higher delay also form a path).

[0068] The determined configuration information is stored in 903.

[0069] In other words, according to various embodiments, chains of delay elements are formed so that the POC value generation is as robust as possible, in particular by determining configuration information, for example, such that the delays of the delay elements constructively overlap (highest delays with the highest delays and lowest delays with the lowest delays).

[0070] Fig. 10 shows a chip 1000 according to one embodiment.

[0071] The chip 1000 comprises a set of (physical obfuscated value generation sub-)circuits 1001 (also referred to above as POC circuit elements) each having a plurality of delay stages 1002, wherein each delay stage 1002 has at least two delay elements 1003.

[0072] Each of the circuits 1001 has, for each delay element 1004, a bypass 1004 of the delay element 1003 (by means of which the delay element can be bypassed when propagating a signal from an input of the delay stage to an output of the delay stage).

[0073] Each of the circuits 1001 has at least one connecting circuit 1005 arranged and configured to connect the delay stages 1002 to a chain of delay stages 1002 forming a plurality of paths through the circuit 1001.

[0074] The chip 1000 also has a detection circuit 1006 for each of the circuits 1001, which is configured to detect which of the multiple paths of the circuit 1001 propagates a signal faster.

[0075] The chip 1001 also includes a physically obfuscated value generation circuit 1007 configured to generate physically obfuscated information depending on which paths propagate the signals faster (i.e., to generate the physically obfuscated information using the outputs of the detection circuits 1006).

[0076] Various examples of implementation are given below.

[0077] Embodiment 1 is a method as described with reference to Fig. 9 described.

[0078] Embodiment 2 is a method according to embodiment 1, wherein in the configuration of the circuit specified by the configuration information, the delay elements are connected in series such that faster and slower delay elements of the different delay stages are connected in series.

[0079] Embodiment 3 is a method according to embodiment 1 or 2, wherein in the configuration of the circuit specified by the configuration information, the delay elements are connected in series such that a path from the input of the circuit to the output of the circuit is formed by means of the determined delay elements.

[0080] Embodiment 4 is a method according to embodiment 1, wherein each circuit has at least one connection circuit, wherein the configuration information indicates a configuration for the at least one connection circuit.

[0081] Embodiment 5 is a method according to embodiment 4, wherein the at least one connecting circuit is arranged and configured to connect the delay stages of the circuit to form a chain of delay stages.

[0082] Embodiment 6 is a method according to embodiment 4 or 5, wherein the at least one connecting circuit is configurable by means of at least one control signal according to a plurality of configurations which differ in that the at least one connecting circuit connects the delay stages in series in different ways as to which delay elements of the different delay stages follow one another.

[0083] Embodiment 7 is a method according to embodiment 6, wherein according to each configuration, a plurality of paths are formed through the delay stages, each having one delay element per delay stage, and the configurations differ in which delay elements the paths have.

[0084] Embodiment 8 is a method according to one of embodiments 4 to 7, wherein the configuration information indicates a configuration of the at least one connecting circuit, in which the at least one connecting circuit connects the delay elements such that a path from an input of the circuit to an output of the circuit is formed by means of the determined delay elements.

[0085] Embodiment 9 is a method according to any one of embodiments 1 to 8, wherein each delay element has a bypass of the delay element and determining the delay elements with the lowest delay comprises cascading the delay stages to form a plurality of paths and bypassing the delay elements of all delay stages of the circuit except for one delay stage whose delay element with the lowest delay is to be determined and detecting through which path an input signal was propagated most quickly.

[0086] Embodiment 10 is a method according to embodiment 9, wherein, for each delay element, the delay of the bypass has a lower dependence on supply voltage and / or temperature than the delay element.

[0087] Embodiment 11 is a method according to embodiment 9 or 10, wherein, for each delay element, the bypass has a lower delay than the delay element.

[0088] Embodiment 12 is a method according to any one of embodiments 1 to 11, wherein the chip is provided with a physically obfuscated value generation circuit by means of which physically obfuscated information is generated depending on outputs of the circuits.

[0089] Embodiment 13 is a method according to embodiment 12, wherein the physically obfuscated value generation circuit is configured to generate the physically obfuscated information depending on which paths of a plurality of paths of the circuits propagate the signals faster.

[0090] Embodiment 14 is a method according to any one of embodiments 1 to 13, comprising storing the configuration information in a non-volatile memory of the chip.

[0091] Embodiment 15 is a method according to any one of embodiments 1 to 14, comprising storing the configuration information off-chip.

[0092] Embodiment 16 is a method according to embodiment 15, comprising deleting the configuration information from the chip.

[0093] Embodiment 17 is a method for generating physically obfuscated information on a chip, comprising providing configuration information according to any one of embodiments 1 to 16, configuring each circuit according to the configuration information, propagating signals through each circuit, and generating physically obfuscated information depending on which paths of a plurality of paths of the circuits propagate the signals faster.

[0094] Embodiment 18 is a method according to embodiment 17 comprising generating, for each of the circuits, a bit of the physically obfuscated information depending on which path of a plurality of paths of the circuit propagates the signal faster.

[0095] Embodiment 19 is a chip as described with reference to Fig. 10 described.

[0096] Embodiment 20 is a chip according to embodiment 19, further comprising, for each of the circuits, a control circuit configured to drive the circuit such that the delay elements of all delay stages of the circuit except one delay stage are bypassed, and to detect through which path an input signal was propagated most quickly.

[0097] Although the invention has been particularly shown and described with reference to specific embodiments, it should be understood by those skilled in the art that numerous changes in design and detail may be made therein without departing from the spirit and scope of the invention as defined by the following claims. The scope of the invention is therefore determined by the appended claims, and it is intended to embrace all changes that come within the letter or range of equivalence of the claims. Reference symbol 100 chip cards 101 carriers 102 chip card module 103 non-volatile memory 104 CPU 105 POC source 106 POC module 200 Schmitt triggers 201,202 pMOS FETs 203,204 nMOS FETs 205 high supply potential 206 low supply potential 207 Entrance 208 connection nodes 209 pMOS-FET 210 nMOS FET 300 POC circuit element 301, 302 delay stages 303-306 Delay elements 307 Multiplexers 400 delay circuit 401 Delay element 402 Bypass element 500 POC circuit element 501, 502 delay stages 503-506 Delay circuits 507 Multiplexers 508 control circuit 509 RS flip-flop 600 RS flip-flop 601,602 NOR gates 700 DFTG 701, 702 input nodes 703, 704 Exit node 705 p-channel FET 706, 707 n-channel FET 708 p-channel FET 801, 802 diagrams 900 Flowchart 901-903 Process steps 1000 chips 1001 circuits 1002 delay stages 1003 delay elements 1004 bypasses 1005 connection circuits 1006 detection circuits 1007 Physically obfuscated value generation circuit

Claims

[1] A method for providing configuration information for generating physically obfuscated information on a chip (102, 1000) having a set of circuits (300, 500, 1001) each having a plurality of delay stages (301, 302, 501, 502, 1002), each delay stage (301, 302, 501, 502, 1002) having at least two delay elements (303-306, 1003), the method comprising: Determining, for each of the circuits (300, 500, 1001), for each delay stage (301, 302, 501, 502, 1002), which of the delay elements (303-306, 1003) of the delay stage (301, 302, 501, 502, 1002) has the lowest delay among the delay elements (303-306, 1003) of the delay stage (301, 302, 501, 502, 1002), wherein each delay element (303-306, 1003) has a bypass of the delay element (303-306, 1003) and determining the delay elements (303-306, 1003) with the lowest delay, the delay stages (301, 302, 501, 502, 1002) to connect several paths in series and to bypass and detect the delay elements (303-306, 1003) of all delay stages (301, 302, 501, 502, 1002) of the circuit (300, 500, 1001) except for one delay stage (301, 302, 501, 502, 1002), whose delay element (303-306, 1003) is to be determined with the smallest delay,through which path an input signal was propagated fastest;, Determining, as a function of the determined delay elements (303-306, 1003), configuration information which specifies a configuration of the circuit (300, 500, 1001) for each of the circuits (300, 500, 1001), in which the delay elements (303-306, 1003) of different delay stages (301, 302, 501, 502, 1002) are connected in series such that at least one path is formed from an input of the circuit (300, 500, 1001) to an output of the circuit (300, 500, 1001); and storing the determined configuration information. [2] Method according to claim 1, wherein in the configuration of the circuit (300, 500, 1001) specified by the configuration information, the delay elements (303-306, 1003) are connected in series such that respectively faster and respectively slower delay elements (303-306, 1003) of the different delay stages (301, 302, 501, 502, 1002) are connected in series. [3] Method according to claim 1 or 2, wherein in the configuration of the circuit (300, 500, 1001) specified by the configuration information, the delay elements (303-306, 1003) are connected in series such that a path from the input of the circuit (300, 500, 1001) to the output of the circuit (300, 500, 1001) is formed by means of the determined delay elements (303-306, 1003). [4] The method of claim 1, wherein each circuit (300, 500, 1001) comprises at least one interconnection circuit, wherein the configuration information indicates a configuration for the at least one interconnection circuit. [5] Method according to claim 4, wherein the at least one connecting circuit is arranged and configured to connect the delay stages (301, 302, 501, 502, 1002) of the circuit (300, 500, 1001) to form a chain of delay stages (301, 302, 501, 502, 1002). [6] Method according to claim 4 or 5, wherein the at least one connecting circuit is configurable by means of at least one control signal according to a plurality of configurations which differ in that the at least one connecting circuit connects the delay stages (301, 302, 501, 502, 1002) in series in different ways as to which delay elements (303-306, 1003) of the different delay stages (301, 302, 501, 502, 1002) follow one another. [7] Method according to claim 6, wherein according to each configuration, a plurality of paths are formed through the delay stages (301, 302, 501, 502, 1002), each having a delay element (303-306, 1003) per delay stage (301, 302, 501, 502, 1002), and the configurations differ in which delay elements (303-306, 1003) the paths have. [8] Method according to one of claims 4 to 7, wherein the configuration information indicates a configuration of the at least one connecting circuit, in which the at least one connecting circuit connects the delay elements (303-306, 1003) in such a way that a path from an input of the circuit (300, 500, 1001) to an output of the circuit (300, 500, 1001) is formed by means of the determined delay elements (303-306, 1003). [9] The method of claim 8, wherein, for each delay element (303-306, 1003), the delay of the bypass has a lower dependence on supply voltage and / or temperature than the delay element (303-306, 1003). [10] The method of claim 8 or 9, wherein, for each delay element (303-306, 1003), the bypass has a lower delay than the delay element (303-306, 1003). [11] Method according to one of claims 1 to 10, wherein the chip (102, 1000) is provided with a physically obfuscated value generation circuit by means of which physically obfuscated information is generated depending on outputs of the circuits (300, 500, 1001). [12] The method of claim 11, wherein the physically obfuscated value generating circuit is configured to generate the physically obfuscated information depending on which of a plurality of paths of the circuits (300, 500, 1001) propagate the signals faster. [13] Method according to one of claims 1 to 12, comprising storing the configuration information in a non-volatile memory of the chip (102, 1000). [14] Method according to one of claims 1 to 13, comprising storing the configuration information outside the chip (102, 1000). [15] The method of claim 14, comprising deleting the configuration information from the chip (102, 1000). [16] A method for generating physically obfuscated information on a chip (102, 1000), comprising: Providing configuration information according to one of claims 1 to 15; Configuring each circuit (300, 500, 1001) according to the configuration information; Propagating signals through each circuit (300, 500, 1001); and generating physically obfuscated information depending on which of multiple paths of the circuits (300, 500, 1001) propagate the signals faster. [17] The method of claim 16 comprising generating, for each of the circuits (300, 500, 1001), a bit of the physically obfuscated information depending on which path of a plurality of paths of the circuit (300, 500, 1001) propagates the signal faster. [18] Chip (102, 1000), comprising: a set of circuits (300, 500, 1001) each having a plurality of delay stages (301, 302, 501, 502, 1002), each delay stage (301, 302, 501, 502, 1002) having at least two delay elements (303-306, 1003); wherein each of the circuits (300, 500, 1001) comprises, for each delay element (303-306, 1003), a bypass of the delay element (303-306, 1003); wherein each of the circuits (300, 500, 1001) comprises at least one connecting circuit arranged and configured to connect the delay stages (301, 302, 501, 502, 1002) to form a chain of delay stages (301, 302, 501, 502, 1002) forming a plurality of paths through the circuit (300, 500, 1001); for each of the circuits (300, 500, 1001), a detection circuit configured to detect which of the plurality of paths of the circuit (300, 500, 1001) propagates a signal faster; a physically obfuscated value generation circuit configured to generate physically obfuscated information depending on which paths propagate the signals faster, and further comprising, for each of the circuits (300, 500, 1001), a control circuit configured to control the circuit (300, 500, 1001) such that the delay elements (303-306, 1003) of all delay stages (301, 302, 501, 502, 1002) of the circuit (300, 500, 1001) except for one delay stage (301, 302, 501, 502, 1002) are bypassed, and to detect through which path an input signal was propagated the fastest.

Images