METHOD FOR DETECTING AN INDUCTION TO THE INTEGRITY OF A SEMICONDUCTOR SUBSTRATE OF AN INTEGRATED CIRCUIT FROM ITS BACK SIDE, AND CORRESPONDING DEVICE

Description

[0001] Embodiments and implementations of the invention relate to integrated circuits, and more particularly to the detection of a possible attack on the integrity of the substrate of an integrated circuit.

[0002] Integrated circuits, especially those equipped with memories containing sensitive information, must be protected as much as possible against attacks, including attacks aimed at discovering stored data.

[0003] Among the possible attacks to extract confidential data from a memory of an integrated circuit, for example a protected memory of a smart card, we can mention so-called fault injection attacks (DFA, or "Differential Fault Analysis") which plan to disrupt the operation and / or the content of the memory, or to modify the logical operation of the circuit, for example by means of radiation (laser, infrared, X-rays, etc.) emitted through the back side of the chip.

[0004] These attacks can, for example, be carried out using a focused ion beam (FIB, "Focus Ion Beam" according to the usual Anglo-Saxon acronym), which uses a focused ion beam to machine or deposit materials at the nanoscale.

[0005] The effectiveness of these attacks increases when the substrate of the integrated circuit is thinned by the attacker, from its rear side so as to get as close as possible to the components of the integrated circuit, made at the level of its front side.

[0006] A preliminary step in such thinning may include, for example, mechanical or mechano-chemical polishing from the back face.

[0007] It is therefore particularly useful to seek to protect the integrated circuit against an attack from the back side of the substrate.

[0008] There is a need to be able to detect an attack on the integrity of the substrate from its rear side, allowing integrated circuits to be protected against this type of attack.

[0009] Publications WO2009 / 016589A2, US2016 / 042199A1 and FR2998419A1 describe techniques for protecting integrated circuits against attacks from the back side.

[0010] Publication WO2009 / 016589A2 describes a tamper-proof semiconductor device in which a safety circuit is disposed on the first side connected to the electrically conductive links through the substrate and is arranged to measure at least two resistance values ​​of the electrically conductive protective layer across the electrically conductive links through the substrate. The safety circuit is further arranged to compare the measured resistance values ​​with reference resistance values.

[0011] Publication US2016 / 042199A1 describes a security device to protect integrated circuits against back-security attacks. When an attacker mills or cuts into the substrate, the substrate's resistance changes. By monitoring the voltage difference, the attack attempt can be detected.

[0012] Publication FR2998419A1 describes an integrated circuit comprising a device for detecting a variation in substrate resistance.

[0013] Depending on the implementation and realization methods, it is proposed to meet this need with a simple solution to implement, guaranteeing better safety, and requiring a small surface area for its realization on the semiconductor substrate.

[0014] The invention is defined by the independent claims.

[0015] Methods of implementing and realizing the invention are defined by the dependent claims.

[0016] By "contact point" we mean substrate contact points classically present in integrated circuit designs and for example dedicated to substrate biasing.

[0017] These contacts can be made by implanting overdope regions, distributed on the front face of the substrate.

[0018] The resistive measurement of the substrate performed on n contact points corresponds to a measurement of the equivalent resistive value of n resistors (each resulting from the resistivity of the substrate) connected in parallel. A nominal resistive value according to this measurement thus decreases as 1 / n.

[0019] By "nominal resistive value" we mean the resistive value reasonably expected when measured on a structure whose integrity has not been compromised.

[0020] By "alarm signal" we mean, for example, a signal that triggers conventional means of countermeasures designed to thwart such an attack, or even to stop the operation of the integrated circuit.

[0021] Other advantages and features of the invention will become apparent upon examination of the detailed description of methods of implementation and embodiment of the invention, which are by no means limiting, and the accompanying drawings in which: there figure 1 represents a cross-sectional view of an integrated circuit equipping a smart card; the figures 2 à 8 schematically illustrate different modes of implementation and realization of the invention.

[0022] There figure 1 represents an example of an integrated circuit (IC) equipping a smart card (CP).

[0023] A typical CP smart card is schematically illustrated at the top of the figure 1 The integrated circuit (IC) is assembled in the CB card body of the CP smart card, under MC contacts. A cross-section of this assembly is shown at the bottom of the figure 1 .

[0024] The integrated circuit IC classically comprises a semiconductor substrate surmounted by an interconnection part (BEOL: Back End Of Lines).

[0025] The integrated circuit IC is covered with an electrically conductive plate PC2. This plate is glued to the rear face FR of said substrate by an adhesive conductive layer CA and attaches it to one face of a resin base RES.

[0026] The RES resin base supports on its opposite face MC contacts dedicated to ensuring the connections of the integrated circuit IC with a terminal such as a card reader.

[0027] The integrated circuit IC is encapsulated in an insulating encapsulation layer Encap.

[0028] The Encap insulating encapsulation layer is itself encapsulated in a CB card body.

[0029] The connections between the MC contacts and the integrated circuit IC are made using BW wires, in a typical flip chip configuration ("Flip chip" according to the usual Anglo-Saxon term), the BW wires being soldered on one side to said MC contacts, and on the other side to contact pads formed on the last level of metallization of the interconnecting part.

[0030] The assembly formed by the electrically conductive plate PC2, the adhesive conductive layer CA and the resin RES, forms an encapsulation of the integrated circuit IC.

[0031] This does not exclude the possibility of using other coatings known in the field of integrated circuits, for example adapted to an application other than a smart card.

[0032] There figure 2 represents an example of an embodiment of the integrated circuit IC.

[0033] The integrated circuit IC comprises a semiconductor substrate having a front face FV, a rear face FR and PCi contact sockets, with i ∈ {10; 11; 12; 13}, distributed at the front face FV.

[0034] Typically, the semiconductor substrate includes electrically isolated CS semiconductor boxes from the rest of the substrate, for example by a classic and well-known triple well structure.

[0035] In this example, the integrated circuit includes a DIS detection block connected to the electrically conductive plate PC2 and the PCi contact points. The DIS detection block measures the resistive value of the substrate between r PCi contact points, r being defined according to the type of measurement to be performed, and the electrically conductive plate PC2.

[0036] In the following, particularly in relation to the figures 3 et 4 , the number r will take a value n during a first measurement, and will take another value m during a second measurement.

[0037] The DIS detection block also allows a third measurement of the resistive value of the substrate to be performed between only PCi contact sockets.

[0038] For example, the DIS detection unit includes a MES measurement circuit configured to measure the substrate's resistive values. This conventionally structured measurement circuit can output a physical quantity representing the substrate's resistive value; for example, a voltage if a known current is passed through the substrate between the contact points and the plate, or a current if a known voltage is applied between the contact points and the plate.

[0039] The DIS detection block also includes two comparison circuits 10, 11 allowing the measured resistive value of the substrate to be compared to a nominal resistive value of the substrate.

[0040] Here and throughout, "nominal resistance value" refers to the resistance value reasonably expected when measured on a structure whose integrity has not been compromised. Different nominal resistance values ​​will be associated with different measurements.

[0041] Comparison circuits 10 and 11 are described below, in relation to the figures 6, 7 And 8 .

[0042] There figure 3 represents the integrated circuit IC after having undergone an opening of the casing opposite the rear face FR.

[0043] More specifically, the electrically conductive plate PC2 described previously in relation to the figures 1 et 2 was removed, thus revealing the FR rear face of the substrate.

[0044] In this state, the DIS detection block will perform the first measurement of the resistive value R1 between n contact points corresponding to a measurement of the equivalent resistive value of n resistors connected in parallel, and a terminal normally connected to the electrically conductive plate PC2.

[0045] Removing the electrically conductive plate PC2 leads to a sharp increase in substrate resistance.

[0046] The number n is advantageously chosen so that the nominal resistance value corresponding to the first measurement is low enough to easily detect an increase in the measured resistance value. In this example, removing the electrically conductive plate PC2 leads to a very high measured resistance value.

[0047] The resistive value R1 of the substrate from the first measurement is then sent to the comparison circuit 10, which is configured to compare this resistive value R1 with a first nominal resistive value of the substrate REFH. If the resistive value R1 of the substrate from the first measurement is greater than the first nominal resistive value REFH, the detection block has detected a withdrawal of at least part of the electrically conductive plate PC2.

[0048] There figure 4 represents the integrated circuit IC after substrate thinning and replacement of the electrically conductive plate PC2.

[0049] For example, to extract confidential data from an integrated circuit's memory, an attacker needs to thin the substrate to get as close as possible to the integrated circuit components, which are made at its front face.

[0050] Such thinning may include, for example, mechano-chemical polishing from the back face, and / or machining, for example, via a focused ion probe FIB.

[0051] After thinning, the attacker can place an electrically conductive plate PC2 on the rear face FR.

[0052] The thinning of the semiconductor substrate leads to a decrease in the resistive value of the substrate between the contact points PCi and the electrically conductive plate PC2.

[0053] To detect thinning, a second measurement of the resistive value R2 of the substrate is performed between m contact points corresponding to a measurement of the equivalent resistive value of m resistors connected in parallel, and the electrically conductive plate PC2. A nominal resistive value according to this measurement thus decreases by 1 / m.

[0054] The second measurement is similar to the first measurement, except that the number m is advantageously chosen so that the corresponding nominal resistive value is large enough to easily detect a decrease in the measured resistive value.

[0055] The geometric distribution of the m contact points on the front face of the substrate is advantageously chosen to perform such a measurement. For example, the measurement can be performed globally across the substrate, or sequentially in local regions of the substrate.

[0056] The resistive value R2 of the substrate from the second measurement is sent to a comparison circuit 11 configured to compare the resistive value R2 of the substrate from the second measurement with a second nominal resistive value of the substrate REFB. If the resistive value R2 of the substrate from the second measurement is lower than said second nominal resistive value REFB, a thinning of the substrate is detected by the detection block.

[0057] There figure 5 schematically illustrates the integrated circuit IC after several thinning operations a1 and a2 leading respectively to substrate thicknesses d1 and d2.

[0058] If we thin the substrate to get as close as possible to a region of interest of the circuits formed in the CS boxes, it is likely that the thinning operation will reach, at least on part of the substrate, an isolation region such as the bottom of a CS box or even a lateral isolation region of the type shallow trench isolation (STI) or local oxide (LOCOS for "LOCal Oxidation of Silicon" according to the usual Anglo-Saxon term).

[0059] In this case, two contacts may be electrically isolated from each other, or connected by a resistive path through the rest of the substrate that is longer than in an unaltered configuration. Consequently, the resistive value R3 of the substrate, obtained from the third measurement between contacts PCi, increases significantly. This is technically equivalent to an open circuit.

[0060] It may be necessary to make an electrical connection, called a short circuit, between two PCi contact sockets, by depositing, for example, an electrically conductive material between the two contact sockets.

[0061] The resistive value R3 from the third measurement is sent to the comparison circuits 10 and 11 in both cases of damage to the substrate integrity, i.e., the creation of an open circuit or a short circuit.

[0062] If the resistive value R3 of the substrate from the third measurement is greater than a corresponding nominal resistive value of said substrate REFH2, the comparison circuit 10 generates an alarm signal.

[0063] If the resistive value R3 of the substrate from the third measurement is less than another corresponding nominal resistive value of said substrate REFB2, the comparison circuit 11 generates an alarm signal.

[0064] There figure 6 schematically illustrates the first comparison circuit 10 to implement the first detection of damage to the substrate integrity in relation to the first measurement, described previously in relation to the figure 3 .

[0065] After the first measurement is taken, the measured resistive value R1 is sent to a non-inverting input of a comparator COM 1.

[0066] An inverting input takes as input a first nominal resistive value REFH of the substrate.

[0067] The comparator COM1 compares the two values ​​received at the input on its two terminals and generates an ALR alarm signal if the resistive value R1 from the first measurement is greater than the first nominal resistive value REFH of the substrate.

[0068] Thus, if a removal of the electrically conductive plate is detected, the ALR alarm signal will be generated.

[0069] The ALR alarm signal, for example, allows the triggering of conventional means of countermeasures intended to counter the attack carried out on the substrate.

[0070] There figure 7 schematically illustrates the second comparison circuit 11 to implement the second detection of damage to the substrate integrity in relation to the second measurement, described previously in relation to the figure 4 .

[0071] The measured resistive value R2 from the second measurement is sent to an inverting input of a comparator COM2.

[0072] A non-inverting input takes as input a second nominal resistive value REFB of the substrate.

[0073] The comparator COM2 compares the two values ​​received at the input on its two terminals and generates an ALR alarm signal if the resistive value R2 from the second measurement is less than the nominal resistive value REFB of the substrate.

[0074] Thus, if a thinning of the substrate is detected, the ALR alarm signal will be generated.

[0075] Similarly, the ALR alarm signal allows, for example, the triggering of conventional means of countermeasures intended to counter the attack carried out on the substrate.

[0076] There figure 8 schematically illustrates the two comparison blocks 10 and 11 relative to the third measurement.

[0077] After the third measurement is taken, the measured resistive value R3 is sent to the non-inverting input of the first comparator COM1, and to the inverting input of a second comparator COM2.

[0078] The inverting input of comparator COM1 receives a third nominal resistive value REFH2 from the substrate.

[0079] The non-inverting input of the second comparator COM2 receives another third nominal resistive value REFB from the substrate.

[0080] The first comparator COM1 compares the two values ​​received at the input on its two terminals and generates an alarm signal ALR if the resistive value R3 from the third measurement is greater than the nominal resistive value REFH2 of the substrate.

[0081] Thus, if there is an open circuit, the ALR alarm signal will be generated.

[0082] The second comparator COM2 compares the two values ​​received at the input on its two terminals and generates an ALR alarm signal if the resistive value R3 from the third measurement is less than the nominal resistive value REFB2 of the substrate.

[0083] Thus, if there is a short circuit, the ALR alarm signal is generated.

[0084] Similarly, the ALR alarm signal allows, for example, the triggering of conventional means of countermeasures intended to counter the attack carried out on the substrate.

[0085] Furthermore, the invention is not limited to these embodiments but encompasses all variants thereof, for example undescribed combinations of contact points may be used to implement the first, second or third measures, as well as the use of known but undescribed means to implement said measures.

Claims

1. A method for detecting disturbance of the integrity of a semiconductor substrate (P) of an integrated circuit (IC) protected by a coating, the substrate comprising a front face (FV) and a rear face (FR), a set of contact pads (PC1) mutually electrically coupled and distributed at the front face (FV), and an electrically conductive plate (PC2) inside the coating and attached to the rear face of the substrate (FR), this disturbance being likely to be caused from the rear face (FR) of the substrate, the method comprising detecting an opening of the coating facing the rear face (FR) of the substrate and further comprising detecting thinning of the substrate from the rear face (FR), wherein detecting thinning comprises a first measurement of a resistive value (R2) of the substrate between the set of contact pads (PC1), and the electrically conductive plate (PC2), the method comprising generating an alarm signal (ALR), indicating that the electrically conductive plate (PC2) is a second conductive plate (PC2) that has been deposited onto the rear face after thinning the substrate, if said resistive value (R2) derived from the first measurement is less than a first nominal resistive value (REFB) of said substrate, said first nominal resistive value (REFB) being the resistive value of a measurement performed on the substrate that has not suffered any disturbance of its integrity.

2. The method according to claim 1, wherein detecting comprises a second measurement of a resistive value (R3) of the substrate between at least two contact pads (PC10, PC11).

3. The method according to claim 2, comprising generating an alarm signal (ALR) if said resistive value (R3) derived from the second measurement is less than a first second nominal resistive value (REFB) of the substrate or greater than a second second nominal resistive value (REFH) of the substrate.

4. An integrated circuit comprising a semiconductor substrate (P) protected by a coating, having a rear face (FR) and a front face (FV), and means for detecting disturbance of the integrity of said substrate (P) likely to be caused from its rear face, configured to detect an opening of the coating facing the rear face of the substrate, wherein the detection means comprise a detection block configured to detect thinning of the substrate from the rear face (FR), and a set of mutually electrically coupled contact pads (PC1) distributed at the front face of the substrate, and an electrically conductive plate (PC2) inside the coating and attached to the rear face (FR) of the substrate, wherein, to detect thinning of the substrate from the rear face, the detection block is configured to perform a first measurement of a resistive value (R2) of the substrate between the set of contact pads (PC1), and the electrically conductive plate (PC2) the detection block being configured to generate an alarm signal (ALR), indicating that the electrically conductive plate (PC2) is a second conductive plate (PC2) that has been deposited onto the rear face after thinning the substrate, if said resistive value (R2) derived from the first measurement is less than a first nominal resistive value (REFB) of the substrate, said first nominal resistive value (REFB) being the resistive value of a measurement performed on the substrate that has not suffered any disturbance of its integrity.

5. The integrated circuit according to claim 4, wherein, to detect thinning of the substrate from the rear face, the detection block is configured to perform a second measurement of a resistive value (R3) of the substrate between at least two contact pads (PC10, PC11).

6. The integrated circuit according to claim 5, wherein the detection block is configured to generate an alarm signal (ALR) if said resistive value (R3) derived from the second measurement is less than a first second nominal resistive value (REFB) of the substrate or greater than a second second nominal resistive value (REFH) of the substrate.

7. An electronic apparatus, such as a smart card (CP), including an integrated circuit (IC) according to one of claims 4 to 6.