METHOD FOR DETECTING THE POSSIBLE VIOLATION OF THE INTEGRITY OF A SEMICONDUCTOR SUBSTRATE OF AN INTEGRATED CIRCUIT FROM ITS BACKS, AND CORRESPONDING INTEGRATED CIRCUIT

Description

[0001] Embodiments and implementations of the invention relate to integrated circuits, and in particular to the detection of any damage to the integrity of the substrate of an integrated circuit, in particular the detection of any thinning of the substrate.

[0002] Integrated circuits, especially those equipped with memories containing sensitive information, must be protected as much as possible against attacks, including attacks aimed at discovering stored data.

[0003] Among the possible attacks to extract confidential data from a memory of an integrated circuit, for example a protected memory of a smart card, we can mention so-called fault injection attacks (DFA, or "Differential Fault Analysis") which plan to disrupt the operation and / or the content of the memory, or to modify the logical operation of the circuit, for example by means of radiation (laser, infrared, X-rays, etc.) emitted through the back side of the chip.

[0004] These attacks can, for example, be carried out using a focused ion beam (FIB, "Focus Ion Beam" according to the usual Anglo-Saxon acronym), which uses a focused ion beam to machine or deposit materials at the nanoscale.

[0005] The effectiveness of these attacks increases when the substrate of the integrated circuit is thinned by the attacker, from its rear side so as to get as close as possible to the components of the integrated circuit, made at the level of its front side.

[0006] A preliminary step in such thinning may include, for example, mechanical or mechano-chemical polishing from the back side.

[0007] It is therefore particularly useful to seek to protect the integrated circuit against an attack from the back side of the substrate.

[0008] A solution was proposed in the French patent application filed under number 1851011 and published on 09.08.2019 with the number FR3077678A1.

[0009] This solution includes, in particular, a measurement of the vertical resistance of the substrate.

[0010] While such a solution is generally satisfactory, it may prove less effective in certain cases. Indeed, the detection of substrate thinning can be disrupted by variations in temperature, supply voltage, or even variations in component characteristics from one integrated circuit to another due to variations in manufacturing processes.

[0011] This can sometimes result in a failure to detect substrate thinning, particularly for small thinnings.

[0012] In particular, there is a need to be able to detect substrate thinning from the back side in a simple and efficient way, even if this thinning is slight.

[0013] Furthermore, document FR 3 063 385 A1 concerns the detection of potential substrate thinning of an integrated circuit from its rear side. More specifically, it describes an integrated circuit comprising a semiconductor substrate having a rear and a front side and including an assembly of at least one semiconductor enclosure electrically isolated from the rest of the substrate, and a device for detecting substrate thinning from its rear side.The device comprises a group of at least one first trench extending in said at least one caisson between two places on its periphery and from said front face to a location situated at a distance from the bottom of said at least one caisson, said at least one first trench being electrically isolated from the caisson, and detection means configured to measure a physical quantity representative of the electrical resistance of the caisson between two contact zones respectively situated on either side of said group of at least one first trench.

[0014] According to the claimed invention, a method is proposed for detecting a possible breach of the integrity of an integrated circuit comprising a semiconductor substrate having a front face and a back face.

[0015] The process according to this aspect includes the detection of any thinning of the substrate from the back face.

[0016] This detection of possible thinning includes a first measurement of a resistive value of the substrate between at least one first contact point, at least one second contact point, spaced apart and located at the front face, and an electrically conductive plate located on the rear face.

[0017] This electrically conductive plate may be the plate initially fixed to the back side of the substrate during the manufacture of the integrated circuit, in the event that no damage to the integrity of the integrated circuit has occurred, in particular no thinning of the substrate.

[0018] That being said, in order to thin the substrate, an attacker will generally either completely remove the initial plate, or locally remove a part of it, so as to thin the substrate from the exposed part or even from the entire back face of the substrate.

[0019] The electrically conductive plate can then be either the initial plate with a part removed, or the initial plate removed and then reattached by the attacker after the substrate has been thinned, or another electrically conductive plate reattached by the attacker after the substrate has been thinned.

[0020] During this first measurement, we take into account both the vertical resistance of the substrate between the first contact point and the plate, and the lateral resistance of the substrate between the two contact points.

[0021] This allows for greater measurement sensitivity and makes it easier to detect slight substrate thinning, compared to measuring the vertical resistance of the substrate alone.

[0022] This measurement can then be compared to at least one threshold corresponding to a nominal resistive value, i.e. to an unthinned substrate.

[0023] By "contact point" we mean, for example, substrate contact points classically present in integrated circuit designs and, for example, dedicated to substrate biasing.

[0024] These initial contacts can be made through establishments in over-doped regions.

[0025] According to the claimed invention, said measurement of the resistive value of the substrate comprises applying a voltage difference between said at least one first contact tap and said plate, and measuring at said at least one second contact tap of a current resulting from this voltage difference.

[0026] Current measurement is a simple way to measure the resistive value of the substrate, and because of the simultaneous consideration of said vertical resistance and said lateral resistance, the current variation between an unthinned substrate and a thinned substrate, even slightly, is significant.

[0027] Here again we can compare the measured current value to at least one threshold value corresponding to a nominal current value, i.e. to an unthinned substrate.

[0028] It is also preferable that the space between said at least one first contact and said at least one second contact be at least equal to half the thickness of the substrate before possible thinning, for example of the order of this thickness.

[0029] This increases the sensitivity of the measurement (between an unthinned substrate and a thinned substrate).

[0030] In order to provide more effective protection against damage to the integrity of the integrated circuit by thinning of the substrate, it is advantageous to provide a first group of several first contact points distributed on said front face and a second group of several second contact points distributed on said front face.

[0031] The first measurement is then advantageously carried out between the first group of several first contact points, the second group of several second contact points and said electrically conductive plate.

[0032] In this respect, a first measurement between the first group, the second group, and the plate can be understood in different ways.

[0033] According to one method, one can for example electrically connect all the first contact points together, electrically connect all the second contact points together, and perform the said first measurement only once, and compare the result of the first measurement to a threshold value.

[0034] In this case, the number of first contacts may be the same as or different from the number of second contacts.

[0035] The resistive measurement of the substrate performed on several contact points corresponds to a measurement of the equivalent resistive value of several resistors connected in parallel. The nominal resistive value thus decreases as 1 / N, where N is the number of resistors in parallel.

[0036] The number N of first and second contacts is advantageously chosen so that the corresponding nominal resistive value makes it easy to detect a variation in the measured resistive value resulting from even a small thinning of the substrate.

[0037] A person skilled in the art will know how to choose the number N based in particular on the nature of the substrate and its dimensions.

[0038] As an indication, for a classic silicon substrate with a surface area of ​​1×1 mm 2< , we can take N to be on the order of 500.

[0039] In a second way, one can not electrically connect the first contact points together, not electrically connect the second contact points together, perform the first measurement sequentially considering each time a different pair of contact points (first and second), and compare each time the result of the measurement corresponding to a threshold value.

[0040] This threshold value can be identical at each step or different depending, for example, on the structure of the integrated circuit and / or the location of the different pairs.

[0041] According to a third method, intermediate between the first method and the second method, one can electrically connect the first contact points in first groups, electrically connect the second contact points in second groups, carry out the first measurement sequentially considering each time a different pair of contact point groups (first and second), and compare each time the result of the measurement corresponding to a threshold value.

[0042] The number of initial contacts may be the same or different from one initial group to another.

[0043] The number of second contacts may be the same or different from one second group to another.

[0044] And in a pair of a first and a second group, used for said measurement, the number of contacts of the first and second groups may be identical or different.

[0045] Here again the threshold value can be identical at each step or different depending for example on the structure of the integrated circuit and / or the location of the different groups.

[0046] A person skilled in the art will know how to choose between the different ways of making the first measurement depending, for example, on the resistivity of the substrate and / or the structure of the integrated circuit.

[0047] Similarly, a person skilled in the art will know how to adjust the different threshold values ​​according to, for example, the resistivity of the substrate and / or the location of the contact points considered.

[0048] According to one implementation method, it is advantageous for the detection of damage to the integrity of the integrated circuit to also include, prior to the detection of substrate thinning, a detection of a possible removal of at least part of the electrically conductive plate.

[0049] This detection of the possible withdrawal of at least part of the plate may include a prior measurement of a resistive value of the substrate between said at least one first contact point and said plate.

[0050] In other words, we do not take into account here the lateral resistance of the substrate but only the vertical resistance of the substrate between the first point of contact and the plate.

[0051] And if the plate is removed locally, for example, directly above the first point of contact, then the measured vertical resistance becomes very large.

[0052] This preliminary measurement of a resistive value of the substrate between said at least one first contact point and said plate advantageously includes an application of a voltage difference between said at least one first contact point and said plate and a measurement at said at least one first contact point of a current resulting from this voltage difference.

[0053] And if the plate is removed locally, for example, directly above the first point of contact, then the measured value of the current becomes very low.

[0054] Comparing the measured current value to at least a threshold allows for the detection of at least local withdrawal of the electrically conductive plate.

[0055] Here again, in order to provide more effective protection against damage to the integrity of the integrated circuit by at least local removal of the electrically conductive plate, it is advantageous to use the first group of several first contact points distributed on said front face.

[0056] The preliminary measurement is then advantageously carried out between the first group and said electrically conductive plate.

[0057] This preliminary measure can also be carried out globally or sequentially.

[0058] According to another aspect of the claimed invention, an integrated circuit is proposed comprising a semiconductor substrate having a front face and a rear face, at least one first contact tap, at least one second contact tap, spaced apart and located at the front face, an electrically conductive plate located on the rear face, and first detection means configured to detect any thinning of the substrate from the rear face, said first detection means comprising first measurement means configured to perform a first measurement of a resistive value of the substrate between said at least one first contact tap, said at least one second contact tap and said electrically conductive plate.

[0059] The first measuring means are configured to apply a voltage difference between said at least one first contact tap and said plate, and to perform a measurement at said at least one second contact tap of a current resulting from this voltage difference.

[0060] According to one embodiment, the space between said at least a first contact point and said at least a second contact point is at least equal to the thickness of the substrate before any thinning.

[0061] According to one embodiment, the integrated circuit comprises a first group of several first contact points distributed on said front face, a second group of several second contact points distributed on said front face, and the first measuring means are configured to perform the first measurement between the first group, the second group and said electrically conductive plate.

[0062] According to one variant, the integrated circuit further includes second detection means configured to, prior to detecting substrate thinning, perform a detection of any possible removal of at least part of the electrically conductive plate.

[0063] According to one embodiment, the second detection means include second measurement means configured to perform a preliminary measurement of a resistive value of the substrate between said at least a first contact point and said plate.

[0064] According to one embodiment, the second measuring means are configured to apply a voltage difference between said at least one first contact point and said plate and to measure at said at least one first contact point a current resulting from this voltage difference.

[0065] According to one embodiment, the second measuring means are configured to perform said preliminary measurement between said first group and said electrically conductive plate.

[0066] According to another aspect of the claimed invention, an electronic device is proposed, for example a smart card, comprising an integrated circuit as defined above.

[0067] Other advantages and features of the invention will become apparent upon examination of the detailed description of methods of implementation and embodiment of the invention, which are by no means limiting, and the accompanying drawings in which: [ Fig 1 ] represents a cross-sectional view of an integrated circuit equipping a smart card [ Fig 2 ] schematically illustrates one embodiment of the invention [ Fig 3 ] schematically illustrates another embodiment of the invention [ Fig 4 ] schematically illustrates another embodiment of the invention [ Fig 5 ] schematically illustrates one method of implementing the invention [ Fig 6 ] schematically illustrates one method of implementing the invention, and [ Fig 7 ] schematically illustrates one method of implementing the invention.

[0068] There figure 1 represents an example of an integrated circuit (IC) equipping a smart card (CP).

[0069] A typical CP smart card is schematically illustrated at the top of the figure 1 The integrated circuit (IC) is assembled in the CB card body of the CP smart card, under MC contacts. A cross-section of this assembly is shown at the bottom of the figure 1 .

[0070] The integrated circuit IC classically comprises a semiconductor substrate surmounted by an interconnection part (BEOL: Back End Of Lines).

[0071] The integrated circuit IC is covered with an electrically conductive plate PL. This plate is glued to the rear face FR of said substrate by an adhesive conductive layer CA and attaches it to one face of a resin base RES.

[0072] The RES resin base supports on its opposite face MC contacts dedicated to ensuring the connections of the integrated circuit IC with a terminal such as a card reader.

[0073] The integrated circuit IC is encapsulated in an insulating encapsulation layer Encap.

[0074] The Encap insulating encapsulation layer is itself encapsulated in a CB card body.

[0075] The connections between the MC contacts and the integrated circuit IC are made using BW wires, in a typical flip chip configuration ("Flip chip" according to the usual Anglo-Saxon term), the BW wires being soldered on one side to said MC contacts, and on the other side to contact pads formed on the last level of metallization of the interconnecting part.

[0076] The assembly formed by the electrically conductive plate PL, the adhesive conductive layer CA and the resin RES, forms an encapsulation of the integrated circuit IC.

[0077] This does not exclude the possibility of using other coatings known in the field of integrated circuits, for example adapted to an application other than a smart card.

[0078] There figure 2 represents an example of an implementation method for the integrated circuit IC.

[0079] The integrated circuit IC comprises a semiconductor substrate having a front face FV, a rear face FR and contact sockets PCi, distributed at the front face FV and of which only a first PC1 and a second PC2 are shown here.

[0080] Typically, the semiconductor substrate includes N-type conductivity CS semiconductor boxes electrically isolated from the rest of the substrate, which here is of P-type conductivity.

[0081] The PC1 and PC2 contact points contain P+ type overdoped regions.

[0082] For example, to extract confidential data from an integrated circuit memory, an attacker needs to thin the substrate to get as close as possible to the integrated circuit components, which are made at its front face.

[0083] Such thinning may include, for example, mechano-chemical polishing from the back face, and / or machining, for example, via a focused ion probe FIB.

[0084] To achieve thinning, the attacker can locally remove a portion of the initial plate, or the entire initial plate.

[0085] After thinning, the attacker can leave the initial plate partially removed, redeposit the initial electrically conductive plate PL or another PL plate on the rear face FR.

[0086] The integrated circuit then advantageously also includes first means of detection configured to detect any thinning of the substrate from the rear FR side.

[0087] These first means of detection include here first means of measurement MS1 configured to perform a first measurement of a resistive value of the substrate between the first contact socket PC1, the second contact socket PC2 and said electrically conductive plate PL.

[0088] The resistance to be measured therefore includes an access resistance RAC, a vertical resistance RVT between the access resistance and the electrically conductive plate PL, and a lateral resistance between the two contact sockets PC1 and PC2.

[0089] Although the representation of access resistance on the figure 2 Although deliberately exaggerated for clarity, this access resistance represents the resistance of the substrate volume located between the FV front face and the edges of the adjacent CS boxes.

[0090] The first MS1 measurement means include a GT1 circuit configured to apply a first voltage V1 to the PC1 contact socket while the PL plate is intended to be grounded GND.

[0091] The measurement of the resistive value of the substrate will be obtained here by measuring the current I1 at the level of the second contact tap PC2, this first current I1 resulting from the voltage difference V1-0.

[0092] In this regard, the first means of measurement include a first measurement circuit MES1, of classic structure and known in itself, intended to measure the current I1 and compare it to at least one threshold.

[0093] This threshold corresponds, for example, to a nominal current value obtained for an unthinned substrate.

[0094] Current measurement is a simple way to measure the resistive value of the substrate, and because the vertical and lateral resistances are taken into account simultaneously, the current variation between an unthinned substrate and a thinned substrate, even slightly, is significant.

[0095] The two contact points PC1 and PC2 are spaced a distance D apart.

[0096] Although not strictly necessary, it is preferable for this distance D to be on the order of the substrate thickness EP before any thinning. This increases the sensitivity of the measurement between an unthinned and a thinned substrate.

[0097] As an indication, for a substrate with a thickness of 150 micrometers, this distance D will advantageously be at least equal to 75 micrometers, for example on the order of 150 micrometers.

[0098] As an example, for a substrate with a nominal thickness EP of 150 micrometers and a spacing D of 150 micrometers between the contact points PC1 and PC2, we obtain a nominal current I1 corresponding to an unthinned substrate of the order of 10 microamperes.

[0099] And, as an example, for a thinning of the order of 40 micrometers, we obtain a current I1 greater than 100 microamperes.

[0100] It is also advantageous that the detection of possible damage to the integrity of the integrated circuit should also include, prior to the detection of possible thinning of the substrate, a detection of possible removal of at least part of the electrically conductive plate PL.

[0101] This detection of possible at least local withdrawal of the plate can then include a prior measurement of a resistive value of the substrate between the first point of contact and the plate.

[0102] In other words, we do not take into account the lateral resistance of the substrate but only the sum of the access resistance and the vertical resistance of the substrate, between the first contact point PC1 and the plate PL.

[0103] And, if the plate is for example removed locally directly above the first point of contact, then this measured resistance becomes very large.

[0104] And, in terms of current, if the plate is for example removed locally directly above the first contact point PC1 then the measured value of the current becomes very low.

[0105] From a hardware perspective, the integrated circuit may include, in this respect, as schematically illustrated on the figure 3 , of the second detection means MS2 configured to, prior to the detection of substrate thinning, perform the detection of any possible withdrawal of at least part of the electrically conductive plate PL.

[0106] More specifically, for example, a switch SW can be provided to allow, in order to carry out this preliminary measurement, the measurement circuit MES1 to be disconnected from the second contact socket PC2.

[0107] The second means of measurement MS2 then include the GT1 circuit configured to apply the voltage V1 to the first contact tap PC1, the PL plate being grounded.

[0108] The MS2 measuring means also include a second measuring circuit MES2 for example of analogous structure to the first measuring circuit MES1, and configured to measure the current I2 resulting from the voltage difference V1-0 applied between the contact socket PC1 and the plate PL.

[0109] The MES2 measurement circuit can then compare this current I2 to a second threshold to detect any possible removal of the PL plate.

[0110] As illustrated on the figure 4 , in order to provide more effective protection against damage to the integrity of the integrated circuit by thinning of the substrate and / or at least localized removal of the PL plate, it is advantageous to provide a first group of several first contacts PC1 distributed on the front face FV of the integrated circuit, and a second group of several second contacts PC2 distributed on said front face FV.

[0111] Although this is not the only possible configuration, as explained above, all first contact sockets PC1 are electrically connected together and all second contact sockets PC2 are electrically connected together in the example described here.

[0112] The first measurement of the current I1 is then advantageously carried out between the first group of contact sockets PC1, the second group of contact sockets PC2 and the electrically conductive plate PL.

[0113] Similarly, the second measurement of the current I2 can advantageously be carried out between the first group of several first contact taps PC1 and the electrically conductive plate PL.

[0114] We now refer more specifically to figures 5 à 7 to illustrate methods of implementing a process according to the invention.

[0115] On the figure 5 , after a power-up 50 of the integrated circuit, in step 51, the possible withdrawal of the semiconductor plate PL is detected at least locally.

[0116] If a withdrawal is indeed detected, then an alarm signal can be issued.

[0117] By "alarm signal" we mean, for example, a signal that triggers conventional means of countermeasures designed to thwart such an attack, or even to stop the operation of the integrated circuit.

[0118] If no local shrinkage of the conductive plate PL is detected, then we proceed to step 53 in which we detect any thinning of the substrate.

[0119] If even a minimal thinning of the substrate is detected, then we return to step 52 of emitting the alarm signal.

[0120] If, on the other hand, no substrate thinning is detected, then the integrated circuit is considered operational.

[0121] As already mentioned above, and as illustrated on the figure 6 Step 51, detecting a possible at least local withdrawal of the PL plate, may include applying voltage V1 to contact tap PC1 and applying ground to the PL plate. The SW switch is open.

[0122] The resulting current I2 is then measured at the contact point PC1 (step 511).

[0123] We then compare this current I2 with a threshold TH2 (step 512) to determine if there has been at least local withdrawal of the PL plate.

[0124] Regarding step 53, as illustrated on the figure 7 , it may also include an application of voltage V1 on the contact socket PC1 and an application of ground on the plate PL (step 530).

[0125] This application 530 is followed by the measurement of the current I1 (step 531) at the level of the second contact socket PC2 (switch SW closed) and then by a comparison of this current I1 with another threshold TH1 (step 532).

Claims

1. Method for detecting a possible compromise of the integrity of an integrated circuit including a semiconductor substrate (SB) having a front face and a rear face, the method comprising detecting (53) a possible thinning of the substrate from the rear face, said detection of the thinning comprising a first measurement of a resistive value of the substrate between at least one first contact (PC1), at least one second contact (PC2), spaced apart and located on the front face, and an electrically conductive plate (PL) located on the rear face, the method being such that said first measurement of the resistive value of the substrate comprises applying (530) a voltage difference between said at least one first contact (PC1) and said plate, and measuring (531) at said at least one second contact (PC2) a current (I1) resulting from this voltage difference.

2. Method according to claim 1, wherein the space (D) between said at least one first contact and said at least one second contact is at least equal to half the thickness (EP) of the substrate before possible thinning.

3. Method according to one of the preceding claims, wherein the first measurement is carried out between a first group of several first contacts (PC1) distributed on said front face, a second group of several second contacts (PC2) distributed on said front face, and said electrically conductive plate (PL).

4. Method according to one of the preceding claims, wherein the detection of the possible compromise of the integrity of the integrated circuit further comprises, prior to the detection (53) of the possible thinning of the substrate, a detection (51) of a possible removal of at least a part of the electrically conductive plate.

5. Method according to claim 4, wherein the detection of the possible removal of at least a part of the plate comprises a prior measurement of a resistive value of the substrate between said at least one first contact (PC1) and said plate (PL).

6. Method according to claim 5, wherein the prior measurement of a resistive value of the substrate between said at least one first contact and said plate comprises applying (510) a voltage difference between said at least one first contact and said plate and measuring (511) at said at least one first contact (PC1) a current (I2) resulting from this voltage difference.

7. Method according to claim 5 or 6 taken in combination with claim 3, wherein said prior measurement is carried out between said first group and said electrically conductive plate (PL).

8. Integrated circuit comprising a semiconductor substrate (SB) having a front face and a rear face, at least one first contact (PC1), at least one second contact (PC2), spaced apart and located at the front face, and an electrically conductive plate (PL) located on the rear face and first detection means (MS1) configured to detect a possible thinning of the substrate from the rear face, said first detection means including first measurement means (MS1) configured to carry out a first measurement of a resistive value of the substrate between said at least one first contact (PC1), said at least one second contact (PC2) and said electrically conductive plate (PL); wherein the first measurement means (MS1) are configured to apply a voltage difference between said at least one first contact and said plate, and to measure, at said at least one second contact, a current (I1) resulting from this voltage difference.

9. Integrated circuit according to claim 8, wherein the space (D) between said at least one first contact and said at least one second contact is at least equal to half the thickness (EP) of the substrate before possible thinning.

10. Integrated circuit according to one of claims 8 to 9, comprising a first group of several first contacts (PC1) distributed on said front face, a second group of several second contacts (PC2) distributed on said front face, and the first measurement means are configured to carry out the first measurement between the first group, the second group and said electrically conductive plate.

11. Integrated circuit according to one of claims 8 to 10, further comprising second detection means (MS2) configured to, prior to the detection of the possible thinning of the substrate, carry out a detection of a possible removal of at least a part of the electrically conductive plate.

12. Integrated circuit according to claim 11, wherein the second detection means comprise second measurement means (MS2) configured to carry out a prior measurement of a resistive value of the substrate between said at least one first contact and said plate.

13. Integrated circuit according to claim 12, wherein the second measurement means (MS2) are configured to apply a voltage difference between said at least one first contact and said plate and to measure at said at least one first contact (PC1) a current (I2) resulting from this voltage difference.

14. Integrated circuit according to claim 12 or 13 taken in combination with claim 10, wherein the second measurement means are configured to carry out said prior measurement between said first group and said electrically conductive plate.

15. Electronic device, such as a chip card (CP), including an integrated circuit (CI) according to one of claims 8 to 14.