Physically unclonable function device

Abstract

Integrated device with a physically unclonable function, comprising a first physically unclonable function module (MPF1), internal to the device (DIS), configured to generate an initial data group (RD2) and management means (MGST), internal to the device, at least configured to -generate an output data group (HUK2) from at least the initial data group (RD2), -authorize only D successive deliveries of the output data group (HUK2) on a first output interface (INST1) of the device, D being a non-zero positive integer, and -prevent any new generation of the output data group (HUK2). Figure for abstract: Fig 1

Description

Title of the invention: Physically non-clonable function device

[0001] Implementations and embodiments of the invention relate to physically unclonable functions (PUF: Physical Unclonable Function), and in particular those implemented within an integrated circuit.

[0002] A physically unclonable function allows for the automatic generation of unique, unpredictable code that depends on random or partially random physical characteristics of the physically unclonable function. These physical characteristics may be caused by variations during the manufacture of the physically clonable function.

[0003] Thus, cloning such a function is very difficult or even impossible.

[0004] Furthermore, the content of the generated code, which is unique because it differs from one physically unclonable function to another physically unclonable function, cannot be predicted and may depend, for example, on a particular configuration of components when the function is powered up. Thus, for example, a physically unclonable function may be implemented by a non-volatile memory that has content upon power-up that depends on the partially random physical characteristics of the memory, with these manufacturing variations leading to different physical characteristics for different memories.

[0005] It is desirable that random variations in physical characteristics are easily identifiable to unambiguously distinguish different data.

[0006] Furthermore, it is desirable that the implementations of physically unclonable functions require few or no dedicated manufacturing steps.

[0007] Unpredictable one-time codes typically comprise a sequence of random data and are primarily used as encryption keys. These data are typically secret.

[0008] Physically unclonable functions can be implemented using, for example, random access or non-volatile memories, or ring oscillators or specific logic circuits.

[0009] However, these prior art devices may in certain cases be more or less easily detectable within the integrated circuit or may be sensitive to fault injection attacks, or even to penalizing surface space requirements.

[0010] There is therefore a need to strengthen the security of physically unclonable function structures, and in particular to propose function structures physically unclonable whose data is clearly discriminable in reading, while being difficult to extract by third-party attacks.

[0011] It would also be appreciated if the structures were easy to produce using existing technologies and had a non-penalizing surface area.

[0012] According to one embodiment, a physically non-clonable function device is provided which can only be used a predefined number of times, the device becoming inoperative after this number of times has been reached.

[0013] A possible, but not exclusive, application of such a device is, for example, a limitation of the number of possible pairings between devices, for example printers, and objects, for example ink cartridges.

[0014] According to another embodiment, a physically non-clonable function device is proposed which can both deliver this unique non-predictable code, which can serve for example as an encryption / decryption key, a predefined number of times, and deliver another unique non-predictable code which can also serve for example as an encryption key and this an unlimited number of times.

[0015] Thus, according to this other embodiment, a physically non-clonable function device is proposed capable of providing, for example, a first key for limited use and a second key for unlimited use.

[0016] According to one aspect there is provided an integrated device of physically non-clonable function, comprising - a first physically unclonable function module, internal to the device, configured to generate a group of initial data, and - management means, internal to the device, configured to o generate a group of output data from at least the group of initial data, o allow only D successive deliveries of the output data group on a first output interface of the device (i.e., outside the device), D being a non-zero positive integer, and o prevent any further generation of the output data group.

[0017] The output data group, i.e. the unique unpredictable code forming for example a first limited-use key, may be for example the initial data group generated by the first module, or may be obtained for example by a combination of this initial data group and additional data itself generated by a second physically unclonable function module.

[0018] The number D is determined for example by the sum of the number of uses of the device under test and the number of operational uses of the device by the end user.

[0019] Furthermore, the first physically unclonable function module and the management means are internal to the integrated device, which makes the integrated device autonomous without it having to receive external data to deliver the output data group, i.e. the unique unpredictable code.

[0020] This makes the device even more robust.

[0021] According to one embodiment, the management means are configured to prevent any new generation of the output data group by preventing any new generation of the initial data group.

[0022] According to one embodiment, the first module comprises -a first set of non-volatile memory cells each having a selection transistor buried in a semiconductor substrate and a depletion-type state transistor, having a control gate and a floating gate, the state transistors having respective effective threshold voltages belonging to a common random distribution, and -reading means configured to deliver the group of initial data from a reading of the effective threshold voltages of the state transistors of the memory cells of said first set.

[0023] This type of non-volatile memory cells with buried selection transistor has a particularly compact structure. It has been described in detail for example in patent application US 2013 / 0 228 846.

[0024] It is possible to read a memory cell of the first set by applying a zero voltage to the control gate, for example by connecting this control gate to ground, because the state transistor is normally on.

[0025] Furthermore, the state transistor being of the depletion type, the passing character, (“normally on”) of the state transistor when the memory cell is for example in a virgin state and a zero voltage is applied to the control gate, is linked to the value of the threshold voltage in the virgin state of this memory cell which can for example be chosen to be negative or substantially zero.

[0026] As an indication, this threshold voltage can be of the order of -1 volts.

[0027] The state transistors of all the memory cells of the first set have the same theoretical threshold voltage. However, it is the effective threshold voltages, that is to say the real values ​​of the threshold voltages, which vary slightly according to the random dispersion, for example due to physical manufacturing hazards.

[0028] And, the common random distribution is advantageously a distribution of effective threshold voltages of state transistors of blank memory cells that have never been written.

[0029] According to one embodiment, the first set of non-volatile memory cells is organized into two first matrix subsets arranged symmetrically with respect to the reading means, all the lines of the first two matrix subsets being parallel, and -the reading means are configured to carry out said reading comprising differential readings of the effective threshold voltages of the state transistors of the pairs of symmetrical memory cells located respectively in the first two sub-assemblies on homologous columns of these first two sub-assemblies.

[0030] Two homologous columns of the first two subsets are understood to be columns having the same column address.

[0031] The distribution of the first set into two symmetrical matrix subsets associated with the differential approach at the reading level is particularly advantageous in that it makes it possible to increase the dispersion within the common random distribution of the effective threshold voltages of the state transistors.

[0032] According to one embodiment, the management means are configured to program or erase the memory cells of one of the two subsets after reading the initial data group, so as to prevent any new generation of the initial data group.

[0033] In fact, any new differential reading of the memory cells of the first set will provide a constant value, of course different from the group of initial data generated.

[0034] We have therefore destroyed here the source of entropy at the origin of the generation of the initial data group.

[0035] According to one embodiment, the group of initial data comprises G initial data and the management means comprise a non-volatile memory device comprising - a memory plan comprising D memory zones, each memory zone being configured to store information comprising a succession of N data including the G initial data, N being greater than or equal to G, and - first processing means configured to successively extract the N data from the D memory areas of the memory means and to destroy at least part of the content of the corresponding memory area during the extraction of the N corresponding data.

[0036] The D memory zones, each of which contains the initial data group (which is a random sequence of data), will allow the D successive deliveries of the output data group to the outside of the device.

[0037] Furthermore, it is possible to store only the group of initial data in each memory area. In this case, N is equal to G and the succession of N data stored in each memory area is the sequence of the G initial data.

[0038] That being said, it would be possible to provide N greater than G. In this case, for example, the G initial data are completed by NG dummy bits, for example all having the value 1, to obtain the succession of N data stored in the memory zone.

[0039] Each memory zone also advantageously comprises non-volatile memory cells with buried selection transistor.

[0040] More specifically, according to one embodiment, each memory area includes a matrix of memory cells having two rows and N columns.

[0041] Each memory cell comprises a state transistor having a control gate and a floating gate, selectable by a vertical select transistor buried in a substrate and having a buried select gate.

[0042] Each column of memory cells includes a pair of twin memory cells.

[0043] Two memory cells are said to be twins when the two selection transistors of this pair of memory cells have a common selection gate.

[0044] The first processing means are configured to store in the memory area, said information comprising the succession of N bits.

[0045] The storage of said information is advantageously carried out so that, with the exception of the last bit of the succession, - a current bit of said succession of bits is stored in two memory cells located on the same row and on two adjacent columns, and -a current bit and the next bit are respectively stored in two twin cells.

[0046] Such a twin cell structure combined with this checkerboard type filling of the memory area and redundant storage of the current bit in two memory cells, leads to robust storage of the information and makes it difficult to restore the correct value of the information bits, and therefore the correct value of the bits of the initial data group, in particular with a conventional method of reading these memory cells.

[0047] In this regard, in order to ensure correct reading of a bit, the first processing means are advantageously configured to, in order to be able to read a bit stored in a first twin cell, first replace the bit stored in the second twin cell with a reference bit having a reference value chosen to allow correct restitution of the value of the bit stored in the first twin cell. This reference value is for example the logic value 0 corresponding to a programmed state of the twin memory cell.

[0048] Indeed, since the two twin cells are selected simultaneously, the value of the bit stored in the second twin cell must not “mask” possibly (for example if this value is equal to 1) the value of the bit stored in the first twin cell.

[0049] Furthermore, the first processing means are further advantageously configured to sequentially read the N bits of the information and, for each bit of the succession except the last, replace a current bit already read of said information with the reference bit, before being able to read the following bit of said succession.

[0050] Such reading with replacement of each bit already read by the reference bit, before being able to read the next bit of information, amounts to “destroying” the bits as they are read, with the exception of the last one, and therefore makes it impossible to re-restore the stored information, and consequently to re-restore the initial data group.

[0051] Each memory zone can therefore only be read once to deliver the stored information only once.

[0052] Consequently, the D memory zones will only allow D restitutions of the initial data group and therefore D deliveries of the unique, unpredictable code.

[0053] According to one embodiment, the memory area comprises a single bit line per column connected to the drains of the state transistors of the pair of twin cells of the corresponding column, and a gate control line, per row of memory cells, connected to all the control gates of the state transistors of the memory cells of the corresponding row.

[0054] According to one embodiment, the first processing means comprise a column decoder configured to individually select the two bit lines associated with the two columns located at the two ends of the memory area and, to simultaneously select two adjacent bit lines, both for the operation of storing the information and for the operation of reading and prior replacement of the bits.

[0055] Such a non-limiting example of a column decoder makes it possible to implement the particular storage and reading mentioned above.

[0056] The memory cells of the memory areas are cells with one bit line per column, while the other memory cells of the device are memory cells with two bit lines per column.

[0057] While it would be possible to provide separate column decoders for each type of architecture (single bit line or dual bit line), it is particularly advantageous to provide a single column decoder structure compatible with both architectures. This will be explained in more detail below.

[0058] In a first variant, the output data group, i.e. the unique, unpredictable, limited-use code delivered by the physically functioning device non-clonable, can simply include the N bits of said information stored in a memory area.

[0059] That being said, it is possible, in order to make the device even more robust to attacks, to combine the N bits of information stored in each memory zone with a group of additional data generated by a second physically unclonable function module.

[0060] Thus, according to another variant, the management means comprise -a second physically unclonable function module configured to generate an additional data group, and - processing means configured to process the output data group from at least the initial data group and at least the additional data group.

[0061] However, this group of additional data can also act on its own as a unique, unpredictable code, which can be used, for example, as an encryption / decryption key.

[0062] The device may then be able to deliver D times a first unique unpredictable code (the output data group) and to deliver a very large unlimited number of times, a second unique unpredictable code (the additional data group s).

[0063] More precisely, according to one embodiment, the management means are configured to deliver on a second output interface of the device (this second output interface being able to be identical or different from the first output interface) the group of additional data.

[0064] According to one embodiment, the second physically unclonable function module comprises: -a second set of non-volatile memory cells each having a selection transistor buried in a semiconductor substrate and a depletion-type state transistor having an electrically connected control gate and floating gate, the state transistors having respective effective threshold voltages belonging to a common random distribution, and - second processing means configured to deliver the group of additional data from a reading of the effective threshold voltages of the state transistors of the memory cells of said second set.

[0065] The non-volatile memory cells with buried selection transistor of the second set are again of the type described in patent application US 2013 / 0 228 846.

[0066] But, here, compared to these conventional cells, the state transistors of the memory cells of the second set are of the depletion type and have an electrically connected control gate and floating gate.

[0067] These characteristics are particularly advantageous because, as for the memory cells of the first set (i.e. those of the first physically unclonable function module), it is then possible to read a memory cell of the second set by applying a zero voltage to the control gate, for example by connecting this control gate to ground, because the state transistor is normally on.

[0068] Furthermore, since there is zero voltage on the control gate when reading, no stress is induced during reading (“read stress”) in the gate dielectric, which makes it possible to greatly reduce, or even eliminate, the risk of the occurrence of a phenomenon known to those skilled in the art under the English term “read disturb” which can result in a modification of the logic value of the stored bit.

[0069] This is particularly advantageous for these memory cells which are likely to be read a very large number of times.

[0070] Furthermore, the state transistor being of the depletion type, the passing character, (“normally on”) of the state transistor when the memory cell is for example in a virgin state and a zero voltage is applied to the control gate, is linked to the value of the threshold voltage in the virgin state of this memory cell which can for example be chosen to be negative or substantially zero.

[0071] As an indication, this threshold voltage can be of the order of -1 volts.

[0072] Here again the state transistors of all the memory cells have the same theoretical threshold voltage. But, it is the effective threshold voltages, that is to say the real values ​​of the threshold voltages, which vary slightly according to the random dispersion, for example due to physical manufacturing hazards.

[0073] But since the control and floating gates of the state transistors are electrically connected, the state transistors by nature have greater variability in the face of these hazards and therefore a wider distribution than other types of electronic components, for example MOS transistors or resistors.

[0074] Thus these cells of the second set offer a very wide dispersion of the effective threshold voltages.

[0075] The dispersion obtained from the effective threshold voltages is for example equal to -1 volts plus or minus 100%.

[0076] And, the common random distribution is advantageously a distribution of effective threshold voltages of state transistors, with connected floating and control gates, of blank memory cells which have never been written.

[0077] Advantageously, each memory cell of the second set comprises a gate oxide arranged between the floating gate of the state transistor and the substrate, the thickness of this gate oxide being greater than 8 nanometers, for example between 8 and 10 nanometers.

[0078] Such a thick gate oxide makes it possible to obtain good robustness of the second physically unclonable function module with respect to aging.

[0079] According to one embodiment, the second processing means comprise second reading means configured to carry out said reading of the effective threshold voltages of the state transistors and the second set of non-volatile memory cells is organized into two second matrix sub-sets arranged symmetrically with respect to the reading means, all the lines or rows of the two second matrix sub-sets being parallel.

[0080] Furthermore, the second reading means are configured to carry out said reading which then comprises differential readings of the effective threshold voltages of the state transistors of the pairs of symmetrical memory cells and located respectively in the two second sub-assemblies on homologous columns of these two second sub-assemblies.

[0081] Here again, two homologous columns of the two second subsets are understood as being columns having the same column address.

[0082] In a manner analogous to what was indicated for the first set, the distribution of the second set into two symmetrical matrix subsets associated with the differential approach at the reading level, is particularly advantageous in the sense that it makes it possible to increase the dispersion within the common random distribution of the effective threshold voltages of the state transistors.

[0083] It is furthermore particularly preferable to ensure the reliability of the memory cells of the second set so as to retain, for the delivery of the group of additional data, only the pairs of memory cells of the second set whose content is reliable, that is to say not likely to vary from one power-up to another.

[0084] Also, according to one embodiment, the second processing means advantageously comprise a third set of memory cells each having a selection transistor buried in a semiconductor substrate and a state transistor having a control gate and a floating gate, the memory cells of the third set being intended to contain reliability information representative of the reliability or unreliability of the contents of the pairs of memory cells of the second set.

[0085] Unlike the memory cells of the second set, the memory cells of the third set which are intended to contain the reliability information, do not include state transistors having their floating gate and control gate electrically connected. On the other hand, these state transistors are also advantageously of the depletion type.

[0086] Thus, just as it is possible (as indicated above) to read a memory cell of the second set by applying a zero voltage to the control gate, for example by connecting this control gate to ground, because the state transistor is normally on, it is also possible to read a memory cell of the third set by applying a zero voltage to the control gate because the state transistor of such a cell is also advantageously normally on.

[0087] In other words, the memory cells of the third set are conventional memory cells with a state transistor and a buried selection transistor, for example of the type described in the previously cited United States patent application, but with for example an arsenic implant in the channel region so as to obtain state transistors of the depletion type.

[0088] According to one embodiment, the third set comprises a matrix arrangement of memory cells sharing the same columns as those of the matrix arrangement of memory cells of the second set.

[0089] This makes decoding easier because the second set and the third set then share the same column decoding.

[0090] Furthermore, it is further advantageous for the third assembly to also comprise two third subassemblies respectively distributed on either side of the second subassemblies.

[0091] Furthermore, the reliability information associated with the pairs of memory cells is stored in memory cells of the third set located on the same columns as those on which said corresponding pairs of memory cells of the second set are located.

[0092] Such symmetrical storage of reliability information on either side of the second subsets allows for easier reading.

[0093] According to one embodiment, the second processing means comprise first generation means configured to generate said reliability information by taking into account a margin value on the differential readings of the effective threshold voltages of the state transistors of the pairs of memory cells of the second set.

[0094] According to one embodiment, the second processing means comprise second generation means configured to generate said group of additional data at least from the differential readings of the voltages effective threshold values ​​of the state transistors of the pairs of memory cells of the second set, and said reliability information of these pairs of memory cells.

[0095] As indicated above, according to one embodiment, the first set of memory cells, the second set of memory cells and the third set of memory cells each have an architecture comprising two bit lines per column of memory cells.

[0096] In other words, the columns of these memory cells comprise pairs of twin memory cells, the two selection transistors of a pair of twin memory cells having a common selection gate, two adjacent twin memory cells of the same column not being connected to the same bit line and two adjacent non-twin memory cells of the same column being connected to the same bit line.

[0097] And according to one embodiment, certain columns of the non-volatile memory device (comprising the D memory areas) are common with certain columns of the first, second and third sets.

[0098] The management means then advantageously comprise a single column decoder configured to individually select the two bit lines associated with the two columns located at the two ends of each memory zone and to simultaneously select two adjacent bit lines of each memory zone and a bit line of the first, second and third sets common to one of these two adjacent bits, and to individually select the other bit lines of the first, second and third sets.

[0099] As indicated above, such a column decoder structure is compatible with the one bit line per column architecture of the non-volatile memory device and with the double bit line per column architecture of the memory cell sets of the first and second physically unclonable function modules.

[0100] According to another aspect, there is provided a method for automatically generating a unique unpredictable code at said first output interface of a physically unclonable function device as defined above, comprising a power-up of the device and at least one reading of a memory area of ​​the non-volatile memory device.

[0101] According to one embodiment, the method further comprises a reading of the effective threshold voltages of the state transistors of the memory cells of said second set, the control gates of the state transistors of these memory cells being connected to ground during said reading, and a development of the unique unpredictable code from the content of the memory area read and the group of additional data obtained from said reading.

[0102] According to another aspect, a method is proposed for producing a physically non-clonable function device as defined above, comprising producing the device within an integrated circuit, and during a test phase of the integrated circuit, - generating the initial data group, - storing said information of N data in the D memory zones, - programming or erasing a portion of the memory cells of the first set after generating the initial data group, - generating and storing reliability information.

[0103] Other advantages and characteristics of the invention will appear on examining the detailed description of embodiments and methods of implementation, which are in no way limiting, and the appended drawings in which:

[0104]

[0105]

[0106]

[0107]

[0108]

[0109]

[0110] [YES]

[0112]

[0113]

[0114]

[0115]

[0116]

[0117]

[0118]

[0119]

[0120]

[0121]

[0122]

[0123]

[0124]

[0125]

[0126]

[0127]

[0128]

[0129]

[0130] [Fig.l] [Fig.2] [Fig.3] [Fig.4] [Fig.5] [Fig.6] [Fig.7] [Fig.8] [Fig.9] [Fig. 10] [Fig.11] [Fig.12] [Fig.13] [Fig.14] [Fig.15] [Fig.16] [Fig.17] [Fig.18] [Fig.19] [Fig.20] [Fig.21] [Fig.22] [Fig.23] [Fig.24] [Fig.25] [Fig.26] [Fig.27] .

[0131] [Fig.28]

[0132] [Fig.29]

[0133] [Fig.30]

[0134] [Fig.31]

[0135] [Fig.32]

[0136] [Fig.33]

[0137] [Fig.34]

[0138] [Fig.35]

[0139] [Fig.36]

[0140] [Fig.37], and

[0141] [Fig.38] schematically illustrate modes of implementation and embodiment of the invention.

[0142] General architecture of the physically non-clonable function device

[0143] Before returning in more detail to the different constituents of a physically non-clonable function device, we will describe an example of its general architecture and operation with reference to figures 1 to 4.

[0144] In [Fig. 1], the reference DIS designates an integrated device with a physically non-clonable function, advantageously entirely produced within the same integrated circuit IC.

[0145] The DIS device comprises a first physically unclonable function module MPF1, internal to the DIS device, configured to generate a group of initial data RD2, typically a random binary data sequence forming a unique unpredictable initial code.

[0146] As will be seen in more detail below, the first module MPF1 comprises a first set 1 of memory cells intended to generate the initial code RD2.

[0147] The DIS device also comprises MGST management means, internal to the DIS device, configured to -generate a HUK2 output data group from at least the RD2 initial data group, - authorize only D successive deliveries of the HUK2 output data group on a first INST1 output interface of the device, D being a non-zero positive integer, and - prevent any further generation of the HUK2 output data group.

[0148] This group of HUK2 output data forms a first unique unpredictable code, usable for example as an encryption / decryption key.

[0149] This first HUK2 code is therefore of limited use because it can only be issued D times.

[0150] As will be seen in more detail below, the management means are configured to prevent any new generation of the output data group HUK2 by preventing any new generation of the initial data group RD2.

[0151] The management means MGST comprise a non-volatile memory device DM having a memory plane comprising D memory zones ZM1-ZMD.

[0152] Each memory area is capable of storing N bits.

[0153] In the example described here, it is assumed that the initial data group RD2 also has N bits.

[0154] As indicated above, in the case where the group RD2 would include GM bits, with G less than N, it would be possible to supplement the G bits with NG dummy bits.

[0155] Each memory zone ZMi is therefore configured here to store the succession of N data of the initial code RD2.

[0156] And as will be seen in more detail below, the memory device DM comprises first processing means (not shown in this [Fig.l]) configured to successively extract the N data of the code RD2 from the D memory zones of the memory means and to destroy at least part of the content of the corresponding memory zone during the extraction of the N corresponding data.

[0157] While it would be possible for the first unpredictable unique code HUK2 to be the initial code RD2, it is preferable, in order to improve the robustness of the DIS device against attacks by malicious third parties, to combine the initial code RD2 with a group of additional data forming a second unpredictable unique code HUK1.

[0158] In this respect, the MGST management means comprise MLB development means, for example a logic circuit of the EXCLUSIVE OR type, developing the first code HUK2 from the initial code RD2 and the second code HUK1.

[0159] The MGST management means also comprise a second physically non-clonable function module MPF2 configured to generate the second HUK1 code.

[0160] As will be seen in more detail below, the second module comprises a second set 2 of memory cells intended to generate the HUK1 code using MSK reliability information contained in a third set 3 of memory cells.

[0161] It is also possible for the second MPF2 module to deliver the second HUK1 code on a second INTS2 output interface of the device, this second INTS2 output interface being able to be the first INTS1 output interface or a different output interface.

[0162] The second HUK1 code can be used, for example, as an encryption / decryption key.

[0163] The second HUK1 code can be an unlimited use code.

[0164] Manufacture and use of the physically non-clonable function device

[0165] We now refer more particularly to [Fig.2] to illustrate an example of a manufacturing process for the device of [Fig.l], allowing its use.

[0166] The steps mentioned in [Fig.2] are general steps, some of which will be explained in more detail below.

[0167] These steps are part of a first PHI phase which is typically a test phase known to those skilled in the art by the acronym EWS (“Electrical Wafer Sorting”)•

[0168] Once the integrated circuit incorporating the DIS device has been produced, the DIS device is powered up (step ST20).

[0169] Then we generate the initial code RD2 (step ST21) which we store respectively D times in the D memory zones ZM1-ZMD (step ST23).

[0170] We then prevent (step ST23) any new generation of the initial code RD2.

[0171] The number D is determined based on the necessary number of uses of the DIS device during the functional test of the device and the maximum number of uses of the device by the end user.

[0172] Indeed, after D deliveries of the HUK2 code by the DIS device, it will no longer be able to deliver the HUK2 code.

[0173] In addition to the steps just mentioned, the method comprises in step ST24, the generation of the reliability information MSK and their storage in the set 3 of memory cells (step ST25).

[0174] At the end of this first PHI phase, the DIS device is ready to be used.

[0175] [Fig.3] describes a first mode of implementation allowing the generation of the HUK2 code.

[0176] After powering up the DIS device in a step ST30, the HUK1 code is generated (step ST31).

[0177] This generation can be triggered automatically or in response to an internal command generated by a control unit (software or state machine for example) internal to the device.

[0178] The HUK1 code is then stored for example in internal registers (step ST32).

[0179] Upon receipt in step ST33 of another internal command HUK2CMD, for example also generated by the control unit, and if the code HUK2 has not already been generated D times (step ST34), we move on to step ST36 in which the initial code RD2 is read in one of the memory areas ZMi still available.

[0180] If, on the other hand, the HUK2 code has already been generated D times, then a new generation and a new delivery of the HUK2 code is impossible (step ST35).

[0181] After reading in step ST36 the initial code RD2, the code HUK2 is generated in step ST37 from the initial code RD2 and the stored code HUK1.

[0182] Furthermore, as will be seen in more detail below, reading the initial code RD2 in the memory zone ZMi automatically results in its destruction in the memory zone ZMi (step ST38).

[0183] The HUK2 code is then delivered on the first output interface INST1 of the DIS device.

[0184] The HUK2 code is therefore a limited-use code because it can only be generated D times.

[0185] [Fig.4] illustrates another example of use of the DIS device.

[0186] In this example, after powering up the DIS device in step ST40, the HUK1 code is generated in step ST41. Then delivered on the output interface INST2 (step ST42).

[0187] Here again, this generation of HUK1 can be triggered automatically or in response to an internal command generated by the internal control unit of the device.

[0188] These steps can be repeated an unlimited number of times.

[0189] The HUK1 key is therefore not for limited use.

[0190] We now refer more particularly to figures 5 and following to describe in more detail certain constituents of the DIS device of [Fig.l].

[0191] Memory cells used in the physically unclonable function device

[0192] As indicated above, the DIS device comprises memory zones ZMi and different sets 1, 2 and 3 comprising memory cells.

[0193] These memory cells are non-volatile cells of the split-gate type.

[0194] In [Fig.5], the reference M designates such a non-volatile memory cell of the split-gate type, for example of the selection transistor type having a vertical gate buried in the substrate of an integrated circuit.

[0195] More precisely, the memory cell M comprises a state transistor T comprising a floating gate FG surmounted by a control gate CG connected to a gate control line CGL.

[0196] The drain (D) of the state transistor T is connected to a bit line BL while the source (S) of the state transistor T is connected to the drain of a selection transistor ST.

[0197] The selection transistor ST comprises a gate CSG connected to a word line WL.

[0198] The source (S) of the selection transistor ST is connected to a source line SL.

[0199] As illustrated in [Fig.6], each state transistor of a memory cell cooperates with the selection transistor ST which is vertical and buried in the substrate SB.

[0200] The ZCH channel of the state transistor is referenced ZCH.

[0201] The selection transistors ST connected to the two state transistors Ti,j and Ti+1,j each have a vertical channel ZCV and a buried vertical common selection gate CSG. It should be noted that for the purpose of simplifying the figure, the contact for connecting the buried common gate CSG to the corresponding word line WLi,i+l is not shown.

[0202] [Fig.6] illustrates more precisely two twin cells Mi,j and Mi+l,j belonging to the same column j and to the two rows i and i+1.

[0203] The state transistor here is a depletion type state transistor as described in the French patent application published under No. 3049380.

[0204] As is well known to those skilled in the art, the depletion MOS transistor is conductive without a control voltage applied to the control gate of the state transistor (control gate connected to ground), and consequently to the floating gate by capacitive coupling. The state transistor is therefore said to be “normally on”. On the other hand, the transistor becomes less and less conductive as the control voltage present on the control gate increases in absolute value (becomes more and more negative) to finally turn off beyond a blocking voltage.

[0205] The ZCH channel of the state transistor is advantageously a surface channel so that it may be possible to block the conduction of the channel by applying an acceptable control voltage to the control gate of the state transistor.

[0206] The implantation energy of the dopants defines the depth of the ZCH channel. As an indication, this energy can be between 5keV and 100keV, leading to a channel depth of the order of 100 nm.

[0207] In the case of a channel of conductivity type N, the implanted dopants may be, for example, arsenic As, and the concentration of dopants determines the threshold voltage VthO of the state transistor of a memory cell in the virgin state. The state transistor is here configured to have such a negative threshold voltage VthO. In this respect, a dose of implanted dopants of between 1012 atoms / cm2 and 1014 atoms / cm3 may be used.

[0208] With such a dose of dopants, it is possible to obtain a negative voltage VthO of, for example, between -1 volt and -0.5 volt.

[0209] Memory plane structures used in the physically unclonable function device

[0210] With such memory cells, different memory plane structures are possible, namely a structure with a single bit line per column or a structure with two (or double) bit lines per column.

[0211] The memory plane of the memory device DM comprising the D memory areas ZMi has a structure with one bit line per column while sets 1, 2 and 3 have a structure with two bit lines per column.

[0212] One-bit-line-per-column memory plane structure

[0213] As an example, [Fig.7] represents a memory plane structure PM with a single bit line per column and comprising memory cells Mi,j; Mi,j+1; Mi-l,j; Mi-l,j+l of the type described in patent application US 2013 / 0228846.

[0214] The memory cells Mi,j and Mi,j+1 of rank "i" belong to the row or line of rank i of the memory plane and are connected to a word line WLi-l,i and to a gate control line CGLi.

[0215] The memory cells Mi-l,j and Mi-l,j+l of rank "i-1" belong to the line or row of rank "i-1" of the memory plane and are connected to the word line WLi-l,i and to a gate control line CGLi-1.

[0216] The memory cells Mi,j and Mi-l,j of rank "j" belonging to the column j are accessible in reading and writing via a single bit line BLj and the memory cells Mi,j+1 and Mi-l,j+l of rank "j-1" are accessible in reading and writing via a single bit line BLj+1.

[0217] Each memory cell comprises a floating gate transistor FG, respectively Ti,j; Ti,j+1 Ti-l,j; Ti-l,j+l. The drain regions (D) of the transistors Ti,j and Ti-l,j are connected to the bit line BLj and the drain terminals of the transistors Ti,j+1 and Ti-1,j+l are connected to the bit line BLj+1. The control gates CG of the transistors Ti,j and Ti,j+1 are connected to the gate control line CGLi and the control gates CG of the floating gate transistors Ti-l,j and Ti-1,j+1 are connected to the gate control line CGLi-1.

[0218] Each floating gate transistor has its source terminal (S) connected to a source line SL via the selection transistor ST. The selection transistors ST of the memory cells Mi,j and Mi-lj have a common selection gate CSG and the two memory cells are therefore called "twins". Similarly, memory cells Mi,j+1 and Mi-l,j+1 are twin memory cells and their selection transistors ST have a common selection gate CSG.

[0219] Each selection gate CSG is a vertical gate buried in a substrate in which the memory plane PM is realized, the source line SL also being buried. These common selection gates CSG of twin memory cells are connected to the word line WLi-l,i.

[0220] Two bit line per column memory plane structure

[0221] [Fig.8] illustrates a memory plane and twin memory cell structure known as “double bit lines” (two bit lines per column).

[0222] The memory plane PM comprises rows and columns of memory cells, eight memory cells Cl,j, C2,j, C3,j, C4,j, Cl,j+1, C2,j+1, C3,j+1, C4,j+1 being represented here. Each memory cell comprises a state transistor, respectively referenced Tl,j, T2,j, T3,j, T4,j, T1,j+1, T2,j+1, T3,j+1, T4,j+1, and a selection transistor ST connected between a source plane SL and the state transistor.

[0223] The memory cells Cl,j, C2,j, C3,j, C4,j belong to a column of rank j and the memory cells Cl,j+1, C2,j+1, C3,j+1, C4,j+1 belong to an adjacent column of rank j+1. The memory cells Cl,j, Cl,j+1 belong to a first row of memory cells, and their state transistors T1,j, Tl,j+1 have control gates CGI connected to a common gate control line CGL1. The memory cells C2,j, C2,j+1 belong to a second row of memory cells, and their state transistors T2,j, T2,j+1 have control gates CG2 connected to a common gate control line CGL2. Memory cells C3,j, C3,j+1 belong to a third row of memory cells, and their state transistors T3,j, T3,j+1 have control gates CG3 connected to a common gate control line CGL3.Memory cells C4,j, C4,j+1 belong to a fourth row of memory cells and their state transistors T4,j, T4,j+1 have control gates CG4 connected to a common gate control line CGL4.

[0224] In the column of rank j, the memory cells Cl,j, C2,j are twin memory cells and their selection transistors ST comprise a common selection gate CSG 1,2 connected to a common word line WL1,2.

[0225] Similarly, the memory cells C3,j, C4,j are twin memory cells and their selection transistors ST comprise a common selection gate CSG3,4 connected to a common word line WL3,4.

[0226] In the column of rank j+1, the memory cells Cl,j+1, C2,j+1 are twin memory cells and their selection transistors ST comprise a common selection gate CSG1,2 connected to the word line WL1,2.

[0227] The memory cells C3,j+1, C4,j+1 are twin memory cells and their selection transistors ST comprise a common selection gate CSG3,4 connected to the common word line WL3,4.

[0228] The common selection gates CSG1,2 or CSG3,4 of the pairs of twin memory cells are buried vertical gates made in the form of conductive trenches made in the substrate, and the source terminals (S) of the selection transistors ST are connected to the buried source plane SL, extending under the region of the substrate where the memory cells are implanted.

[0229] The memory plane PM comprises two bit lines per column of memory cells. Thus, two bit lines Bl,j, B2,j are allocated to the memory cells of the column of rank j, and two bit lines B1,j+1, B2,j+1 are allocated to the memory cells of the column of rank j+1.

[0230] Two twin memory cells are connected to different bit lines among the two bit lines assigned to the column in which they are located, while two adjacent but non-twin memory cells are connected to the same bit line.

[0231] Thus, in the column of rank j:

[0232] - the drain terminal (D) of the state transistor Tl,j is connected to the bit line B1,j by through an AI conductive path,

[0233] - the drain terminal of the state transistor T2,j is connected to the bit line B2,j by via a conductive path 23B,

[0234] - the drain terminal of the state transistor T3,j is connected to the bit line B2,j by via the conductive path 23B (the memory cell C2,j being adjacent but not twinned with the memory cell C3,j), and

[0235] - the drain terminal of the state transistor T4,j is connected to the bit line B1,j by via a 4A conductive path.

[0236] In the column of rank j+1:

[0237] - the drain terminal of the state transistor Tl,j+1 is connected to the bit line B1,j+1 by through an IC conductive path,

[0238] - the drain terminal of the state transistor T2,j+1 is connected to the bit line B2,j+1 by via a 23D conductive path,

[0239] - the drain terminal of the state transistor T3,j+1 is connected to the bit line B2,j+1 by via the conductive path 23D (memory cell C2,j+1 being adjacent but not twinned with memory cell C3,j+1), and

[0240] - the drain terminal of the state transistor T4,j+1 is connected to the bit line Bl,j+1 by via a 4C conductive path. Column and row decoders

[0241] As will be seen below, the various components of the DIS device use column and row decoders to select the memory cells.

[0242] It is possible to use specific column decoders for each constituent. Some of these decoders may have a conventional structure. The column decoder associated with the non-volatile memory DM device has a specific structure.

[0243] This being so, as will be seen in more detail at the end of the description with reference to figures 37 and 38, it is particularly advantageous to provide a single column decoder capable of addressing the different memory planes.

[0244] This makes it possible to simplify the overall architecture of the device and to reduce the footprint on silicon.

[0245] The line decoders are of classic structure.

[0246] The first physically unclonable function module MPF1 and its operation

[0247] We now refer more particularly to Figures 9 to 11 to describe in more detail an example of embodiment of the first physically unclonable function module MPF1 intended to generate the initial unpredictable code RD2.

[0248] As indicated above, the first module MPF1 comprises a first set of memory cells.

[0249] Each memory cell has the characteristics described with reference to [Fig.6].

[0250] The state transistor being of the depletion type ("depletion" in the language English), the normally on character of the state transistor when the memory cell is in a blank state and a zero voltage is applied to the control gate is linked to the value of its threshold voltage in the blank state of the memory cell which can be chosen to be negative or substantially zero.

[0251] The state transistor of a memory cell in the virgin state is here configured to have such a negative threshold voltage, for example of the order of -1 volts.

[0252] All the memory cells of this first set 1 are in a blank state.

[0253] All state transistors of all cells of the first set 1 are intended to have the same threshold voltage.

[0254] That being said, the effective threshold voltages, that is to say the real values ​​of the threshold voltages, vary slightly according to a random dispersion, for example due to physical manufacturing hazards. This type of dispersion is usual and known per se.

[0255] Thus, the transistors of the cells of the first set 1 each have an effective threshold voltage belonging to a common random distribution.

[0256] And this common random distribution is here a distribution of threshold voltages of memory cell transistors in the virgin state which have never been written.

[0257] If we now refer more particularly to [Fig.9], we see that in this advantageous embodiment, the first set 1 of non-volatile memory cells CEL is organized into two first matrix subsets 10L and 10R arranged symmetrically with respect to reading means LECT of conventional structure and known per se, typically comprising sense amplifiers 5.

[0258] All lines or rows of the first two matrix subsets 10L and 10R are parallel.

[0259] The line decoding of each of these two sub-assemblies 10L, 10R is carried out by XDEC line decoders of conventional structure and known per se while the column decoding of these first two sub-assemblies is carried out by two YDEC column decoders, also of conventional structure and known per se, arranged symmetrically with respect to the reading amplifiers 5.

[0260] And, these reading means LECT are configured to carry out differential readings of the effective threshold voltages of the state transistors of the pairs of symmetrical memory cells CELijL and CELijR located respectively in the first two sub-assemblies 10L and 10R on homologous columns of these first two sub-assemblies.

[0261] Reference is now made more particularly to [Fig. 10] to describe a differential reading RD carried out by reading means LECT incorporating the reading amplifiers 5.

[0262] In the example illustrated in [Fig. 10], the reading means LECT are configured to measure the difference between the effective threshold voltages of the pair of state transistors T belonging respectively to the two memory cells CELijL and CELijR.

[0263] The reading means are coupled to the transistors T via the respective bit lines BLL and BLR.

[0264] The selection transistors ST are controlled on their gate by signals carried on the respective word lines WLL and WLR.

[0265] A differential reading RD such as that illustrated in [Fig. 10] is advantageously carried out with the control gates of the state transistors connected to ground.

[0266] The sense amplifier 5 is configured to amplify a difference between the current ICL flowing in the cell CELijL and the current ICR flowing in the cell CELijR.

[0267] These read currents ICL and ICR being representative of the effective threshold voltages of the floating gate transistors of the respective cells CELijL and CELijR, the difference in these currents is representative of the difference between the effective threshold voltages of these state transistors.

[0268] Thus, the reading means LECT are capable of measuring the difference between the effective threshold voltages of the pairs of state transistors of two cells arranged on homologous bit lines.

[0269] And, by way of non-limiting example, it can be decided that if the current ICL is greater than the current ICR, then the data DATAij contained in this pair of cells has a logic value 0 while if the current ICL is less than the current ICR, then this data has a logic value 1.

[0270] Of course, one could have adopted the opposite convention.

[0271] Thus the differential reading RD of the memory cells of the first set 1 provides the initial code RD2.

[0272] Once this RD2 code is generated, it is destroyed for example as illustrated in [Fig.11].

[0273] More precisely, the management means may comprise in this regard MPROG programming means of conventional structure, configured to program the memory cells of the first subset 10L or those of the second subset 10R.

[0274] Thus a subsequent differential reading of the cells of this first set will provide a series of constant values.

[0275] Alternatively, it would be possible to replace the programming means with erasing means of conventional structure configured to erase the memory cells of the first subset 10L or those of the second subset 10R.

[0276] The non-volatile memory device DM and its operation

[0277] Reference is now made more particularly to Figures 12 to 27 to describe in more detail an example of the structure of the non-volatile memory device DM and its operation.

[0278] Such an example is described in the French patent application filed in the name of the Applicant on the same day as the present application and entitled: “Non-volatile memory device readable only a predetermined number of times”.

[0279] Some of its characteristics are recalled here.

[0280] The memory plane structure PM of the memory device DM is a single bit line per column structure as described in [Fig.7].

[0281] [Fig.12] illustrates more precisely two twin cells Mi,j and Mi+l,j belonging to the same column j and to the two rows i and i+1.

[0282] Their drain is connected to the same bit line BLj which is the only bit line for column j.

[0283] Each memory cell has the characteristics described with reference to [Fig.6].

[0284] Each memory cell has a first state, for example an erased state, in which it stores a bit having a first logical value, for example the logical value 1, and a second state, for example a programmed state, in which it stores a bit having a second logical value, for example the logical value 0.

[0285] The state transistor of a memory cell is advantageously configured to be on when the memory cell is in its first state and to be off when the memory cell is in its second state.

[0286] In [Fig. 13], the different threshold voltages Vthe, VthO and Vthp corresponding respectively for example to erased, blank and programmed memory cells are shown schematically.

[0287] In read mode, a zero read voltage can be applied to the control gate CG of the state transistor and a positive voltage can be applied to the bit line BL.

[0288] The state transistor being depletion with a negative voltage VthO, it is normally on for a blank memory cell, i.e. when no charge is present in the floating gate.

[0289] It then emerges from [Fig. 13] that a state transistor of an erased memory cell will be on while the state transistor of a programmed memory cell will be off. And, the fact of applying a zero voltage to the control gate and consequently to the floating gate FG of the state transistor, does not induce read stress.

[0290] Furthermore, the programming or erasure of a floating gate transistor is carried out here by injecting or extracting electrical charges into the gate of the transistor by injecting hot electrons by means of high voltage(s).

[0291] More particularly, the erasure of a memory cell is ensured by combining a positive voltage applied to the substrate with a negative voltage applied to the control gate of its floating gate state transistor.

[0292] As for the twin cell, if we want it not to be simultaneously erased, we apply a positive voltage to the control gate of its state transistor.

[0293] The programming of a memory cell can be ensured for example by applying a positive voltage to the bit line concerned, by applying a zero voltage to the substrate, and a positive voltage on the control gate of its floating gate state transistor.

[0294] The selection of such a memory cell to be programmed is carried out by applying a positive voltage greater than the threshold voltage of the state transistor, on the word line concerned.

[0295] As regards the twin cell, if it is desired that it not be simultaneously programmed, a weakly negative voltage, for example -0.5 Volt or -1 Volt, or zero, is applied to the control gate of its state transistor.

[0296] Finally, as indicated above, the reading of a memory cell is ensured by applying a zero voltage to the control gate CG of its state transistor, as well as a positive voltage to the corresponding bit line.

[0297] The selection of such a memory cell to be read is carried out by applying a positive voltage greater than the threshold voltage of the state transistor, on the word line concerned.

[0298] In practice, in read mode, a zero voltage will be applied to all the cells in the memory plane.

[0299] As a result, two selected twin cells will be read simultaneously.

[0300] And if in addition the column decoder is configured, as will be seen in more detail below, to simultaneously select two adjacent bit lines, the two corresponding pairs of twin cells will be simultaneously read.

[0301] Reference is now made more particularly to Figures 14 to 27 to describe more precisely embodiments and implementations of the memory device DM.

[0302] In [Fig. 14], for the sake of simplification, only one memory zone ZM has been shown and only the operation of this memory zone will be described, it being understood that the structure and operation of the D memory zones ZM1-ZMD of the memory device DM are identical.

[0303] This memory zone ZM here contains a matrix of memory cells Mi,j having two rows or lines L0 and L1 and N columns, here 32 columns.

[0304] In this example, i denotes the row or line index and i is 0 or 1.

[0305] The index j denotes the column index and varies from 0 to 31 in this example.

[0306] The memory area ZM is intended to store information comprising N binary data D0-D31.

[0307] Here we consider that the N binary data D0-D31 are those of the initial code RD2 generated by the first module MPF1.

[0308] The memory device DM also comprises first processing means MTR1 comprising in particular a line decoder DECR, of conventional structure, and configured to deliver voltages on the word line WL0,l as well as on the gate control lines CGL0 and CGL1.

[0309] The processing means also include a DECC column decoder.

[0310] This DECC column decoder here comprises a set of switches SW0-SW31 each comprising two MOS transistors in parallel.

[0311] A first terminal of the switch SWj is connected to the corresponding bit line BLj.

[0312] A second terminal of the switch SWJ is connected either to a read amplifier circuit AMP via a MOS transistor controlled on its gate by a read signal READ or to a programming means PRGL, of conventional structure, via another MOS transistor controlled on its gate by a programming control signal PROG.

[0313] These READ and PROG signals are delivered by the first processing means MTR1 depending on whether the reading phase or the programming phase is in progress.

[0314] As illustrated in [Fig. 14], the column decoder DECC is configured to individually select the two bit lines BL0 and BL31 associated with the two columns located at both ends of the memory area ZM, via the logic signals COLO and COL31.

[0315] Furthermore, the column decoder is also configured to simultaneously select two adjacent bit lines BLj and BLj+1 by the logic signal COLjj + 1.

[0316] This individual selection of the two bit lines BLO and BL31 and the simultaneous selection of two adjacent bit lines is carried out both for the operation of storing the information D0-D31 in the memory cells of the memory area ZM and for the reading operation which, as will be seen in more detail below, involves prior replacements of bits by a reference bit, in this case a bit with logic value 0.

[0317] The logic signals COLO, COL31 and COL jj+1 are delivered by MCC logic means.

[0318] As indicated above, the memory area is intended to store 32 bits of data D0-D31 of the RD2 code.

[0319] And, as illustrated in [Fig.15], prior to the storage of this information (code RD2) in the memory zone ZM, all the memory cells of the memory zone ZM are in an erased state, that is to say they all contain the logical value 1.

[0320] We now refer more particularly to figures 16 to 19 to illustrate the successive writing of the N bits D0-D31 of the information (code RD2) in the memory zone ZM.

[0321] Generally speaking, since the initial state of the memory cells of the memory zone ZM is an erased state, i.e. containing a logical “1”, no operation will be carried out in a memory cell to write data having a logical value of “1”.

[0322] On the other hand, a programming operation of a memory cell will be carried out in the case where the data to be written in this cell is a “0”.

[0323] The voltages to be applied to the bit line, the substrate, the control gate and the word line to select and program a cell have been indicated above.

[0324] Similarly, the voltages to be applied to the bit line, the control gate and the word line to select and read a cell have been indicated above.

[0325] In [Fig. 16], the column decoder DECC selects, using the logic signal COL1, the two bit lines BLO and BL1.

[0326] Furthermore, the grid control line CGL1 is selected.

[0327] As a result, the data D0 is written both in the memory cell M 1,0 and in the memory cell Ml,l.

[0328] Then, as illustrated in [Fig. 17], the column decoder selects the two bit lines BL1 and BL2 using the logic signal COL12.

[0329] Furthermore, this time it is the CGLO grid control line which is selected.

[0330] Consequently, the second data DI of the information is stored simultaneously in the two memory cells MO,2 and MO,3 of the first line LO.

[0331] The write operation then continues sequentially until the last data item D31 of the information is written into the memory cell M0,31.

[0332] This is done by selecting the bit line BL31 by means of the logic signal COL31 and by selecting the gate control line CGLO ([Fig. 18]).

[0333] At the end of this writing operation, we obtain, as illustrated in [Fig. 19], a filling of the memory area in a checkerboard pattern such that a data item, with the exception of the last data item D31, is stored in two adjacent memory cells of the same row and that two successive data items are respectively stored in two twin cells of the same column.

[0334] Furthermore, the twin cell M0,0 of that Ml,0 storing the data D0 stores the value 1 while the last data D31 is stored in the memory cell MO,31 twin of the memory cell Ml,31 storing the data D30.

[0335] We now refer more particularly to Figures 20 to 27 to illustrate an example of reading the information (code RD2) stored in the memory zone ZM.

[0336] Since the zero voltage (GND ground) is applied in reading on the control gates of all the memory cells of the memory area, the reading of a first twin memory cell of a column simultaneously causes the reading of the second twin cell.

[0337] Now, if the first twin cell contains a logical “1”, then this logical “1” will mask the value read from the data located in the second twin cell.

[0338] Indeed, reading these two twin cells will always give a logical “1” regardless of the value of the stored data.

[0339] This is the reason why it is necessary, before reading a memory cell, to replace the value stored in its twin cell with a reference bit chosen so as to allow the correct restitution of the stored data. In this case, this reference bit will have the value "0" which corresponds to a prior programming of the twin cell so as to store a "0" there.

[0340] This is illustrated in [Fig.20].

[0341] More precisely, using the logic signal COL0, the bit line BL0 is selected and, using the line control signal CGLO, the memory cell M0,0 is programmed so as to store a logic “0” there.

[0342] Then, we can proceed to read the two twin cells M0,0 so as to store a logical “0” there.

[0343] Then, we can proceed to read the two twin cells M0,0 and M1,0 still by selecting the bit line BLO using the logic signal COL0, as illustrated in [Fig.21].

[0344] And, this time, the DO data is correctly read.

[0345] Indeed, if the data D0 is equal to 0, then the value 0 will actually be read by the reading amplifier circuit AMP.

[0346] And, if the logical value of the data D0 is equal to 1, then a logical “1” will be read by the sense amplifier circuit AMP.

[0347] We then proceed as illustrated in Figures 22 and 23 to read the data D1.

[0348] And, as this time the column decoder will select the two bit lines BLO and BL1 simultaneously, and the zero voltage GND is applied to the control gates of the state transistors of all the memory cells, there will be a simultaneous reading of the two twin cells located on the column "0" and the two twin cells located on the column "1".

[0349] Also, in order to obtain a correct restitution of the logical value of the data D1, it is necessary, prior to reading this data D1, not only to program the twin cell of the cell D1 with the value “0” but also to program the cell which contained the data D0 previously read.

[0350] This is illustrated in [Fig.22].

[0351] We see that in this preliminary programming step, by the selection of the bit lines BLO and BL1 by the logic signal COL01 and by the application of the programming voltage on the gate control line CGL1, the memory cells Ml,0 and Ml,1 are programmed with the logic value “0”.

[0352] Therefore, as illustrated in [Fig.23], the selection of the two bit lines BLO and BL1 and the application of the zero voltage GND to the control gates of the state transistors lead to simultaneously reading the logic value of the data D1 and the three logic values ​​“0” stored in the memory cells M0,0, M1,0 and M1,1.

[0353] As a result, the logical value of the data D1 is correctly restored. Indeed, if this data is equal to 0, then the reading amplifier circuit will actually read a “0” while if this logical value is equal to 1, the reading amplifier circuit will actually read a “1”.

[0354] It should therefore be noted here that not only does prior programming allow for correct restitution of the data to be read, but this prior programming also destroys the data that has been previously read.

[0355] Figures 24 and 25 illustrate the reading of the following data D2.

[0356] Prior to this reading, programming of cells M0,l and MO,2 ([Fig.24]) then a reading of the data D2 stored in the memory cell Ml,2 ([Fig.25]).

[0357] The DI data has therefore been destroyed.

[0358] Figures 26 and 27 illustrate the reading of the last data D31.

[0359] In this regard, as illustrated in [Fig.26], programming is carried out prior to the twin cell Ml,31 then as illustrated in [Fig.27] to a reading of the cell D31 stored in the memory cell MO,31.

[0360] At the end of this reading, we notice that all the memory cells except the last cell M0,31, store a logical 0.

[0361] Reading the N binary data of the stored RD2 code therefore destroyed all the bits of this code except the last one.

[0362] And, we can therefore no longer read this RD2 code again in the ZM memory zone.

[0363] This being the D zones ZM1-ZMD will be successively read as indicated above for the zone ZM, so as to allow reading of the information RD2 only D times.

[0364] The second physically unclonable function module MPF 2 and its operation

[0365] The second MPF2 module may be a physically unclonable function module having the characteristics of the physically unclonable function device described in the French patent application filed under No. 2002929.

[0366] We now recall certain characteristics.

[0367] As illustrated in [Fig.28], the second MPF2 module comprises a second set 2 of non-volatile memory cells CEL.

[0368] The device DIS also comprises second processing means MT2 configured to deliver the unpredictable code HUK1 from a reading of the effective threshold voltages of the state transistors of the memory cells CEL of the second set 2.

[0369] Each CEL memory cell has the characteristics described with reference to [Fig.6].

[0370] But as illustrated in [Fig.29], the CEL cell comprises a T state transistor having a control gate or control gate CG and a floating gate FG which are here electrically connected for example by means of a via or contact which is not located in the plane of [Fig.29] but which is represented schematically by two dotted lines.

[0371] The floating gate FG is separated from the semiconductor substrate SUB by a gate oxide OX whose thickness is advantageously greater than 8 nanometers, for example between 8 and 10 nanometers.

[0372] The drain D of the state transistor T is connected to a bit line via a contact CBL.

[0373] The control gate CG of the transistor T is connected to a gate control line.

[0374] As indicated above, the channel of the state transistor T comprises a surface-implanted channel CH, for example N-doped, so that the corresponding memory cell operates in a depletion mode.

[0375] In other words, the state transistor T being of the depletion type, the normally on character of the state transistor when the memory cell is in a virgin state and a zero voltage is applied to the control gate is linked to the value of its threshold voltage in the virgin state of the memory cell which can be chosen to be negative or substantially zero.

[0376] In the case of an N-conductivity channel, the implanted dopants may be, for example, arsenic As and the concentration of dopants determines the threshold voltage of the transistor T of a memory cell in the virgin state.

[0377] As for the cells of the first set 1, the state transistor is here configured to have a threshold voltage of a memory cell in the negative virgin state, for example of the order of -1 volts.

[0378] All state transistors of all CEL cells of the first set are intended to have the same threshold voltage.

[0379] That being said, the effective threshold voltages, that is to say the real values ​​of the threshold voltages, vary slightly according to a random dispersion, for example due to physical manufacturing hazards. This type of dispersion is usual and known per se.

[0380] Since the control and floating gates of the state transistors are electrically connected, the state transistors naturally exhibit greater variability in the face of these hazards and therefore a wider distribution.

[0381] Thus, the transistors T of the CEL cells of the second set 2 each have an effective threshold voltage belonging to a common random distribution.

[0382] In particular, the common random distribution may be a distribution of threshold voltages of memory cell transistors in a pristine state that have never been written.

[0383] If we refer again to [Fig.28], we see that the second processing means MT2 comprise a third set 3 of CELM memory cells each also having a selection transistor buried in a substrate semiconductor and a state transistor having a control gate and a floating gate.

[0384] In fact, CELM memory cells are analogous to CEL memory cells except that the floating gates and the control gates of the state transistors are not electrically connected. They also have the characteristics described with reference to [Fig.6].

[0385] As will be seen in more detail below, these CELM memory cells are intended to store reliability information representative of the reliability or unreliability of the contents of the CEL memory cells of the second set 2.

[0386] The second processing means MT2 comprise first generation means MGEN1 configured to generate said reliability information.

[0387] The second processing means MT2 also comprise second generation means MGEN2 configured to generate the code HUK1 at least from readings of the effective threshold voltages of the state transistors of the memory cells CEL and of said reliability information contained in the memory cells CELM of the third set 3.

[0388] We will return in more detail to an example of the structure and operation of the first generation means MGEN1, the second generation means MGEN2 and the matrix arrangement of the second set of cells 3.

[0389] If we now refer more particularly to [Fig. 30], we see that in this advantageous embodiment, the second set 2 of non-volatile memory cells CEL is organized into two second matrix subsets 20L and 20R arranged symmetrically with respect to second reading means LECT2 of conventional structure and known per se, typically comprising sense amplifiers 5.

[0390] All the lines or rows of the two second matrix subsets 20L and 20R are parallel.

[0391] The line decoding of each of these two sub-assemblies 20L, 20R is carried out by XDEC line decoders of conventional structure and known per se while the column decoding of these first two sub-assemblies is carried out by two YDEC column decoders, also of conventional structure and known per se, arranged symmetrically with respect to the reading amplifiers 5.

[0392] And, these second reading means LECT2 are configured to carry out differential readings of the effective threshold voltages of the state transistors of the pairs of symmetrical memory cells CELijL and CELijR or CELmpL and CELmpR and located respectively in the two second sub-assemblies 20L and 20R on homologous columns of these two second sub-assemblies.

[0393] And, the memory cells of the third set 3 are intended to contain the reliability information representative of the reliability or unreliability of the contents of the pairs of memory cells of the second set.

[0394] This reliability information is here binary data having a first logical value, for example the logical value 0, representative of an unreliability of the contents of a given pair of memory cells of the second set or a second logical value, for example the logical value 1, representative of a reliability of the contents of a given pair of memory cells of the second set.

[0395] Thus, as an example, in [Fig.30], the reliability information Mij, here having the logical value 0, is representative of the unreliability of the contents bijL and bijR of the pair of memory cells CELijL and CELijR of the second set.

[0396] On the other hand, the reliability information Mmp which has the logical value 1, is here representative of the reliability of the contents bmpL and bmpR of the pair of memory cells CELmpL and CELmpR of the second set.

[0397] All of this reliability information forms an MSK mask.

[0398] Reference is now made more particularly to [Fig.31] to describe a differential reading RD carried out by second reading means LECT2 incorporating the reading amplifiers 5.

[0399] In the example illustrated in [Fig.31], the second reading means LECT2 are configured to measure the difference between the effective threshold voltages of the pair of state transistors T belonging respectively to the two memory cells CELijL and CELijR.

[0400] The second reading means are coupled to the transistors T via the respective bit lines BLL and BLR.

[0401] The selection transistors ST are controlled on their gate by signals carried on the respective word lines WLL and WLR.

[0402] In addition to the reading amplifiers 5, the second reading means comprise reference current generators 51 which may or may not be connected to the reading amplifiers 5 via switches.

[0403] In the context of a differential reading RD such as that illustrated in [Fig.31], advantageously carried out with the control gates of the state transistors connected to ground, the reference current generators are not connected to the reading amplifiers 5.

[0404] The sense amplifier 5 is configured to amplify a difference between the current ICL flowing in the cell CELijL and the current ICR flowing in the cell CELijR.

[0405] These reading currents ICL and ICR being representative of the effective threshold voltages of the floating gate transistors of the respective cells CELijL and CELijR, the The difference in these currents is representative of the difference between the effective threshold voltages of these state transistors.

[0406] Thus, the second reading means LECT2 are capable of measuring the difference between the effective threshold voltages of the pairs of state transistors of two cells arranged on homologous bit lines.

[0407] And, as a non-limiting example, it can be decided that if the current ICL is greater than the current ICR, then the data DATAij contained in this pair of cells has a logic value 0 while if the current ICL is less than the current ICR, then this data has a logic value 1.

[0408] Of course, one could have adopted the opposite convention.

[0409] Reference is now made more particularly to Figures 32 and 33 to describe differential readings of the effective threshold voltages of the state transistors of the pairs of memory cells taking into account a margin value.

[0410] Here again, these differential readings are advantageously carried out with the control gates of the state transistors connected to ground.

[0411] [Fig.32] illustrates a first RDM0 differential reading taking into account a margin value.

[0412] More precisely, during this RDM0 reading, the additional current IREF generated by one of the current generators 51 is added to the current flowing through the cell CELijR.

[0413] This makes it possible to measure a difference between the effective threshold voltages from a certain margin.

[0414] The margin value corresponds to the IREF current representative of a reference voltage deviation.

[0415] This margin value is chosen in particular according to the precision of the second reading means LECT2.

[0416] As an indication, the value of the IREF current can be equal to 2 microamperes.

[0417] And, in this case, if the current ICL is greater than the sum of the current ICR and the current IREF, then the stored data DATAij is taken equal for example to 0.

[0418] In [Fig.33], another RDM1 differential reading is illustrated, carried out by the second reading means LECT2 and taking into account the margin value.

[0419] More precisely, in this case, the reference current IREF is added to the current ICL flowing in the cell CELijL.

[0420] And, for example, if the current ICR is greater than the sum of the current ICL and the current IREF, then DATAij is equal to 1.

[0421] We now refer more particularly to [Fig.34] to describe an example of the structure of the first generation means MGEN 1 making it possible to generate the reliability information of the MSK mask.

[0422] As illustrated in this [Fig.34], the reliability information is generated by taking into account a margin value on the differential readings RDMO and RDM1 of the effective threshold voltages of the state transistors of the pairs of memory cells.

[0423] More precisely, the first generation means MGEN1 comprise the second reading means LECT2 configured to carry out for each pair of memory cells of the second set 1 a first reading, for example the reading RDMO, of the difference between on the one hand the current flowing through a first memory cell of said pair increased by the reference current representative of said margin value and on the other hand the current flowing through the second memory cell of said pair so as to obtain a first binary data item.

[0424] The second reading means LECT2 are also configured to carry out a second reading, for example the reading RDM1, of the difference between, on the one hand, the current flowing through the second memory cell increased by the reference current and, on the other hand, the current flowing through the first memory cell so as to obtain a second binary data item.

[0425] In the example described here, for the purposes of simplification, a group of 16 first binary data DB1, for example [0000 YES 1111 1111], obtained at the end of the first RDMO reading and a corresponding group of 16 second binary data DB2, for example [0000 0000 0000 1111], obtained at the end of the RDM1 reading, has been represented.

[0426] The generation means MGEN1 also comprise a module, globally referenced by the reference 222, configured to generate and write the MSK mask in the third set 3 of memory cells.

[0427] This module 222 comprises an inverter IV making it possible to invert one of the groups of binary data, for example the group of first binary data DB1 resulting from the RDMO reading, so as to obtain, in the illustrated case, the group [1111 1000 0000 0000],

[0428] Then, comparison means, for example an OR gate referenced PL, make it possible to compare bit by bit the group of second binary data DB2 resulting from the reading RDM1 with the inverse of the group of first binary data DB1 resulting from the reading RDMO.

[0429] If an inverted bit actually has a logical value opposite to that of the corresponding non-inverted bit, then the data can be considered reliable and a 1 can be assigned to the corresponding reliability information, which is obtained by the OR logic gate.

[0430] On the other hand, if the logical value of the inverted bit is equal to the logical value of the corresponding non-inverted bit, then the data is considered unreliable and the corresponding reliability information will have the logical value 0.

[0431] We therefore obtain an MSK mask comprising as many bits as there are pairs of memory cells in the second set 2. In the case illustrated, the MSK mask is equal to [1111 1000 0000 1111],

[0432] Of course it would be possible to replace the inverter and the OR gate with a logic gate of the EXCLUSIVE OR (XOR) type.

[0433] The module 222 also includes PROG writing means, of conventional and known structure, making it possible to write the reliability information (bits) of the MSK mask in the corresponding memory cells of the third set 3.

[0434] Reference is now made more particularly to [Fig.35] to describe an example of the structure of the second generation means MGEN2 configured to generate the code HUK1 from the differential readings of the effective threshold voltages of the state transistors of the pairs of memory cells and the reliability information associated with these pairs of memory cells.

[0435] More precisely, the second reading means LECT2 carry out a conventional differential reading RD of the pairs of homologous memory cells respectively located in the two subsets 20L and 20R so as to obtain a first set of output data JS 1, for example [0000 0000 YES 1111], comprising in this simplified example 16 binary output data.

[0436] This reading is advantageously carried out with the control gates of the state transistors connected to ground.

[0437] Conventional MLCT reading means also comprising reading amplifiers such as the reading amplifiers 5, carry out a conventional RDMSK reading of the MSK reliability information corresponding to the pairs of cells read and contained in the CELM memory cells of the third set 3, for example [1111 1000 0000 1111],

[0438] This RDMSK reading is also advantageously carried out with the control gates of the state transistors connected to ground.

[0439] The second generation means MGEN2 then comprise masking means 4 configured to retain as HUK1 code only the binary data of the set JS1 which are assigned reliability information signifying that the data is reliable, in this case reliability information equal to 1.

[0440] In this case, the data considered reliable (value 1) are the first five bits on the left and the last four bits, the other bits being uncertain (X).

[0441] Therefore, as illustrated in [Fig.35] as an example, the HUK1 code will only have 9 bits out of the 16 in the JS1 set [0000 0XXX XXXX 1111].

[0442] Although not essential, it is preferable as illustrated in [Fig.36] that the third set 3 of memory cells which is intended to store the reliability information, comprises two third subsets 30L and 30R respectively distributed on either side of the second subsets 20L and 20R.

[0443] Furthermore, the reliability information associated with the pairs of memory cells is stored in the memory cells of the third set located on the same columns as those on which said corresponding pairs of memory cells are located.

[0444] Furthermore, the first set 1 of memory cells comprising the two sub-sets 10L and 10R, the second set 2 of memory cells comprising the two sub-sets 20L and 20R, the third set 3 of memory cells comprising the two sub-sets 30L and 30R, the memory plane of the non-volatile memory device DM as well as the management means are located within the same integrated circuit IC.

[0445] This simplifies column decoding and makes it even more difficult to extract data by an attack, for example on the back of the DIS device.

[0446] Column decoder architecture compatible with “single bit line” and “dual bit line” memory plane architectures.

[0447] Due to the disparity in the structure of the different memory planes of the DIS device (one bit line per column architecture for the memory plane of the ZM1-ZMD memory areas, and two bit line per column architecture for the sets 1, 2 and 3 of memory cells), certain metallizations of the integrated circuit are interrupted and are assigned only to certain columns (bit lines) of the memory plane of the ZM1-ZMD memory areas, while other metallizations are common to a column of the memory plane of the ZM1-ZMD memory areas and to a column of the memory planes of the sets 1, 2 and 3, and other metallizations are assigned only to columns of the memory planes of the sets 1, 2 and 3.

[0448] This is partially illustrated in [Fig.37], where we see that an interrupted metallization MET2A corresponds to the bit line BL0 of column 0 referenced COL0 of the memory plane of the memory areas ZM1-ZMD, and that another metallization MET2B corresponds to the bit line BL1 of column 1 COL1 of the memory plane of the memory areas ZM1-ZMD as well as to one B 1,0 of the bit lines of column 0 COL0 of the memory planes of sets 1, 2 and 3.

[0449] The other bit line B2,0 of column 0 COL0 of the memory planes of sets 1, 2 and 3 is materialized by the metallization MET3.

[0450] Two other MET5 metallizations correspond to the two bit lines B 1,1 and B2,1 of column 1 COL1 of the memory planes of sets 1, 2 and 3.

[0451] Thus, as illustrated schematically in [Fig.38], certain columns of the memory plane of the memory zones ZM1-ZMD are individually addressable, in this case the even-ranked columns, COL0, COL2,.....

[0452] The odd-rank columns COL1, COL3,... of the memory plane of the memory zones ZM1-ZMD can be addressed simultaneously to the columns of rank 4k, COL0, COL4, .... of the memory planes of sets 1, 2 and 3.

[0453] The columns of ranks 4k+l, 4k+2 and 4k+3, COL1, COL2, COL3, COL5, COL6, COL7,.... of the memory planes of sets 1, 2 and 3 are individually addressable.

[0454] A single COLDEC column decoder, shown schematically in [Fig.38], is configured to -individually select the two columns located at the two ends of each ZMi memory zone, -simultaneously select two adjacent columns from each memory zone ZMi and a column from the first, second and third sets common to one of these two adjacent columns, and -individually select the other columns of the first, second and third sets.

[0455] This column decoder comprises switches based on MOS transistors, controlled on their grid by control signals and whose sources are connected to a common node ND connected to reading or programming means.

[0456] Here for the purpose of simplification only 10 switches SW0-SW9 are shown controlled by control signals SCO, SCA to SCJ.

[0457] The SCO signal which controls the switch SW0 makes it possible to individually select the COL0 column of the ZMi memory zones.

[0458] The SCA signal which controls the switches SW0 and SW1 makes it possible to select the COL0 column of the memory cell sets 1, 2 and 3 as well as simultaneously the COL0 and COL1 columns of the ZMi memory zones.

[0459] The signal SCB which controls the switches SW1 and SW5 makes it possible to select the column COL0 of the sets of memory cells 1, 2 and 3 as well as simultaneously the columns COL1 and COL2 of the memory zones ZMi.

[0460] The SCC signal which controls the switch SW2 makes it possible to select the COL1 column of the memory cell sets 1, 2 and 3.

[0461] The SCD signal which controls the switch SW3 makes it possible to select the COL2 column of the memory cell sets 1, 2 and 3.

[0462] The SCE signal which controls the switch SW4 makes it possible to select the COL3 column of the memory cell sets 1, 2 and 3.

[0463] The SCF signal which controls the switches SW5 and SW6 makes it possible to select the COL4 column of the memory cell sets 1, 2 and 3 as well as simultaneously the COL2 and COL3 columns of the ZMi memory zones.

[0464] The signal SCG which controls the switches SW6 and another switch not shown in this figure for the sake of simplification makes it possible to select the column COL4 of the sets of memory cells 1, 2 and 3 as well as simultaneously the columns COL3 and COL4 of the memory zones ZMi.

[0465] The SCH signal which controls the switch SW7 makes it possible to select the COL5 column of the memory cell sets 1, 2 and 3.

[0466] The SCI signal which controls the switch SW8 makes it possible to select the COL6 column of the memory cell sets 1, 2 and 3.

[0467] The SCJ signal which controls the SW9 switch allows the selection of the COL7 column of the memory cell sets 1, 2 and 3, and so on....

Claims

Claims

1. Integrated device with a physically unclonable function, comprising a first physically unclonable function module (MPF1), internal to the device (DIS), configured to generate an initial data group (RD2) and management means (MGST), internal to the device, at least configured to -generate an output data group (HUK2) from at least the initial data group (RD2), -authorize only D successive deliveries of the output data group (HUK2) on a first output interface (INST1) of the device, D being a non-zero positive integer, and -prevent any new generation of the output data group (HUK2).

2. Device according to claim 1, wherein the management means (MGST) are configured to prevent any new generation of the output data group (HUK2) by preventing any new generation of the initial data group (RD2).

3. Device according to one of the preceding claims, in which the first module (MPF1) comprises - a first set (1) of non-volatile memory cells each having a selection transistor buried in a semiconductor substrate and a state transistor, preferably of the depletion type, having a control gate and a floating gate, the state transistors having respective effective threshold voltages belonging to a common random distribution, and - reading means (LECT) configured to deliver the group of initial data from a reading of the effective threshold voltages of the state transistors of the memory cells of said first set.

4. Device according to claim 3, in which the first set (1) of non-volatile memory cells is organized into two first matrix subsets (10L; 10R) arranged symmetrically with respect to the reading means, all the lines of the two first matrix subsets being parallel, and - the reading means (LECT) are configured to carry out said reading comprising differential readings of the effective threshold voltages of the state transistors of the pairs of symmetrical memory cells and located respectively in the two first sub- sets on homologous columns of these first two subsets.

5. Device according to claims 2 and 4, in which the management means (MGST) are configured to program or erase the memory cells of one of the two subsets after reading the initial data group, so as to prevent any new generation of the initial data group.

6. Device according to one of the preceding claims, in which the group of initial data (RD2) comprises G initial data and the management means (MGST) comprise a non-volatile memory device (DM) comprising - a memory plane comprising D memory areas (ZM1-ZMD), each memory area being configured to store a succession of N data including the G initial data, N being greater than or equal to G, and - first processing means (MTR1) configured to successively extract the N data from the D memory areas of the memory means and to destroy at least part of the content of the corresponding memory area during the extraction of the N corresponding data.

7. Device according to claim 6, wherein each memory area (ZMi) includes a matrix of memory cells having two rows and N columns, each memory cell comprising a state transistor having a control gate and a floating gate, selectable by a vertical selection transistor buried in a substrate and having a buried selection gate, each column of memory cells including a pair of twin memory cells, the two selection transistors of a pair of twin memory cells having a common selection gate, and the first processing means (MTR1) are configured to store in the memory area the succession of N bits so that, with the exception of the last bit of the succession,a current bit of said succession is stored in two memory cells located on the same row and on two adjacent columns and a current bit and the following bit are respectively stored in two twin cells.,

8. Device according to claim 7, in which the first processing means (MTR1) are configured to, in order to be able to read a bit stored in a first twin cell, replace beforehand the bit stored in the second twin cell by a reference bit having a reference value chosen to allow correct restitution of the value of the bit stored in the first twin cell.

9. Device according to claim 8, in which the first processing means (MTR1) are further configured to sequentially read the N bits of said succession and replace a current bit already read of said information with the reference bit before being able to read the following bit of said succession, so as to destroy said current bit when extracting said following bit.

10. Device according to one of claims 6 to 9, in which the memory cell matrix of each memory zone (ZMi) comprises a single bit line per column, connected to the drains of the state transistors of the pair of twin cells of the corresponding column, and a gate control line, per row of memory cells, connected to all the control gates of the state transistors of the memory cells of the corresponding row.

11. Device according to one of claims 6 to 10, in which the first processing means (MTR1) comprise a column decoder configured to individually select the two bit lines associated with the two columns located at the two ends of the memory area and to simultaneously select two adjacent bit lines, both for the operation of storing the succession of N bits and for the operation of reading and prior replacement of the bits.

12. Device according to one of claims 6 to 11, in which the output data group (HUK2) comprises the N bits of said succession.

13. Device according to one of claims 1 to 12, in which the management means (MGST) comprise - a second physically unclonable function module (MPF2) configured to generate a group of additional data (HUK1), and - development means (MLB) configured to develop the group of output data (HUK2) from at least the group of initial data (RD2) and at least the group of additional data (HUK1).

14. Device according to claim 13, in which the management means (MGST) are further configured to deliver on a second output interface (INST2) of the device the additional data group (HUK1).

15. Device according to claim 13 or 14, wherein the second physically unclonable function module comprises (MPF2): - a second set (2) of non-volatile memory cells each having a selection transistor buried in a semiconductor substrate and a depletion-type state transistor having an electrically connected control gate and floating gate, the state transistors having respective effective threshold voltages belonging to a common random distribution, and - second processing means (MT2) configured to deliver the group of additional data (HUK1) from a reading of the effective threshold voltages of the state transistors of the memory cells of said second set.

16. Device according to claim 15, in which - the second processing means (MT2) comprise second reading means (LECT2) configured to carry out said reading, - the second set (2) of non-volatile memory cells is organized into two second matrix subsets (20L; 20R) arranged symmetrically with respect to the second reading means, all the lines of the two second matrix subsets being parallel, and - the second reading means (LECT2) are configured to carry out said reading comprising differential readings of the effective threshold voltages of the state transistors of the pairs of symmetrical memory cells and located respectively in the two second subsets on homologous columns of these two second subsets.

17. Device according to claim 15 or 16, in which the second processing means (MT2) comprise a third set (3) of memory cells (CELM) each having a selection transistor buried in a semiconductor substrate and a state transistor, preferably of the depletion type, having a control gate and a floating gate, the memory cells of the third set being intended to contain reliability information. (MSK) representative of the reliability or unreliability of the contents of the pairs of memory cells of the second set.

18. Device according to claim 17, in which the third set (3) comprises a matrix arrangement of memory cells sharing the same columns as those of the matrix arrangement of memory cells of the second set (2).

19. Device according to one of claims 17 or 18, in which the second processing means (MT2) comprise first generation means (MGEN1) configured to generate said reliability information by taking into account a margin value on the differential readings of the effective threshold voltages of the state transistors of the pairs of memory cells of the second set.

20. Device according to one of claims 15 to 19 taken in combination with claim 17, in which the second processing means (MT2) comprise second generation means (MGEN2) configured to generate said group of additional data at least from the differential readings of the effective threshold voltages of the state transistors of the pairs of memory cells of the second set, and from said reliability information of these pairs of memory cells.

21. Device according to one of the preceding claims, taken in combination with claims 3, 15 and 17, in which the first set (1) of memory cells, the second set (2) of memory cells and the third set (3) of memory cells each have an architecture comprising two bit lines per column of memory cells, the columns of memory cells comprising pairs of twin memory cells, the two selection transistors of a pair of twin memory cells having a common selection gate, two adjacent twin memory cells of the same column not being connected to the same bit line and two adjacent non-twin memory cells of the same column being connected to the same bit line.

22. A device according to claims 10 and 21, wherein some columns of the non-volatile memory device (DM) are common with some columns of the first, second and third sets, and the management means (MGST) comprise a single column decoder (COLDEC) configured to -individually select the two bit lines associated with the two columns located at the two ends of each memory area, -simultaneously select two adjacent bit lines and a bit line from the first, second and third sets common to one of these two adjacent bits, and -individually select the other bit lines from the first, second and third sets.

23. Method for automatically generating a unique unpredictable code (HUK2) at said first output interface of a physically unclonable function device (DIS) according to one of claims 1 to 22 taken in combination with claim 6, comprising a power-up of the device (DIS) and at least one reading of a memory area of ​​the non-volatile memory device.

24. Method according to claim 23, further applicable to the device according to claim 15, further comprising a reading of the effective threshold voltages of the state transistors of the memory cells of said second set, the control gates of the state transistors of these memory cells being connected to ground during said reading, and a development of the unique unpredictable code (HUK2) from the content of the memory area read and the group of additional data (HUK1) obtained from said reading.

25. Method for producing a physically unclonable function device (DIS) according to claims 5, 6 and 19, comprising producing the device within an integrated circuit, and during a test phase of the integrated circuit, - generating the initial data group (RD2), - storing said information of N data in the D memory areas, - programming or erasing a part of the memory cells of the first set after generating the initial data group, generating and storing reliability information (MSK).

Images