Semiconductor equipment

Abstract

Protect semiconductor devices from glitch attacks (FIA). [Solution] The semiconductor device has a semiconductor chip comprising a power-on controller POC, multiple detection circuits FIA1a to FIA1f, a detection controller FIAC, various peripheral circuits PERI, and a system controller SYSC. After power is supplied to the semiconductor chip by the power-on controller POC, the detection controller FIAC sequentially transfers detection data in a loop from the multiple detection circuits FIA1a to FIA1f. The comparison circuit compares the detection data with reference data, and if the detection data and reference data do not match, it sends error data DTe indicating unauthorized access to the system controller SYSC. When the system controller SYSC receives the error data DTe, it disconnects from the various peripheral circuits PERI.

Description

Technical Field

[0001] The present invention relates to a semiconductor device, for example, to a semiconductor device equipped with a processor.

Background Art

[0002] "4.6 FAULT.DOUBLECHECK" in Non-Patent Document 1 discloses a method of implementing countermeasures against glitch attacks (FIA: Fault Injection Attack) by software. Specifically, it discloses a method of performing a double check on the identity of data read at a certain point in time and data read after a fixed period of time using software when using important data.

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] For example, in a semiconductor device equipped with a processor or the like, in other words, a semiconductor chip, data is transferred between a plurality of circuits in the chip at the time of reset transfer, at the time of chip activation, at the time of processor activation, and the like.

[0005] On the other hand, one method of glitch attack (FIA) is to invert important data, such as the security protection status. If such a glitch attack occurs during data transfer, for example, the security protection status may change, allowing unauthorized control of the semiconductor chip, potentially leading to the alteration or leakage of important data. As a countermeasure against glitch attacks, a method of using software for double-checking is known, as shown in Non-Patent Literature 1. However, this method can be applied after the processor has started up and the software is ready to run, but it cannot detect glitch attacks at all times. Therefore, there is a need for a technology that can detect glitch attacks at all times. Furthermore, since data is transferred between multiple circuits in a semiconductor chip, there is a need for a technology that can detect glitch attacks at multiple locations.

[0006] The embodiments described later were made in view of these considerations, and other issues and novel features will become apparent from the description and accompanying drawings of this specification. [Means for solving the problem]

[0007] In one embodiment, after power is supplied to the semiconductor chip by the power-on controller, the detection controller sequentially transfers detection data in a loop to multiple detection circuits. The comparison circuit compares the detection data stored in the first register with the reference data stored in the second register. If the detection data and the reference data do not match, it sends error data indicating unauthorized access to the system controller. When the system controller receives the error data, it disconnects the connection to the peripheral circuits. [Effects of the Invention]

[0008] According to one embodiment, a semiconductor device can be protected from unauthorized access, such as glitch attacks (FIAs). [Brief explanation of the drawing]

[0009] [Figure 1] Figure 1 is a block diagram showing a schematic configuration example of the main parts of a semiconductor device according to the first embodiment. [Figure 2] Figure 2 is a schematic diagram showing an example of the arrangement of the detection circuit on a semiconductor chip. [Figure 3] Figure 3 shows a more detailed example of the detection circuit configuration. [Figure 4] Figure 4 is a schematic diagram showing an example of connections between detection circuits. [Figure 5] Figure 5 shows an example of a flip-flop circuit configuration. [Figure 6] Figure 6 shows an example of the arrangement of the detection unit and the error generation unit. [Figure 7] Figure 7 shows the graphs superimposed on each other. [Figure 8] Figure 8 shows an example of the output from the error generation unit. [Figure 9] Figure 9 is a timing chart showing an example of the timing of glitch attack detection. [Figure 10] Figure 10 is a flowchart showing an example of a process for monitoring whether a detection controller has been subjected to a glitch attack. [Figure 11] Figure 11 shows the range over which the detection controller monitors and controls. [Figure 12] Figure 12 is a block diagram showing a schematic configuration example of the main parts of a semiconductor device according to a second embodiment. [Figure 13] Figure 13 is a schematic diagram showing an example configuration of the detection unit and the error generation unit. [Figure 14] Figure 14 shows an example of a combinational circuit configuration. [Figure 15] Figure 15 shows the graphs of voltage value changes shown in Figure 13 superimposed on each other. [Figure 16] Figure 16 is a block diagram showing a schematic configuration example of the main parts of a semiconductor device according to the third embodiment. [Figure 17] Figure 17 shows an example of the arrangement of the detection unit on a semiconductor chip. [Figure 18]FIG. 18 is a diagram showing a configuration example of a detection unit and an error generation unit according to the fourth embodiment. [Figure 19] FIG. 19 is a block diagram showing a schematic configuration example for adjusting the performance of a detection circuit. [Mode for Carrying Out the Invention]

[0010] In the following embodiments, when necessary for convenience, the description will be divided into a plurality of sections or embodiments, but unless otherwise specified, they are not irrelevant to each other, and one is in a relationship of a modification, detail, supplementary explanation, or the like of part or all of the other. Further, in the following embodiments, when referring to the number of components (including the count, numerical value, quantity, range, and the like), the number is not limited to the specific number, and may be equal to or larger than, or equal to or smaller than the specific number, unless otherwise specified or the number is apparently limited to the specific number in principle.

[0011] Furthermore, in the following embodiments, it goes without saying that constituent elements (including element steps and the like) are not necessarily essential, unless otherwise specified or apparently considered to be essential in principle. Similarly, in the following embodiments, when referring to the shapes, positional relationships, and the like of constituent elements and the like, these shall include those substantially approximate to or similar to the relevant shapes and the like, unless otherwise specified or apparently considered to be otherwise in principle. This also applies to the aforementioned numerical values and ranges.

[0012] Further, circuit elements constituting each functional block of the embodiments are not particularly limited, but are formed on a semiconductor substrate such as single crystal silicon by a known integrated circuit technology such as CMOS (complementary metal-oxide-semiconductor transistor).

[0013] Hereinafter, the embodiments will be described in detail with reference to the drawings. Note that in all the drawings for describing the embodiments, members having the same function are denoted by the same reference numerals, and repeated description thereof will be omitted. Further, in the following embodiments, description of the same or similar parts will not be repeated in principle unless particularly necessary.

[0014] (First Embodiment) <Overview of Semiconductor Device> Figure 1 is a block diagram showing a schematic configuration example of the main parts of a semiconductor device according to the first embodiment. As shown in Figure 1, the semiconductor device according to the first embodiment has a semiconductor chip CHP such as an SoC (System on Chip) on which a plurality of circuits are formed. The plurality of circuits include a power-on controller POC, a processor PRC, a reset data transfer controller RDTC, a memory controller MEMC, various peripheral circuits PERI, an external port controller EXPC, a test circuit TEC, and a system controller SYSC. Furthermore, the plurality of circuits include a detection controller FIAC and detection circuits FIA1a to FIA1f.

[0015] The various peripheral circuits (PERI) include a variety of circuits depending on the functions required of the semiconductor device, such as communication interface circuits with the outside of the chip, analog-to-digital converters, and digital-to-analog converters. The system controller (SYSC) controls the power-on controller (POC), processor (PRC), memory controller (MEMC), reset data transfer controller (RDTC), various peripheral circuits (PERI), external port controller (EXPC), test circuit (TEC), and detection controller (FIAC). In this way, the system controller (SYSC) controls, for example, the operation sequence of the entire semiconductor chip (CHP).

[0016] The Power-On Controller (POC) releases the reset state of the entire semiconductor chip CHP in response to power being supplied to the CHP or to a reset signal from an external reset terminal. The Processor (PRC) is, for example, a CPU (Central Processing Unit), and may also include a GPU (Graphics Processing Unit) and a DSP (Digital Signal Processor).

[0017] The memory controller MEMC includes a memory unit MEMU, a register unit REGU, and a comparator circuit CMP. The memory controller MEMC primarily controls access to the memory unit MEMU or the register unit REGU. The memory unit MEMU includes, for example, a first memory MEMU1a, a volatile memory RAM such as SRAM (Static Random Access Memory), and a non-volatile memory NVM such as MRAM (Magnetoresistive RAM) or flash memory. The register unit REGU includes a main register REGm and sub-registers REGs.

[0018] Non-volatile memory (NVM) stores, for example, programs. These programs are copied from the non-volatile memory (NVM) to the volatile memory (RAM). The processor (PRC) executes the programs copied to the volatile memory (RAM). The first memory (MEMU1a) consists of a non-volatile memory that can only be written to once, in other words, cannot be rewritten, such as a fuse ROM (Read Only Memory) or an OTP (One Time Programmable) ROM. The first memory (MEMU1a) pre-stores the data necessary for initializing the semiconductor chip (CHP), i.e., the initial setup data.

[0019] Initial setup data includes important data representing security protection status, etc. Specifically, initial setup data may include protection bit settings for commands and protection bit settings for boot firmware, i.e., values ​​that determine whether protection is enabled or disabled. The reset data transfer controller RDTC performs a data transfer from the memory unit MEMU to the register unit REGU, i.e., a reset transfer, when the semiconductor chip CHP starts up.

[0020] The reset data transfer controller RDTC transfers the data stored in the first memory MEMU1a, i.e., the initialization data, to the main register REGm or sub-register REGs in N data transfers, which is an integer greater than or equal to 2. The reset data transfer controller RDTC generates a random number for the value of N, which is the number of data transfers.

[0021] Here, the data DTm transferred to the main register REGm is referenced during the initial setup of the semiconductor chip CHP, for example, by the processor PRC, the system controller SYSC, etc. On the other hand, the sub-registers REGs are provided to verify the data DTm of the main register REGm. That is, the comparator circuit CMP in the memory controller MEMC determines whether the data DTm transferred to the main register REGm matches or does not match the data DTs transferred to the sub-registers REGs. The comparator circuit CMP then outputs a judgment result signal RS, which represents the judgment result, to the system controller SYSC.

[0022] The external port controller (EXPC) controls ports that can communicate with external devices. Multiple external port controllers (EXPC) may be present. An example of an external port controller (EXPC) is an I / O port controller.

[0023] The detection controller FIAC controls detection circuits FIA1a through FIA1f. For example, the detection controller FIAC instructs detection circuits FIA1a through FIA1f to start and stop operations sequentially. The detection controller FIAC also executes a process to transfer detection data sequentially from detection circuit FIA1a through FIA1f. In this case, the detection controller FIAC creates new detection data each time the transfer of detection data is repeated. When new detection data is created, the detection controller FIAC sets the expected values ​​EXV1a through EXV1f, described later, to the same value as the newly created detection data. In other words, new detection data is created and expected values ​​are set each time the detection data loop is performed.

[0024] Detection circuit FIA1a is a circuit that detects unauthorized access. In this embodiment, unauthorized access will be described as a glitch attack (FIA: Fault Injection attack). Detection circuits FIA1b through FIA1f are similar circuits that detect glitch attacks, respectively.

[0025] Figure 2 is a schematic diagram showing an example of the arrangement of detection circuits FIA1a to FIA1f on the semiconductor chip CHP. Detection circuits FIA1a to FIA1f are each positioned at different locations on the semiconductor chip CHP.

[0026] For example, as shown in Figure 2, the semiconductor chip CHP has a system controller SYSC, peripheral circuits PERI_A and PERI_B, an external port controller EXPC, a test circuit TEC, and a memory controller MEMC. In this case, detection circuits FIA1a to FIA1f are positioned between these other circuits. This allows the semiconductor chip CHP to detect glitch attacks at various locations across the entire surface of the substrate where multiple circuits are located.

[0027] Furthermore, in this embodiment, after power is supplied to the semiconductor chip CHP by the power-on controller POC, detection data is sequentially transferred in a loop from the detection circuit FIA1a to the detection circuit FIA1f.

[0028] In this embodiment, the explanation describes a case where six detection circuits, from detection circuit FIA1a to detection circuit FIA1f, are provided, but the number of detection circuits is not limited to this. Detection circuits can be provided at any desired location on the semiconductor chip CHP where glitch attacks are to be detected. By providing detection circuits in many locations, the security level of the semiconductor chip CHP can be improved.

[0029] As shown in Figure 1, the detection circuit FIA1a comprises a register REGD1a (first register), an expected value EXV1a (second register), and a comparator circuit CMP1a. Register REGD1a stores detection data for detecting glitch attacks. Expected value EXV1a stores reference data for determining whether or not an FIA has been detected. Expected value EXV1a is, for example, a fixed value. Expected value EXV1a may also be a variable value, for example, transferred from non-volatile memory NVM when the semiconductor chip CHP is started.

[0030] The comparison circuit CMP1a compares the detection data with the reference data. More specifically, the comparison circuit CMP1a compares the detection data stored in register REGD1a with the reference data stored in expected value EXV1a. If the detection data and the reference data do not match, the comparison circuit CMP1a sends error data DTe, indicating a glitch attack, to the system controller SYSC. When the system controller SYSC receives the error data DTe, it disconnects connections to various peripheral circuits such as PERI. Details of these processes will be described later.

[0031] Figure 3 shows a more detailed configuration example of the detection circuit FIA1a. The detection circuit FIA1a comprises a detection unit FIAD and an error generation unit FIAG. The detection unit FIAD includes a register REGD1a. The error generation unit FIAG includes an expected value EXV1a and a comparison circuit CMP1a. Detection circuits FIA1b to FIA1f have a similar configuration. Therefore, a detailed explanation of detection circuits FIA1b to FIA1f is omitted. Note that the data stored in expected value EXV1a to expected value EXV1f are reference data of the same value.

[0032] As shown in Figures 1 and 2, detection circuits FIA1a through FIA1f are configured to sequentially transfer detection data in a loop. For example, detection data is transferred from detection circuit FIA1a to detection circuit FIA1b. Then, detection data is transferred from detection circuit FIA1b to detection circuit FIA1c. This process is repeated, and finally, detection data is transferred from detection circuit FIA1f to detection circuit FIA1a. Then, detection data is transferred again from detection circuit FIA1a to detection circuit FIA1b. In the semiconductor chip CHP, after the power-on controller POC is started up, detection data is configured to be transferred in a loop from detection circuit FIA1a to detection circuit FIA1f.

[0033] Next, we will explain examples of connections between detection circuits. Figure 4 is a schematic diagram showing an example of the connection between detection circuit FIA1a and detection circuit FIA1b. The connection examples between other detection circuits are similar.

[0034] As shown in Figure 4, the register REGD1a included in the detection circuit FIA1a contains multiple flip-flop circuits (FFs). Similarly, the register REGD1b included in the detection circuit FIA1b contains multiple flip-flop circuits (FFs). The multiple flip-flop circuits (FFs) are connected by wiring in a one-to-one relationship. In this embodiment, the detection data is 32 bits. Therefore, a number of flip-flop circuits (FFs) capable of transmitting 32 bits of data are provided.

[0035] The wiring from register REGD1a to register REGD1b should be routed as widely as possible across the semiconductor chip CHP. This makes it possible to route the wiring between detection circuits FIA1a and FIA1f across the entire surface of the semiconductor chip CHP.

[0036] If a glitch attack FIA occurs in either the wiring between detection circuit FIA1a and detection circuit FIA1b during the transfer of detection data, the detection data will become corrupted. The data stored in the register REGD1b of detection circuit FIA1b will change from, for example, "H'A55A_5AA5" to "H'A55F_FAA5" (see Figure 9), as described later.

[0037] Next, we will describe a configuration that increases the detection sensitivity of the glitch attack FIA in each of the detection circuits FIA1a to FIA1f. First, we will explain the case where the configuration example of the flip-flop FF included in the register is changed. Figure 5 is a diagram showing an example of the configuration of the flip-flop circuit FF.

[0038] As shown in Figure 5, the flip-flop circuit FF includes transistor sections TR1 and TR2 that form latches. Transistor sections TR1 and TR2 are arranged side by side between power supply lines VL11 and VL12, respectively. Transistor section TR1 includes multiple transistors, namely transistors TRN11 to TRN14. Transistor section TR2 includes multiple transistors, namely transistors TRN21 to TRN24.

[0039] Transistors TRN11 through TRN14 are arranged in a first and second column between power lines VL11 and VL12, which receive power from an external power supply. Transistors TRN11 and TRN13 are located in the first column. Transistors TRN12 and TRN14 are located in the second column. Similarly, for transistors TRN21 through TRN24, transistors TRN21 and TRN23 are located in the first column. Transistors TRN22 and TRN24 are located in the second column.

[0040] Here, transistors TRN11 and TRN21, located in the first column closest to power line VL11, and transistors TRN14 and TRN24, located in the second column closest to power line VL12, are configured such that their gate length L to gate width W ratio (L / W) is larger than that of the other transistors TRN12, TRN13, TRN22, and TRN23. In other words, within a single transistor section TR1, TR2, transistors with a large gate length L to gate width W ratio are arranged in intersecting directions, or in other words, in an alternating pattern.

[0041] Therefore, the voltage in transistors TR1 and TR2 tends to become unstable. In other words, the noise immunity of transistors TR1 and TR2 is weakened. The graph in Figure 5 shows that when subjected to a glitch attack FIA, the change in voltage value becomes large. Therefore, transistors TR1 and TR2 can have a high detection sensitivity for glitch attacks FIA.

[0042] Next, we will describe an example configuration in which the FIA ​​detection unit and the error generation unit FIAG are arranged in a specific way. Figure 6 shows an example arrangement of the detection unit FIAD and the error generation unit FIAG.

[0043] As shown in Figure 6, the detection unit FIAD and the error generation unit FIAG are located between power lines VL11 and VL12. Furthermore, the error generation unit FIAG is located in a region where the power supply V is reinforced (first region), and the detection unit FIAD is located in a region where the power supply V is not reinforced (second region). In other words, the error generation unit FIAG is located in the first region where power supply fluctuations are small, and the detection unit FIAD is located in the second region where power supply fluctuations are large. Reinforcing the power supply V can be done, for example, by increasing the area of ​​the wiring to which the power is supplied or by increasing the number of wires.

[0044] Figure 6 shows graphs V11 to V14 illustrating the changes in voltage values. Graphs V11 and V21 show the changes in voltage values ​​along power line VL11, while graphs V12 and V22 show the changes in voltage values ​​along power line VL12. Graphs V11 and V12 show the changes in voltage values ​​at the error generation unit FIAG. Graphs V21 and V22 show the changes in voltage values ​​at the detection unit FIAD.

[0045] Figure 7 shows the superimposed state of graphs V11, V12, V21, and V22. In graphs V11 and V12, the fluctuation range of the voltage values ​​is small. On the other hand, in graphs V21 and V22, the fluctuation range of the voltage values ​​is large.

[0046] Figure 8 shows an example of the output of the error generation unit FIAG. Signals IN0, IN1, and IN2 in Figure 8 are shown in Figure 6. In Figure 6, signal IN0 is the signal to the first flip-flop circuit (first FF). Signal IN1 is the signal from the first flip-flop circuit (first FF) to the second flip-flop circuit (second FF) and the comparator circuit CMP. The comparator circuit CMP is one of comparator circuits CMP1a to CMP1f. Signal IN2 is the signal from the second flip-flop circuit (second FF) to the comparator circuit CMP.

[0047] If a glitch occurs in signal IN0 due to a power supply fluctuation in the detection unit FIAD, and its timing coincides with the rising edge of the clock CLK, the first flip-flop circuit (first FF) of the detection unit FIAD latches the glitch state as signal IN1. Furthermore, in the next clock CLK cycle, the second flip-flop circuit (second FF) transfers the state of signal IN1, i.e., the glitch state, to the comparator circuit CMP as the state of signal IN2. The comparator circuit CMP then outputs the EXOR of signal IN1 and signal IN2 as a signal. With this configuration, the error generation unit FIAG can detect, based on the voltage fluctuation, that a misconfiguration has been induced in the first flip-flop circuit (first FF), i.e., that it has been subjected to a glitch attack, by outputting the EXOR.

[0048] For example, if the first glitch attack FIA shown in Figure 8 is received, the state of signal IN1 becomes "0" when signal IN0 is captured as "1". By taking the EXOR of the state of signal IN1 ("0") and the state of signal IN2 ("0"), the output of the EXOR becomes "1". As a result, the error generation unit FIAG can detect that a glitch attack has occurred. The same applies when the second glitch attack FIA is received.

[0049] As explained using Figures 7 to 9, a second region with large voltage fluctuations is created where power lines VL11 and VL12 are vulnerable and no intentional decoupling capacitors are placed. The detection unit FIAD is placed in this second region. The error generation unit FIAG is placed in the first region where power lines VL11 and VL12 are strengthened and the voltage fluctuations are small. This makes it possible to further improve the detection sensitivity of glitch attack FIA. Note that the vulnerable region of power lines VL11 and VL12 can be identified, for example, using CAD, and if there is no vulnerable region, a vulnerable region can be created through design.

[0050] Figure 9 is a timing chart showing an example of the timing of glitch attack detection. In Figure 9, the processing of detection circuit FIA1a to detection circuit FIA1f is arranged from top to bottom. The horizontal axis is time. Here, the detection data is assumed to be 32-bit data of "H'A55A_5AA5". The reference data stored in expected value EXV1a to expected value EXV1f is also assumed to be "H'A55A_5AA5". Here, we will explain using the processing flow shown from step S10 to step S40 of the processing that transfers the detection data shown in Figure 9 as an example.

[0051] As shown in Figure 9, for example, if the detection data and the reference data match, the detection circuit FIA1a transfers the detection data "H'A55A_5AA5" to the detection circuit FIA1b based on the control of the detection controller FIAC (S10).

[0052] The detection circuit FIA1b compares the transferred detection data "H'A55A_5AA5" with the expected value EXV1b "H'A55A_5AA5". Since they match, the detection circuit FIA1b does not send error data DTe to the system controller SYSC. Also, based on the control of the detection controller FIAC, the detection circuit FIA1b sends the detection data "H'A55A_5AA5" to the detection circuit FIA1c (S20).

[0053] The detection circuit FIA1c compares the transmitted detection data "H'A55A_5AA5" with the expected value EXV1c "H'A55A_5AA5". Since they match, the detection circuit FIA1b does not send error data DTe to the system controller SYSC. Also, based on the control of the detection controller FIAC, the detection circuit FIA1c transmits the detection data "H'A55A_5AA5" to the detection circuit FIA1d (S30).

[0054] Next, the detection circuit FIA1d compares the transmitted detection data "H'A55F_FAA5" with the expected value EXV1b "H'A55A_5AA5". Here, the detection data has changed from "H'A55A_5AA5" to "H'A55F_FAA5". This means that a glitch attack FIA occurred during the transfer of the detection data from the detection circuit FIA1c to the detection circuit FIA1d. The detection data "H'A55F_FAA5" and the reference data "H'A55A_5AA5" do not match. Therefore, the detection circuit FIA1d sends error data DTe to the system controller SYSC (S40). As a result, the system controller SYSC can detect that a glitch attack FIA has occurred.

[0055] Note that while Figure 9 illustrates the case where the detection data is 32 bits, this is not the only option. For example, the number of bits in the detection data may be changed depending on manufacturing variations, acceptable noise immunity, and target sensitivity. For instance, in the case of a semiconductor chip CHP with low manufacturing variations, the number of bits may be less than 32 bits. This allows the number of bits in the detection data to be adjusted according to manufacturing variations, acceptable noise immunity, and target sensitivity.

[0056] Next, the operation of the semiconductor chip CHP will be explained using Figures 1 and 10. Figure 10 is a flowchart showing an example of the process by which the detection controller FIAC monitors whether or not it has been subjected to a glitch attack.

[0057] As shown in Figure 10, when the power-on controller POC turns on the power of the semiconductor chip CHP (S100), power is supplied to the semiconductor chip CHP. After the power supply voltage stabilizes, the system controller SYSC sends a start command to the detection controller FIAC (S110). This starts up the detection controller FIAC.

[0058] Next, the detection controller FIAC starts transferring the detection data (S120). The detection data can be stored, for example, within the detection controller FIAC. Based on the control of the detection controller FIAC, the detection circuits FIA1a to FIA1f operate sequentially in a loop. This executes the data transfer process for detection described in Figure 9 above.

[0059] While the transfer process for detection data is being performed, the system controller SYSC determines whether or not a glitch attack FIA has been detected based on the data transmitted from the comparison circuit CMP1a to CMP1f (S130). More specifically, the detection controller FIAC determines whether or not error data DTe has been received each time it is determined whether or not the detection data and reference data match in the detection circuits FIA1a to FIA1f. If it is determined that error data DTe has not been received (S130: NO), the transfer process of detection data by the detection controller FIAC continues.

[0060] On the other hand, if it determines that it has received error data DTe (S130: YES), the system controller SYSC executes connection disconnection processing (S140). More specifically, the system controller SYSC disconnects the connections between the various peripheral circuits PERI, the external port controller EXPC, and the test circuit TEC.

[0061] While the process of monitoring the glitch attack FIA, as explained in Figure 10, is being executed, the reset data transfer controller RDTC and the memory controller MEMC also start operating. When the power-on controller POC powers on the semiconductor chip CHP (S100), the first memory MEMU1a starts up (S150).

[0062] A reset transfer start / completion notification is sent between the reset data transfer controller RDTC and the system controller SYSC (S160). The reset data transfer controller RDTC transfers data to the memory unit MEMU. In the memory unit MEMU, the first data transfer is performed from the first memory MEMU1a to the main register REGm, and subsequent data transfers are performed N times to the sub-registers REGs. The data transferred to the main register REGm is also transferred to various peripheral circuits PERI (S170).

[0063] The comparison circuit CMP compares the data transferred to the main register REGm with the data transferred to the sub-registers REGs. If the two sets of data do not match, the comparison circuit CMP sends a determination result signal RS to the system controller SYSC (S180). As a result, the system controller SYSC performs connection disconnection processing. More specifically, the system controller SYSC disconnects the connections between the various peripheral circuits PERI, the external port controller EXPC, and the test circuit TEC (S140).

[0064] After data is transferred from the main register REGm to the various peripheral circuits PERI, the system controller SYSC instructs the reset data transfer controller RDTC and the memory controller MEMC to initialize (S190). After the initialization of the memory controller MEMC, a loop process is executed in which the reset data transfer is redone. When the reset data transfer controller RDTC notifies the system controller SYSC of the completion of the reset data transfer, the system controller SYSC instructs the various peripheral circuits PERI to start up (S200). Next, the system controller SYSC instructs the processor PRC to start up (S210).

[0065] Figure 11 shows the scope within which the detection controller FIAC performs FIA monitoring and control. The detection controller FIAC can continuously perform FIA monitoring and control after the power-on process of the power-on controller POC. For example, the detection controller FIAC can perform FIA monitoring and control during any of the following processes: reset transfer process, memory controller MEMC startup process, and processor PRC startup process.

[0066] As explained above, the detection controller FIAC can detect glitch attack FIAs before important data is destroyed by continuously monitoring and controlling FIAs after power-on processing. Furthermore, the detection controller FIAC can disconnect the connection as soon as it detects a glitch attack FIA. This prevents important data from leaking outside the semiconductor chip CHP. In addition, the semiconductor chip CHP can be prevented from malfunctioning, thereby improving security.

[0067] If a glitch attack FIA is detected, the system controller SYSC may suspend the system clock. This prevents the corruption of important data stored in main registers such as REGm.

[0068] By arranging multiple detection circuits (detection circuits FIA1a to FIA1f) at different locations across the entire surface of the semiconductor chip CHP, the detection controller FIAC can improve the detection accuracy of glitch attack FIA.

[0069] The above embodiment describes the processing in the event of a glitch attack FIA, but this technology can also be applied to the detection of power line and ground line failures. This enables the system controller SYSC to perform pre-detection of power line and ground line failures. Furthermore, this technology can also be applied to the detection of MRAM failures. More specifically, by applying this technology to the memory element portion of the MRAM, in other words, by using an element sensitive to magnetic fields as a detection circuit for detecting glitch attack FIA, the semiconductor chip CHP can detect data failures (data inversion) of the MRAM caused by an external magnetic field.

[0070] (Second Embodiment) The second embodiment differs from the first embodiment in that it is configured so that detection data is not transferred between detection circuits.

[0071] Figure 12 is a block diagram showing a schematic configuration example of the main parts of a semiconductor device according to the second embodiment. As shown in Figure 12, the semiconductor device according to the second embodiment is configured such that each detection circuit FIA2a to FIA2f compares detection data and reference data using a comparison circuit (CMP2a to CMP2f). Therefore, compared to the case in Figure 1, the process of transferring detection data in step S130 becomes unnecessary.

[0072] Figure 13 is a schematic diagram showing an example configuration of the detection unit FIAD and the error generation unit FIAG. As shown in Figure 13, the detection unit FIAD is located in the first region where the voltage fluctuation range is large, and the error generation unit FIAG is located in the second region where the voltage fluctuation range is small. The detection unit FIAD is composed of a combinational circuit CBC. An example of a combinational circuit CBC is, for example, a buffer.

[0073] Figure 14 shows an example of the configuration of a combinational circuit CBC. The combinational circuit CBC is composed of multiple transistors, for example, four transistors TRN31 to TRN34.

[0074] Transistors TRN31 through TRN34 are arranged in a first and second column between power lines VL11 and VL12, which receive power from an external power supply. Transistors TRN31 and TRN33 are located in the first column. Transistors TRN32 and TRN34 are located in the second column.

[0075] Here, transistor TRN31, located in the first column closest to power line VL11, and transistor TRN34, located in the second column closest to power line VL12, are configured such that their gate length L to gate width W ratio (L / W) is larger than that of the other transistors TRN32 and TRN33. In other words, the four transistors TRN31 through TRN34 are arranged in intersecting directions, or in other words, alternately, so that their gate length L to gate width W ratio is larger.

[0076] Figure 15 shows the superimposed graphs V11, V12, V21, and V22, which show the voltage value changes shown in Figure 13. Graphs V11 and V12 show the voltage value changes in the error generation unit FIAG, while graphs V21 and V22 show the voltage value changes in the detection unit FIAD. As shown in Figure 15, the voltage value changes are larger in graphs V21 and V22 than in graphs V11 and V12. In other words, the voltage value changes are larger in the detection unit FIAD, which is composed of the combinational circuit CBC.

[0077] With this configuration, the voltage of the combinational circuit CBC tends to become unstable, and its noise immunity weakens. Therefore, when subjected to a glitch attack FIA, the voltage value changes significantly. Thus, the detection unit FIAD can have a high detection sensitivity for the glitch attack FIA.

[0078] In the second embodiment, the following operations are performed. After power is supplied to the semiconductor chip CHP by the power-on controller POC, the detection controller FIAC sequentially operates the detection circuits FIA2a to FIA2f. The comparator circuit CMP2a compares the detection data stored in the combinational circuit CBC2a (first register) with the reference data stored in the expected value EXV2a (second register). If the detection data and the reference data do not match, the comparator circuit CMP2a sends error data DTe indicating that a glitch attack FIA (unauthorized access) has occurred to the system controller SYSC. Comparator circuits CMP2b to CMP2f perform similar operations. When the system controller SYSC receives the error data DTe, it disconnects connections to various peripheral circuits such as PERI (S140).

[0079] Furthermore, in the second embodiment, there is no need to provide wiring for transferring detection data to other detection circuits. Therefore, compared to the first embodiment, the semiconductor chip CHP of the second embodiment can reduce the wiring occupancy rate within the semiconductor chip CHP.

[0080] In the second embodiment, the case in which the detection unit FIAD is composed of combinational circuits CBC2a to CBC2f was described, but it is not limited to this. For example, the detection unit FIAD may be configured to have a capacitive element between the power supply V and the intermediate potential. Alternatively, for example, the capacitive element may be connected to ground. Furthermore, when this technology is applied to MRAM, instead of combinational circuits CBC2a to CBC2f, a memory with an element size that is sensitive to magnetic fields may be provided.

[0081] (Third embodiment) The third embodiment differs from the first and second embodiments in that the detection unit FIAD, which has the combinational circuit CBC described in the second embodiment, is arranged throughout the semiconductor chip CHP, and the signals transmitted from each detection unit FIAD are compared by a single comparison circuit.

[0082] Figure 16 is a block diagram showing a schematic configuration example of the main components of a semiconductor device according to the third embodiment. As shown in Figure 16, the semiconductor device according to the third embodiment is configured to compare detection data and reference data transmitted from detection units FIAD3a and FIAD3f, respectively, using a comparison circuit CMP3. Therefore, compared to the configuration in Figure 1, the process of transferring detection data in step S130 is unnecessary, similar to the configuration in Figure 2.

[0083] Figure 17 shows an example of the arrangement of the detection unit FIAD on the semiconductor chip CHP. As shown in Figure 17, detection units FIAD3a to FIAD3f are scattered across the entire surface of the semiconductor chip CHP. Detection unit FIAD3a consists of a combinational circuit CBC3a. The same applies to the other detection units FIAD3b to FIAD3f. The signal IN1 from the first flip-flop circuit (first FF) is input from detection unit FIAD3a to detection unit FIAD3f. Detection units FIAD3a to FIAD3f each output the signal that has passed through the combinational circuit (CBC3a to CBC3f) and input it to the error generation unit FIAG. The error generation unit FIAG performs an OR logic operation using the input output signal. The result of the operation is then output to the system controller SYSC. The result of the operation is, for example, whether or not the error data DTe is generated. If the error data DTe is sent to the system controller SYSC, the system controller SYSC can detect that a glitch attack FIA has occurred.

[0084] Even with this configuration, the same effects as the second embodiment can be achieved. Furthermore, the number of error generation units FIAG can be reduced to one. Therefore, the semiconductor chip CHP of the third embodiment can reduce the area on which the error generation units FIAG are arranged.

[0085] (Fourth embodiment) The fourth embodiment differs from the second and third embodiments in that the power supplies for the detection unit and the error generation unit are separated.

[0086] Figure 18 shows an example configuration of the detection unit and the error generation unit. As shown in Figure 18, the detection unit FIAD is powered by an external power supply Vcc. Power supply Vcc is, for example, 5.0V. On the other hand, the error generation unit FIAG is connected to power supply Vcc via a power regulator LDO (Low Drop Out). Power supply Vcc is, for example, 3.3V. Therefore, the error generation unit FIAG is supplied with power supply Vdd, which is lower than power supply Vcc. Since power supply Vdd is generated by the power regulator LDO, it is less affected by transient fluctuations in the external power supply Vcc. In this way, the error generation unit FIAG is located in a region with small voltage fluctuations (first region), and the detection unit FIAD is located in a region with large voltage fluctuations (second region).

[0087] When the power supplies for the detection unit FIAD and the error generation unit FIAG are separated in this way, a potential difference is created between the detection unit FIAD and the error generation unit FIAG. To adjust this potential difference, a level shifter LS is placed between the detection unit FIAD and the error generation unit FIAG. This allows the potential difference between the detection unit FIAD and the error generation unit FIAG to be adjusted.

[0088] In this fourth embodiment of the semiconductor chip CHP, a power regulator LDO is provided between the internal and external power supply Vcc, adjusting the fluctuation range of the power supply Vcc's voltage value to supply power at a voltage lower than that of the power supply Vcc. The detection unit FIAD in the first region receives power from the external power supply Vcc. The error generation unit FIAG in the second region (first and second flip-flop circuits FF and comparator circuit CMP) receives power from the power regulator LDO.

[0089] Therefore, the influence of fluctuations in the voltage value supplied from the power supply can be reduced during processing in the error generation unit FIAG. As a result, the accuracy of the error generation unit FIAG in detecting power supply fluctuations when subjected to a glitch attack FIA can be improved.

[0090] (Fifth embodiment) The fifth embodiment differs from the first embodiment in that it allows the performance of the detection circuit to be adjusted.

[0091] Figure 19 is a block diagram illustrating a schematic configuration example for adjusting the performance of the detection circuit. As shown in Figure 19, the semiconductor chip CHP comprises a detection controller FIAC, a detection circuit FIA1, a system controller SYSC, and a non-volatile memory NVM. Other components of the semiconductor chip CHP are not shown. Although only one detection circuit FIA1 is shown, there are multiple detection circuits, such as detection circuits FIA1a to FIA1f, as shown in Figure 1.

[0092] The non-volatile memory (NVM) stores level data (LVD), which serves as the reference data. The LVD includes detection level data, which sets the detection level for glitch attacks (FIAs), and notification level data, which sets the notification level for when a glitch attack (FIAs) has occurred. The detection level is set, for example, by the user evaluating the semiconductor chip (CHP) using a test circuit (TEC). The user then stores the optimal value extracted from the evaluation results as level data (LVD) in the NVM.

[0093] After the power-on controller POC supplies power to the semiconductor chip CHP, the detection controller FIAC reads level data LVD from the non-volatile memory NVM. The detection controller FIAC selects data corresponding to the flip-flop circuits FF of the detection circuit FIA1. For example, the type, number, and numerical value (i.e., the initial value of the flip-flop circuits) of flip-flop circuits with different detection capabilities are selected. This sets the detection level in the event of a glitch attack FIA. For example, the detection level setting data SET1 and the detection level setting data SET2 are set in different flip-flop circuits FF (second register).

[0094] Next, the detection controller FIAC switches the switch SW (second register) to the notification level corresponding to the level data read. The notification level is, for example, an error or a warning. If error data DTe is notified, the system controller SYSC executes the blocking process in step S140 described above. If warning data DTw is notified, the system controller SYSC executes a process to start dedicated software. After the detection level and notification level are set in the detection circuit FIA1, the monitoring process for the glitch attack FIA described above is started.

[0095] It is conceivable that the performance of the detection circuit FIA1 may vary due to manufacturing variations. According to the semiconductor chip CHP of the fifth embodiment, the detection level and notification level can be adjusted according to the performance of the detection circuit FIA1 when powered on. In other words, the semiconductor chip CHP can digitally vary the detection accuracy of the detection circuit FIA1. Therefore, the semiconductor chip CHP can compensate for manufacturing variations in detection accuracy so that it is appropriate, and it is also possible to take measures against false detections.

[0096] Although the present invention has been specifically described above based on embodiments, it goes without saying that the present invention is not limited to the above embodiments and can be modified in various ways without departing from its essence. [Explanation of Symbols]

[0097] CHP semiconductor chip CMP,CMP1a-CMP1f,CMP2a-CMP2f,CMP3 comparison circuit DTE Error Data EXPC External Port Controller EXV1a-EXV1f Expected Value FIA1a-FIA1f, FIA2a-FIA2f detection circuit FIAD, FIAD3a-FIAD3f detection unit FIFG Error Data Generation Unit FIAC detection controller MEMU1a First Memory MEMC memory controller MEMU (Memory Unit) PERI various peripheral circuits POC Power-On Controller PRC Processor RDTC Reset Data Transfer Controller REGD1a-REGD1f Registers REGU Register Unit REGm Main Register REGs sub-registers SYSC System Controller TRN11-TRN14, TRN21-TRN24, TRN31-TRN34 Transistors

Claims

1. A semiconductor device having a semiconductor chip on which multiple circuits are formed, The aforementioned multiple circuits are A power-on controller that controls the power supply to the semiconductor chip, Multiple detection circuits for detecting unauthorized access, A detection controller that controls the plurality of detection circuits, Peripheral circuits and, A system controller that controls the aforementioned peripheral circuits, Equipped with, The detection circuit is A first register that stores detection data for detecting the unauthorized access, A second register for storing reference data, A comparison circuit for comparing the detection data with the reference data, Including, After power is supplied to the semiconductor chip by the power-on controller, the detection controller sequentially transfers the detection data to the plurality of detection circuits in a loop. The comparison circuit compares the detection data stored in the first register with the reference data stored in the second register, and if the detection data and the reference data do not match, it transmits error data indicating that unauthorized access has occurred to the system controller. When the system controller receives the error data, it disconnects from the peripheral circuit. Semiconductor equipment.

2. A semiconductor device according to claim 1, The first register includes a plurality of transistors, The plurality of transistors are arranged in a first and second row between a first power supply line and a second power supply line that receive power from an external power source. The transistor in the first row closest to the first power supply line and the transistor in the second row closest to the second power supply line have a larger ratio of gate length to gate width than the other transistors. Semiconductor equipment.

3. A semiconductor device according to claim 2, The second register and the comparison circuit are provided in the first region where the external power supply is enhanced. The first register is located in the second region where the external power supply is not enhanced. The first register is composed of a combinational circuit. Semiconductor equipment.

4. A semiconductor device according to claim 2, The system further includes a power regulator between the external power supply and the first power line that adjusts the fluctuation range of the power supply's voltage value to supply power at a voltage lower than the power supply's voltage value. The first register receives power from the external power supply, The second register and the comparison circuit receive power from the power regulator. Semiconductor equipment.

5. A semiconductor device according to claim 1, The system further comprises a non-volatile memory in which the aforementioned reference data is stored, After the power-on controller supplies power to the semiconductor chip, the detection controller reads the reference data from the non-volatile memory and stores the reference data in the second register. Semiconductor equipment.

6. A semiconductor device according to claim 5, The aforementioned reference data includes detection level data for setting the detection level for the unauthorized access and notification level data for setting the notification level for the unauthorized access. Semiconductor equipment.

7. A semiconductor device according to claim 1, The plurality of detection circuits are arranged at different locations on the semiconductor chip. Semiconductor equipment.

8. A semiconductor device according to claim 1, The aforementioned unauthorized access was due to a glitch attack. Semiconductor equipment.

9. A semiconductor device according to claim 1, It further includes an external port controller that controls ports capable of communicating with external devices, When the system controller receives the error data, it disconnects the connection to the external port controller in addition to the peripheral circuits. Semiconductor equipment.

10. A semiconductor device having a semiconductor chip on which multiple circuits are formed, The aforementioned multiple circuits are A power-on controller that controls the power supply to the semiconductor chip, Multiple detection circuits for detecting unauthorized access, A detection controller that controls the plurality of detection circuits, Peripheral circuits and, A system controller that controls the aforementioned peripheral circuits, Equipped with, The detection circuit is A first register that stores detection data for detecting the unauthorized access, A second register for storing reference data, A comparison circuit for comparing the detection data with the reference data, Including, The detection controller, after power is supplied to the semiconductor chip by the power-on controller, sequentially operates the plurality of detection circuits. The comparison circuit compares the detection data stored in the first register with the reference data stored in the second register, and if the detection data and the reference data do not match, it transmits error data indicating that unauthorized access has occurred to the system controller. When the system controller receives the error data, it disconnects from the peripheral circuit. Semiconductor equipment.

Images