Methods and mechanisms for secure data sharing

Abstract

An electronic device manufacturing system configured to receive requests for manufacturing process data via a first computing system. This system further retrieves manufacturing process data from a data store using a first encryption key controlled by a first entity and a second encryption key controlled by a second entity, and a database management system. The system further retrieves the manufacturing process data stored in the data store using the database management system. The manufacturing process data is encrypted. This system further transmits the encrypted manufacturing process data to a second computing system configured to perform one or more anonymization operations on this manufacturing process data.

Description

Technical Field

[0001] This disclosure relates to electrical components, and more particularly, to methods and mechanisms for secure data sharing in a manufacturing system.

Background Art

[0002] Products can be produced by executing one or more manufacturing processes using manufacturing equipment. For example, semiconductor manufacturing equipment can be used to produce semiconductor devices (e.g., substrates) through semiconductor manufacturing processes. The manufacturing equipment can execute an etching process to deposit multiple layers of films on the surface of the substrate and form complex patterns on the deposited films via process tools according to process recipes. For example, the manufacturing equipment can execute a chemical vapor deposition (CVD) process to deposit alternating layers on the substrate. Sensors can be used to determine the manufacturing parameters of the manufacturing equipment during the manufacturing process, and measurement devices can be used to determine the characteristic data of the products produced by the manufacturing equipment, such as the thickness of the entire layer on the substrate.

[0003] x Tool data (from process tools) can be collected, for example, through a data collection plan (DCP). In some systems, multiple different algorithms and machine learning models can use tool data for specific purposes such as data analysis, predictive operations, and corrective operations. [[ID=z17]]

Summary of the Invention

[0004] The following is a simplified summary of the present disclosure to provide a basic understanding of some aspects of the present disclosure. This summary is not an extensive overview of the present disclosure. It is not intended to identify the main or important elements of the present disclosure, nor to delineate the scope of specific embodiments or claims of the present disclosure. Its sole purpose is to present some concepts of the present disclosure in a simplified form as a prelude to the more detailed description presented later.

[0005] In one aspect of the present disclosure, an electronic device manufacturing system is provided, configured to receive requests for manufacturing process data via a processor in a first computing system. The processor further decrypts a database management system configured to retrieve data from a data store using a first key, which is managed by a first entity. The processor further decrypts the database management system using a second key, which is managed by a second entity. The processor further retrieves the manufacturing process data from the data store, which is encrypted. The processor further transmits the encrypted manufacturing process data to a second computing system configured to perform one or more anonymization operations on the manufacturing process data.

[0006] In another aspect of the present disclosure, an electronic device manufacturing system is provided, configured to receive requests for manufacturing process data via a processor in a first computing system. The system further requests a database management system to retrieve the manufacturing process data from a data store, using a first cryptographic key controlled by a first entity and a second cryptographic key controlled by a second entity. The system further retrieves the manufacturing process data stored in the data store using the database management system. The manufacturing process data is encrypted. The system further transmits the encrypted manufacturing process data to a second computing system configured to perform one or more anonymization operations on the manufacturing process data.

[0007] In another aspect of this disclosure, an electronic device manufacturing system is provided, configured by a processor in a first computing system to receive first encrypted data from a second computing system and second encrypted data from a third computing system. The system is further configured to obtain first decrypted data by decrypting the first encrypted data using a first key, which is part of a first public-key-private key pair managed by the second computing system. The system is further configured to obtain second decrypted data by decrypting the second encrypted data using a second key, which is part of a second public-key-private key pair managed by the third computing system. The system is further configured to obtain output data by performing one or more anonymization operations on the first and second decrypted data. The system is further configured to encrypt the output data using a third key and transmit the encrypted output data to at least one of the second or third computing systems.

[0008] Further aspects of this disclosure include methods according to any aspect or embodiment described herein.

[0009] Further aspects of this disclosure include a non-temporary computer-readable storage medium containing instructions that, when executed by a processing unit operably coupled to memory, perform operations according to any aspect or embodiment described herein.

[0010] This disclosure is shown in the attached drawings as an example, not as an limitation. [Brief explanation of the drawing]

[0011] [Figure 1] This block diagram shows an exemplary system architecture according to some embodiments of the present disclosure. [Figure 2] This is a schematic top view of an exemplary manufacturing system according to some embodiments of the present disclosure. [Figure 3] This block diagram shows an exemplary predictive architecture according to some embodiments of the present disclosure. [Figure 4A] This figure shows an exemplary field service server architecture according to some embodiments of the present disclosure. [Figure 4B] This figure shows an exemplary field service server architecture according to some embodiments of the present disclosure. [Figure 5] This table shows exemplary examples of cryptographic key relationships according to some embodiments of this disclosure. [Figure 6A] This figure shows how a normalization device generates synthetic data according to some embodiments of the present disclosure. [Figure 6B] Another figure illustrating how a normalization device generates synthetic data, according to some embodiments of this disclosure. [Figure 6C] This figure provides a more detailed view of the graph sections of Figures 6A and 6B according to some embodiments of the present disclosure. [Figure 7] This is a flowchart illustrating a method for obtaining data requested from a field service server according to the aspects of this disclosure. [Figure 8] This is a flowchart of a method for anonymizing data obtained from a field service server according to the aspect of this disclosure. [Figure 9] This block diagram shows an exemplary architecture of a multi-entity data source according to some embodiments of the present disclosure. [Figure 10] A block diagram showing a computer system according to a specific embodiment. [Modes for carrying out the invention]

[0012] This specification describes techniques relating to methods and mechanisms for secure data sharing in manufacturing systems. A manufacturing system may include multiple process chambers. A process chamber may have multiple subsystems that operate during each substrate manufacturing process (e.g., deposition, etching, polishing, etc.). A subsystem can be characterized as a set of sensors and control devices related to the operating parameters of the process chamber. Operating parameters may include temperature, flow rate, pressure, etc. For example, a pressure subsystem may be characterized by one or more sensors that measure gas flow, chamber pressure, control valve angle, foreline (vacuum line between pumps) pressure, pump speed, etc. Thus, a process chamber may include a pressure subsystem, a flow rate subsystem, a temperature subsystem, and so on.

[0013] A process chamber can execute each substrate manufacturing process according to a process policy. A process policy defines a specific set of operations performed on the substrate during the process and may include one or more settings associated with each operation. A process policy can be embodied as a table of policy settings, including a set of input or policy parameters ("parameters") and processes that are manually entered by a user (e.g., a process engineer) to achieve a set of target characteristics (e.g., characteristics on the substrate), also called a set of objectives. For example, a deposition process policy may include a temperature setting for the process chamber, a pressure setting for the process chamber, and a flow rate setting for the precursor material contained in the film deposited on the substrate surface. Thus, the thickness of each film layer, the depth of each etching, etc., can be correlated with these process chamber settings.

[0014] A manufacturing system can collect system data for maintenance, analysis, and prediction techniques performed by one or more evaluation systems (e.g., machine learning models, inference engines, heuristic models, algorithms, physics-based engines, etc.). For example, each subsystem may suffer degradation and deviate from optimal performance conditions. In the pressure subsystem, for instance, a pressure drop may occur due to one or more of the following: pump problems, control valve problems, etc. If these degradation conditions are overlooked and not repaired, it can lead to defects in the circuit board, resulting in substandard products, reduced manufacturing yield, and significant downtime and increased repair time.

[0015] In some systems, the strategies related to the substrate manufacturing process, the sensor and measurement data obtained from the substrate manufacturing, and the evaluation system used to analyze the obtained data are each proprietary and owned by different entities (for example, the strategies and sensor data are owned by the customer, and the evaluation system is owned by the service provider). With growing concerns about data privacy, entities have strengthened security measures related to their data. However, the evaluation system needs to receive and analyze sensor and measurement data in order to improve the manufacturing process, and as a result, proprietary data may be unintentionally lost.

[0016] The aspects and embodiments of this disclosure address these and other shortcomings of existing technologies by providing a system capable of performing secure data sharing. In particular, the system may include a field service server (FSS) and an anonymization device server (hereinafter, anonymization device). Data generated by manufacturing equipment during the substrate manufacturing process (e.g., sensor data) can be encrypted and stored in a data store managed by the FSS. The FSS may be configured to allow joint management and operation by two entities, such as a customer and a service provider. Each entity may hold an encryption key for specific components of the server.

[0017] In an exemplary example, manufacturing process data may be encrypted by a service provider using, for example, the public key of a public-private key pair. The private key, which can be used to decrypt the manufacturing process data, may be held by an anonymizer. The anonymizer may be operated by a third entity. Access to the encrypted manufacturing process data may require permission from both the service provider and the customer. For example, a database management system configured to store, retrieve, and query a data store may be encrypted by both the service provider and the customer. In particular, the database management system may be first encrypted with a public key held by the customer, and then re-encrypted with a public key held by the service provider. Each of the service provider and the customer may grant permission to retrieve the encrypted manufacturing process data (via the database management system) by decrypting the database management system using their respective private keys.

[0018] A service provider can manage applications used to provide data analysis, predictive operations, corrective operations, etc. In response to requests for manufacturing process data by an application, both entities (e.g., a customer and a service provider) can enable access to encrypted manufacturing process data by decrypting a database management system. Then, the encrypted manufacturing process data can be sent to an anonymization device to remove confidential information (e.g., secret data, proprietary data, etc.). In particular, the anonymization device can decrypt the encrypted manufacturing process data (e.g., via a secret key) and execute one or more of a heuristic-based approach, a machine learning-based approach, a k-source anonymity-based approach, an algorithm-based approach, etc. to remove confidential data. Then, the anonymization device can normalize the data and convert the data into a normalized data set such that the normalized data set retains certain characteristics from the original data without revealing actual output values. Then, the normalized data can be sent to an application, and the application can use the data to perform data analysis, predictive operations, and / or corrective operations.

[0019] Aspects of the present disclosure provide technical advantages that enable secure data sharing between two entities associated with a manufacturing system. In one example, aspects of the present disclosure can enable an application to use anonymized data to provide diagnostic data. Thereby, diagnostic data can be generated without risking compromising highly confidential, customer-proprietary data in the manufacturing system as a result.

[0020] FIG. 1 shows an exemplary computer system architecture 100 according to an aspect of the present disclosure. In some embodiments, the computer system architecture 100 can be included as part of a manufacturing system for processing substrates. The computer system architecture 100 includes a client device 110, a manufacturing apparatus 124, a prediction system 160 (e.g., which performs generation of prediction data, provision of adaptation and modification of models, use of a knowledge base, etc., which will be described in detail in FIG. 3), a data store 140, and an anonymization device 150. The manufacturing apparatus 124 can include a sensor 126 configured to capture data of substrates being processed in the manufacturing system. In some embodiments, the manufacturing apparatus 124 and the sensor 126 can be part of a sensor system that includes a sensor server (e.g., a field service server (FSS) 145) and a sensor identifier reader (e.g., a radio frequency identification (RFID) reader for a front opening unified pod (FOUP) for a sensor system). In some embodiments, the measurement device 128 can be part of the computer system architecture 100 that includes a measurement server (e.g., a measurement database, a measurement folder, etc.) and a measurement identifier reader (e.g., a FOUP RFID reader for a measurement system).

[0021] The manufacturing apparatus 124 can operate according to a policy or over a period of time to produce products such as electronic devices. The manufacturing apparatus 124 can include a process chamber. The manufacturing apparatus 124 can perform a process on a substrate (e.g., a wafer, etc.) in the process chamber. Examples of substrate processes include a deposition process of depositing one or more layers on the surface of the substrate, an etching process of forming a pattern on the surface of the substrate, and the like. The manufacturing apparatus 124 can execute each process according to a process policy. The process policy can define a specific series of operations performed on the substrate during the process and can include one or more settings associated with each operation. For example, the deposition process policy can include a temperature setting of the process chamber, a pressure setting of the process chamber, a flow rate setting of a precursor of a material included in the film deposited on the substrate surface, and the like.

[0022] In some embodiments, the manufacturing apparatus 124 includes sensors 126 configured to generate data associated with a substrate being processed in the manufacturing system 100. For example, the process chamber may include one or more sensors configured to generate spectral or non-spectral data associated with the substrate before, during, and / or after a process (e.g., a deposition process, an etching process, etc.) is performed on the substrate. In some embodiments, the spectral data generated by the sensors 126 may indicate the concentration of one or more materials deposited on the surface of the substrate. Sensors 126 configured to generate spectral data associated with the substrate may include reflectance sensors, ellipsometry sensors, thermal spectral sensors, capacitive sensors, and the like. Sensors 126 configured to generate non-spectral data associated with the substrate may include temperature sensors, pressure sensors, flow sensors, voltage sensors, and the like. For example, each sensor 126 may be a temperature sensor, pressure sensor, chemical detection sensor, chemical composition sensor, gas flow sensor, motion sensor, position sensor, optical sensor, or any other type of sensor. Some or all of the sensor 126 includes a light source for generating light (or any other electromagnetic radiation), which can be directed at a target such as a component of the machine 100 or a substrate, or a film deposited on the substrate, and the light reflected from the target can be detected. The sensor 126 can be placed anywhere within the manufacturing apparatus 124 (e.g., in any chamber including the loading station, on one or more robots, on robot blades, between chambers, etc.), or even outside the manufacturing apparatus 124 (where the sensor can inspect ambient temperature, pressure, gas concentration, etc.). Further details regarding the manufacturing apparatus 124 are provided with reference to Figure 2.

[0023] In some embodiments, sensor 126 provides sensor data (e.g., sensor values, features, trace data) associated with the manufacturing apparatus 124 (e.g., associated with the manufacturing apparatus 124 producing corresponding products such as substrates). The manufacturing apparatus 124 can produce products by performing operations according to a policy or over a period of time. Sensor data received over a period of time (e.g., corresponding to at least part of a policy or operation) may be called trace data (e.g., past trace data, current trace data, etc.) received from different sensors 126 over time. Sensor data may include one or more values ​​from among temperature (e.g., heater temperature), spacing (SP), pressure, high-frequency radio frequency (HFRF), electrostatic chuck (ESC) voltage, current, material flow, power, voltage, etc. Sensor data may be associated with or indicate hardware parameters such as the settings or components of the manufacturing apparatus 124 (e.g., size, type, etc.) or manufacturing parameters such as process parameters of the manufacturing apparatus 124. Sensor data may be provided while the manufacturing apparatus 124 is performing a manufacturing process (e.g., readings of the apparatus as it processes products). Sensor data may vary from board to board.

[0024] In some embodiments, the manufacturing apparatus 124 may include a control device 125. The control device 125 may include one or more components or subsystems configured to enable and / or control one or more processes of the manufacturing apparatus 124. For example, subsystems may include a pressure subsystem, a flow subsystem, a temperature subsystem, and so on, and each subsystem may have one or more components. Components may include, for example, a pressure pump, a vacuum, a gas supply line, a plasma etching apparatus, an actuator, and so on. In some embodiments, the control device 125 may be managed based on data from a sensor 126, inputs from a control device 120, and so on.

[0025] The measuring device 128 can provide measurement data associated with the substrate processed by the manufacturing device 124. The measurement data may include values ​​such as film property data (e.g., wafer space film properties), dimensions (e.g., thickness, height, etc.), dielectric constant, dopant concentration, density, and defects. In some embodiments, the measurement data may further include values ​​of one or more surface profile property data (e.g., etching rate, etching rate uniformity, limit dimensions of one or more features contained on the substrate surface, uniformity of limit dimensions across the entire substrate surface, edge placement error, etc.). The measurement data may be for a finished product or a semi-finished product. The measurement data may differ from substrate to substrate. The measurement data can be generated using, for example, reflectivity measurement techniques, polarization analysis techniques, TEM techniques, etc.

[0026] In some embodiments, the measuring device 128 may be included as part of the manufacturing apparatus 124. For example, the measuring device 128 may be contained within or coupled to a process chamber and configured to generate measurement data of the substrate before, during, and / or after a process (e.g., a deposition process, an etching process, etc.) while the substrate remains inside the process chamber. In some examples, the measuring device 128 may be called an in-situ measuring device. In other examples, the measuring device 128 may be coupled to another station of the manufacturing apparatus 124. For example, the measuring device may be coupled to a transfer chamber such as the transfer chamber 210 in Figure 2, a load lock such as the load lock 220, or a factory interface such as the factory interface 206.

[0027] The client device 110 may include computing devices such as personal computers (PCs), laptops, mobile phones, smartphones, tablet computers, netbooks, network-attached televisions ("smart TVs"), network-attached media players (e.g., Blu-ray players), set-top boxes, over-the-top (OTT) streaming devices, and operator boxes. In some embodiments, measurement data can be received from the client device 110. The client device 110 may display a graphical user interface (GUI), which allows the user to provide measurement values ​​of substrates processed in the manufacturing system as input. The client device 110 may include a user interface (UI) 112, an application 114, and a corrective action component 116.

[0028] Application 114 can be a computer program configured to provide maintenance, service, analysis, and prediction techniques performed by one or more evaluation systems (e.g., machine learning models, inference engines, heuristic models, algorithms, physics-based engines, etc.). One or more evaluation systems (e.g., machine learning models) can be generated by the prediction system 160, as described with reference to Figure 3. UI 112 can receive user input associated with Application 114 (e.g., via a graphical user interface (GUI) displayed via a client device 110). In some embodiments, the user interface 112 can be presented via a web browser (not shown), and Application 114 can be hosted on an application server (not shown). Alternatively, the client device 110 includes a local (mobile or desktop) application 114 that provides the user interface 112. In some embodiments, the user interface 112 can communicate with Application 114 via a network 130.

[0029] In some embodiments, input data can be transmitted to or processed by application 114. The corrective action component 116 can be part of application 114 or a separate system (e.g., a program, application, etc.). In some embodiments, the corrective action component 116 receives input data from at least one of the following: anonymization device 150, manufacturing device 124, UI 112, FFS 145, prediction system 160, etc., determines corrective action based on the input data, and implements the corrective action. The corrective action component 116 can receive user input of instructions associated with the manufacturing device 124 (e.g., via a graphical user interface (GUI) displayed via client device 110). For example, in response to receiving an instruction that sensor data has met a threshold criterion (e.g., exceeded or fallen below the fault detection limit), the corrective action module 116 can execute one or more corrective actions (e.g., increasing power, decreasing flow rate, etc.). The corrective actions can be stored in a fault pattern library on data store 140.

[0030] In some embodiments, the corrective action component 116 sends instructions to the prediction system 160 (or any other service provided by the application 114), receives output (e.g., prediction data) from the prediction system 160, determines corrective action based on that output, and has the corrective action implemented. In some embodiments, the corrective action component 116 receives instructions for corrective action from the prediction system 160 and has the corrective action implemented. Each client device 110 may include an operating system that enables the user to perform one or more of the following actions: generate, view, or edit data (e.g., instructions associated with the manufacturing equipment 124, corrective action associated with the manufacturing equipment 124, etc.).

[0031] The datastore 140 can be memory (e.g., random access memory), drives (e.g., hard drives, flash drives), a database system, or another type of component or device capable of storing data. The datastore 140 may include multiple storage components (e.g., multiple drives or multiple databases) that can span multiple computing devices (e.g., multiple server computers). The datastore 140 can store data associated with the processing of substrates in the manufacturing equipment 124. For example, the datastore 140 can store data (referred to as process data) collected by the sensors 126 of the manufacturing equipment 124 before, during, or after the substrate process. The process data may refer to historical process data (e.g., process data generated for previous substrates processed in the manufacturing system) and / or current process data (e.g., process data generated for the current substrate processed in the manufacturing system). The datastore may also store spectral data or non-spectral data associated with a portion of the substrates processed in the manufacturing equipment 124. The spectral data may include historical spectral data and / or current spectral data.

[0032] The data store 140 can also store context data associated with one or more substrates processed by the manufacturing system. Context data may include policy names, policy step numbers, preventive maintenance indicators, operators, etc. Context data may refer to historical context data (e.g., context data associated with previous processes performed on previous substrates) and / or current process data (e.g., context data associated with current or future processes performed on previous substrates). Context data may further include identifying sensors associated with specific subsystems of the process chamber.

[0033] The data store 140 can also store task data. Task data may include one or more sets of operations performed on a substrate during a deposition process, and may include one or more settings associated with each operation. For example, task data for a deposition process may include the temperature setting of the process chamber, the pressure setting of the process chamber, and the flow rate setting of the precursor material for the film to be deposited on the substrate. In another example, task data may include controlling the pressure at a pressure point defined for a flow rate value. Task data may refer to past task data (e.g., task data associated with a previous process performed on a previous substrate) and / or current task data (e.g., task data associated with a current or future process to be performed on a substrate).

[0034] In some embodiments, the data store 140 can store statistical data. Statistical data may include statistical information representative of the raw data, such as mean data (mean), range data, standard deviation data, maximum and minimum data, median data, and mode data. Mean data may include the measured mean of two or more values. For example, mean data can be used to determine the average heater temperature, process chamber pressure, or average gas flow rate over a step, a specific duration, or an entire process policy. Range data may include the central observation of a set of data (e.g., the median temperature during a step). Range data may also include the difference between the maximum and minimum values ​​of a set of values ​​(e.g., the range of heater pressure during a process policy). Standard deviation is a measure of the amount of variability or dispersion of a set of values.

[0035] In some embodiments, the data store 140 can be configured to store data that is inaccessible to users of the manufacturing system. For example, process data, spectral data, and context data acquired about substrates being processed in the manufacturing system are inaccessible to users of the manufacturing system (e.g., operators). In some embodiments, all data stored in the data store 140 can be made inaccessible to users of the manufacturing system. In other or similar embodiments, some of the data stored in the data store 140 can be made inaccessible to users, while other parts of the data stored in the data store 140 can be made accessible to users. In some embodiments, one or more parts of the data stored in the data store 140 can be encrypted using an encryption mechanism unknown to the user (e.g., the data is encrypted using a private encryption key). In other or similar embodiments, the data store 140 can include multiple data stores, where data inaccessible to users is stored in one or more first data stores, and data accessible to users is stored in one or more second data stores.

[0036] In some embodiments, the data store 140 may be configured to store data associated with known failure patterns. A failure pattern may be one or more values ​​(e.g., vectors, scalars, etc.) associated with one or more problems or failures associated with a process chamber subsystem. In some embodiments, a failure pattern may be associated with a corrective action. For example, a failure pattern may include a parameter adjustment step to correct the problem or failure indicated by the failure pattern. For example, a predictive system or corrective action module may compare a determined failure pattern (determined from data acquired from one or more sensors in a sensor cluster) with a library of known failure patterns to determine the type of failure experienced by the subsystem, the cause of the failure, recommended corrective actions to correct the failure, and so on.

[0037] The datastore 140 may be part of the FSS145 or operationally connected to the FSS145. The FSS145 may include one or more physical machines (e.g., server machines, desktop computers, etc.) each containing one or more processing units, each communicatively coupled to memory devices and input / output (I / O) devices. The processing units may include computers, microprocessors, logic devices, or other devices or processors, comprising hardware, firmware, and software for performing some of the embodiments described herein. The FSS145 will be described with reference to Figure 3.

[0038] The anonymization device 150 may include one or more computing devices (e.g., server machines) configured to perform one or more data anonymization operations on the dataset. Data anonymization is a type of data sanitization aimed at protecting privacy. It is the process of removing personally identifiable information from a dataset so that certain date elements are not revealed. The anonymization device 150 may include a decryption device 152, a sanitizer 154, and a normalization device 156.

[0039] The decryption device 152 can, for example, decrypt a dataset received from the FSS 145 (and / or data store 140). In particular, the decryption device 152 can receive an encrypted dataset from the FSS 145. This dataset can be encrypted using, for example, one or more cryptographic keys (e.g., public key, private key, symmetric key, asymmetric key, pre-shared key (PSK), etc.), tokens, digital certificates, etc. For example, the FSS 145 (or any other component or external component of the manufacturing system 100 (not shown)) can use one or more cryptographic keys to encrypt plaintext data (e.g., sensor data, measurement data, policy data, etc.) into ciphertext data. One or more cryptographic keys can be shared in advance with the anonymization device 150. The decryption device 152 can use one or more of the previously shared cryptographic keys to decrypt the received ciphertext data into plaintext data.

[0040] Sanitizer 154 can sanitize the decrypted dataset (e.g., plaintext data). Sanitizer 154 can remove sensitive data (e.g., secret data, proprietary data, etc.) from the dataset. Such data may include policy data, setpoint data, identification data, yield data, specific measurement data, security data, etc. In some embodiments, sanitizer 154 can remove specific metadata from the dataset. For example, metadata may identify policy names, policy input values, customer identification data, etc. In some embodiments, sanitizer 154 can perform one or more heuristic-based methods, machine learning-based methods, k-source anonymity-based methods, algorithm-based methods, or any other methods configured to remove sensitive data.

[0041] The normalization device 156 can convert the output values ​​of a dataset (e.g., trace data) into a normalized dataset, so that the normalized dataset retains certain features from the original dataset without revealing the actual output values. This allows for the concealment of the original output values. In some embodiments, the normalization device 156 can generate one or more of the following from the dataset: normalized summary statistics, synthetic data, scaled time series data, symbolic data (e.g., converting data to arbitrary symbols).

[0042] To generate normalized summary statistics, the normalizer 156 can adjust dataset values ​​measured at different scales to a conceptually common scale. In some embodiments, the normalized summary statistics may include dataset adjustments that align the probability distributions of the adjusted values. In some embodiments, the normalized summary statistics may mask the original output values ​​by shifting, scaling, or performing other operations on the data values.

[0043] Synthetic data may include data artificially generated from a dataset. In some embodiments, the normalization device 156 can generate synthetic data by applying one or more of the following to trace data: filters, algorithms, machine learning models, feature extraction, and normalization algorithms.

[0044] Figure 6A shows how the normalization device 156 generates synthetic data according to some embodiments of the present disclosure. In particular, graph 610 shows exemplary sensor data (e.g., trace data). Trace data may include specific output values ​​along the y-axis (e.g., power values, pressure values, flow values, etc.) and time along the x-axis. Graph set 620 is a set of graphs showing how the normalization device 156 performs feature extraction on output values ​​and normalized statistics. Feature extraction may include identifying specific data points where data values ​​provide useful information (e.g., including relatively large increases or decreases).

[0045] Figure 6B is another diagram showing how the normalization device 156 generates synthetic data according to certain embodiments of the present disclosure. In particular, graph 630 shows exemplary sensor data. Graph 640 shows exemplary normalized data. As shown, the normalized data in graph 640 is transformed to modify the output values ​​along the y axis while identifying data that provides useful information along the x axis. Figure 6C shows sections 652 and 654 of graphs 630 and 640 in more detail. In particular, graph 632 shows section 654 of graph 630 in more detail. Graph 642 shows section 654 of graph 640 in more detail. Graph 634 shows section 652 of graph 630 in more detail. Graph 644 shows section 652 of graph 640 in more detail.

[0046] Returning to Figure 1, in some embodiments, the operations performed by the anonymizer 150 (e.g., operations performed by the decryption device 152, sanitizer 154, and / or normalization device 156) can be performed in a privacy-enhanced environment, such as a trusted execution environment (TEE), a multi-party computation (MPC) environment, a federated learning (FL) environment, or a fully homomorphic encryption (FHE) environment. Performing operations in a privacy-enhanced environment prevents external users from obtaining sensitive and / or raw data before the dataset is sanitized and / or normalized.

[0047] TEE can encrypt data from less privileged processes using hardware-based encryption, preventing even more privileged computing processes from accessing the unencrypted data. This allows less privileged processes to isolate their data from more privileged processes, even when those processes are responsible for managing the data. For example, encryption can be performed at the firmware level, preventing access to the encryption key from any operating system process running on the computer.

[0048] Multi-Party Computation (MPC) can involve multi-party collaborative computation on shuffled data and computing nodes. Specifically, MPC is a branch of cryptography aimed at generating methods for parties to collaboratively compute a function on an input while keeping their own input confidential. Cryptographic techniques in MPC ensure mutual protection of participants' privacy.

[0049] FL (also known as collaborative learning) is a machine learning technique that trains algorithms across multiple distributed edge devices or servers holding local data samples without exchanging data samples. This approach contrasts with traditional centralized machine learning techniques where all local datasets are uploaded to a single server, and with more classical distributed approaches that often assume local data samples are identically distributed.

[0050] FHE is a form of encryption that allows computations to be performed on encrypted data without decrypting it. The resulting computation results remain encrypted, but decryption yields the same output as if the operation had been performed on unencrypted data. Homomorphic encryption can be used for external storage and computation outsourcing while protecting privacy.

[0051] In some embodiments, the operations performed by application 114 can be performed in a privacy-enhanced environment, such as a TEE, MPC environment, FL environment, or FHE environment.

[0052] In some embodiments, one or more algorithms or applications configured to perform one or more data anonymization operations may be generated, encrypted, and / or transmitted to the anonymization device 150 by the FSS 145, client device 110, or an external entity. For example, the FSS 145 may transmit encrypted data on which one or more anonymization operations are performed, along with the algorithms for performing the one or more anonymization operations, to the anonymization device 150. The anonymization device 150 receives the encrypted data and encrypted algorithms and can execute the algorithms on the encrypted data in a privacy-enhanced environment. In some embodiments, the anonymization device 150 may encrypt output data obtained from the anonymization operations (e.g., normalized summary statistics, synthetic data, scaled time-series data, symbolic data, etc.). The output data can be decrypted by the requesting application (e.g., application 114) using, for example, an encryption key.

[0053] The decryption device 152, the sanitizer 154, and the normalization device 156 are each shown as components of the anonymization device 150, but can be included in one or more other computing devices such as rack-mount servers, router computers, server computers, personal computers, mainframe computers, laptop computers, tablet computers, desktop computers, GPUs, and ASICs. Each component can execute instructions that perform one or more of the methods and / or embodiments described herein. Instructions can be stored in a computer-readable storage medium that may include main memory, static memory, secondary storage, and / or processing units (during the execution of the instructions).

[0054] The client device 110, the manufacturing equipment 124, the sensor 126, the prediction system 160, the anonymization device 150, the FSS 145, and the data store 140 can be connected to each other via the network 130. In some embodiments, the network 130 is a public network that provides the client device 110 with access to the anonymization device 150, the prediction system 160, the data store 140, the FSS 145, the manufacturing equipment 124, and other publicly available computing devices. In some embodiments, the network 130 is a private network that provides the client device 110 with access to the manufacturing equipment 124, the data store 140, the FSS 145, the anonymization device 150, the prediction system 160, and other privately available computing devices. Network 130 may include one or more wide area networks (WANs), local area networks (LANs), wired networks (e.g., Ethernet networks), wireless networks (e.g., 802.11 networks or Wi-Fi networks), cellular networks (e.g., Long-Term Evolution (LTE) networks), routers, hubs, switches, server computers, cloud computing networks, and / or combinations thereof.

[0055] In this embodiment, “User” can represent a single individual. However, other embodiments of this disclosure include the case where “User” is an entity controlled by multiple users and / or automated sources. For example, a collection of individual users united as a group of administrators can be considered a “User.”

[0056] Figure 2 is a schematic top view of an exemplary manufacturing system 200 according to an aspect of the present disclosure. The manufacturing system 200 can perform one or more processes on a substrate 202. The substrate 202 can be any appropriately rigid, fixed-dimension planar article suitable for manufacturing electronic devices or circuit components, such as a silicon-containing disk or wafer, a patterned wafer, or a glass plate.

[0057] The manufacturing system 200 may include a process tool 204 and a factory interface 206 coupled to the process tool 204. The process tool 204 may include a housing 208 having a transfer chamber 210 inside. The transfer chamber 210 may include one or more process chambers (also called processing chambers) 214, 216, 218 arranged around the transfer chamber 210 and coupled to the transfer chamber 210. The process chambers 214, 216, 218 can be coupled to the transfer chamber 210 via their respective ports, such as slit valves. The transfer chamber 210 may also include a transfer chamber robot 212 configured to transfer substrates 202 between the process chambers 214, 216, 218, a load lock 220, etc. The transfer chamber robot 212 may include one or more arms, each arm including one or more end effectors at the end of each arm. The end effectors can be configured to handle specific objects such as wafers, sensor disks, sensor tools, etc.

[0058] Process chambers 214, 216, and 218 can be adapted to perform any number of processes on the substrate 202. Each process chamber 214, 216, and 218 can perform the same or different substrate processes. Substrate processes can include atomic layer deposition (ALD), physical vapor deposition (PVD), chemical vapor deposition (CVD), etching, annealing, curing, pre-cleaning, and metal or metal oxide removal. Other processes can be performed on the substrate within the process chamber. Each process chamber 214, 216, and 218 can include one or more sensors configured to capture data on the substrate 202 before, after, or during the substrate process. For example, one or more sensors can be configured to capture spectral and / or non-spectral data about a portion of the substrate 202 during the substrate process. In other or similar embodiments, one or more sensors can be configured to capture data related to the environment within process chambers 214, 216, and 218 before, after, or during the substrate process. For example, one or more sensors can be configured to capture data related to the temperature, pressure, gas concentration, and other environmental factors within the process chambers 214, 216, and 218 during substrate processing.

[0059] In some embodiments, a measuring device (not shown) may be located within a process tool. In other embodiments, a measuring device (not shown) may be located within one or more process chambers 214, 216, 218. In some embodiments, a transfer chamber robot 212 may be used to position the substrate onto the measuring device. In other embodiments, the measuring device may be part of a substrate support assembly (not shown). The measuring device can provide measurement data associated with the substrate processed by the manufacturing apparatus 124. The measurement data may include values ​​such as film property data (e.g., wafer space film properties), dimensions (e.g., thickness, height, etc.), dielectric constant, dopant concentration, density, and defects. In some embodiments, the measurement data may further include values ​​of one or more surface profile property data (e.g., etching rate, etching rate uniformity, limit dimensions of one or more features contained on the substrate surface, limit dimensional uniformity across the substrate surface, edge placement error, etc.). The measurement data may relate to a finished or semi-finished product. The measurement data may differ from substrate to substrate. The measurement data can be generated using, for example, reflectivity measurement techniques, polarization analysis techniques, TEM techniques, etc.

[0060] The load lock 220 can also be coupled to the housing 208 and the transfer chamber 210. The load lock 220 can be configured to interface with and couple to one side of the transfer chamber 210 and to the factory interface 206. In some embodiments, the load lock 220 can have an environmentally controlled atmosphere that can be changed from a vacuum environment (to which the substrate can be transferred to and from the transfer chamber 210) to an atmospheric pressure or near-atmospheric gas environment (to which the substrate can be transferred to and from the factory interface 206). The factory interface 206 can be any suitable enclosure, such as an equipment front-end module (EFEM). The factory interface 206 can be configured to receive substrates 202 from a substrate carrier 222 (e.g., a forward-opening unified pod (FOUP)) docked to various load ports 224 of the factory interface 206. A factory interface robot 226 (shown by a dotted line) can be configured to transfer the substrates 202 between the carrier (also called a container) 222 and the load lock 220. The carrier 222 can be a circuit board storage carrier or a replacement parts storage carrier.

[0061] The manufacturing system 200 may also be connected to a client device (e.g., client device 110, not shown) configured to provide information about the manufacturing system 200 to a user (e.g., an operator). In some embodiments, the client device may provide information to the user of the manufacturing system 200 via one or more graphical user interfaces (GUIs). For example, the client device may provide information via the GUI about the target thickness profile of the film to be deposited on the surface of the substrate 202 during the deposition process performed in process chambers 214, 216, and 218. The client device may also provide information about anomaly detection and failure classification according to embodiments described herein.

[0062] The manufacturing system 200 may also include a system controller 228. The system controller 228 may be and / or include a computing device such as a personal computer, a server computer, a programmable logic control unit (PLC), or a microcontroller. The system controller 228 may include one or more general-purpose processing units, such as a microprocessor or a central processing unit. More specifically, the processing units may be a composite instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor or combination of instruction sets that implements other instruction sets. The processing units may also be one or more dedicated processing units such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), or a network processor. The system controller 228 may include data storage devices (e.g., one or more disk drives and / or solid drives), main memory, static memory, a network interface, and / or other components. The system controller 228 may execute instructions to perform one or more of the methods and / or embodiments described herein. In some embodiments, the system controller 228 can execute instructions to perform one or more operations in the manufacturing system 200 according to a process policy. Instructions can be stored in a computer-readable storage medium, which may include main memory, static memory, secondary storage, and / or processing units (while the instructions are being executed).

[0063] The system controller 228 can receive data from sensors (e.g., sensor 126, not shown) located on or within various parts of the manufacturing system 200 (e.g., processing chambers 214, 216, 218, transfer chamber 210, load lock 220, etc.). In some embodiments, the data received by the system controller 228 may include spectral and / or non-spectral data for a portion of the substrate 202. In other or similar embodiments, the data received by the system controller 228 may include data associated with the processing of the substrate 202 in processing chambers 214, 216, 218, as described above. For the purposes of this description, the system controller 228 is described as receiving data from sensors located within the process chambers 214, 216, 218. However, the system controller 228 can receive data from any part of the manufacturing system 200, and the data received from that part may be used according to the embodiments described herein. In an exemplary example, the system controller 228 can receive data from one or more sensors in the process chambers 214, 216, and 218 before, after, or during the substrate process in the process chambers 214, 216, and 218. Data received from sensors in various parts of the manufacturing system 200 can be stored in the data store 250. The data store 250 can be included as a component within the system controller 228 or as a separate component from the system controller 228. In some embodiments, the data store 250 can be the data store 140 described with respect to Figure 1. The data store 250 can be coupled to the FSS 145.

[0064] Figure 3 shows an exemplary prediction architecture 300 according to an aspect of the present disclosure. In some embodiments, the prediction architecture 300 includes a prediction system 160, a network 130, and a data store 310 (which may be the same as the data store 140). In some embodiments, the prediction system 160 may use a model (e.g., model 190) to group two or more sensors, for example, based on sensor statistical data. For example, model 190 may receive sensor statistical data as input and generate sensor cluster data as output. In some embodiments, the prediction system 160 may include a prediction server 112, server machines 170 and 180, and a prediction server 195. Prediction server 160, server machine 170, server machine 180, and prediction server 195 may each include one or more computing devices such as rack-mount servers, router computers, server computers, personal computers, mainframe computers, laptop computers, tablet computers, desktop computers, graphics processing units (GPUs), and application-specific integrated circuits (ASICs) (e.g., tensor processing units (TPUs)).

[0065] The server machine 170 includes a training set generator 172 that can generate training datasets (e.g., a set of data inputs and a set of target outputs) for training, validating, and / or testing a machine learning model 190. The machine learning model 190 can be any algorithmic model capable of learning from data. In some embodiments, the machine learning model 190 can be a predictive model. In some embodiments, the dataset generator 172 can divide the training data into training sets, validation sets, and test sets, which can be stored in the training data store 310 as part of the training statistics 312. The training statistics 312 can be accessed from the computing device prediction system 160 directly or via the network 130. In some embodiments, the prediction system 160 generates multiple training datasets.

[0066] The server machine 180 may include a training engine 182, a validation engine 184, a selection engine 185, and / or a test engine 186. An engine can refer to hardware (e.g., circuits, custom logic, programmable logic, microcode, processing units, etc.), software (e.g., processing units, general-purpose computer systems, or instructions executed on a custom machine), firmware, microcode, or a combination thereof. The training engine 182 can train one or more machine learning models 190. A machine learning model 190 can refer to a model artifact created by the training engine 182 using training data (also referred to herein as the training set) which includes training inputs and corresponding target outputs (the correct answers for each training input). The training engine 182 can find patterns in the training data that map training inputs to target outputs (predicted answers) and provide machine learning models 190 that capture these patterns. Machine learning models 190 can use one or more of the following: statistical modeling, support vector machines (SVM), radial basis functions (RBF), clustering, supervised machine learning, semi-supervised machine learning, unsupervised machine learning, k-nearest neighbor algorithm (k-NN), linear regression, random forest, and neural networks (e.g., artificial neural networks).

[0067] One type of machine learning model that can be used to perform some or all of the above tasks is an artificial neural network, such as a deep neural network. An artificial neural network generally contains feature representation components that have classifier or regression layers that map features to a desired output space. A convolutional neural network (CNN), for example, hosts multiple layers of convolutional filters. Pooling is performed, and nonlinearity can be dealt with in lower layers, and a multilayer perceptron is generally added on top of those lower layers to map the top layer features extracted by the convolutional layers to a decision (e.g., classification output). Deep learning is a class of machine learning algorithms that use a cascade of multiple layers of nonlinear processing units for feature extraction and transformation. Each successive layer uses the output from the previous layer as input. Deep neural networks can be trained in supervised (e.g., classification) and / or unsupervised (e.g., pattern analysis) forms. A deep neural network contains a hierarchy of layers, where different layers learn different levels of representation corresponding to different levels of abstraction. In deep learning, each level learns to transform its input data into a slightly more abstract and complex representation. In plasma process tuning, for example, the raw input could be a process result profile (e.g., a thickness profile showing one or more thickness values ​​across the entire surface of the substrate), a second layer could consist of feature data associated with the state of one or more zones of the control elements of the plasma process system (e.g., zone orientation, plasma exposure time, etc.), and a third layer could include a starting policy (e.g., a policy used as a starting point to determine an updated process policy for processing the substrate and producing process results that meet threshold criteria). Notably, the deep learning process can learn on its own which features are best placed at which levels. The "deep" in "deep learning" refers to the number of layers to which the data is transformed. More precisely, a deep learning system has a considerable depth of confidence assignment paths (CAPs). A CAP is a chain of transformations from input to output.A CAP describes the latent causal relationship between an input and an output. In the case of a feedforward neural network, the depth of the CAP can be the depth of the network, which can be the number of hidden layers + 1. In the case of a recurrent neural network, where a signal can propagate through layers two or more times, the depth of the CAP is potentially unlimited.

[0068] In one embodiment, one or more machine learning models are recurrent neural networks (RNNs). An RNN is a type of neural network that includes memory, allowing the neural network to capture temporal dependencies. An RNN can learn input-output mappings that depend on both current and past inputs. An RNN can deal with past and future flow measurements and make predictions based on this continuous measurement information. An RNN can be trained using a training dataset and can produce a fixed number of outputs (e.g., determining a set of substrate processing rates, determining modifications to a substrate process policy). One type of RNN that can be used is a long short-term memory (LSTM) neural network.

[0069] Training a neural network can be achieved in a supervised learning manner, which involves feeding the network a training dataset consisting of labeled inputs, observing its output, defining the error (by measuring the difference between the output and the labeled value), and adjusting the network's weights across all layers and nodes of the network to minimize the error, using techniques such as deep gradient descent and backpropagation. In many applications, repeating this process across many labeled inputs in the training dataset results in a network that can produce the correct output even when presented with inputs different from those present in the training dataset.

[0070] A training dataset can be formed using a training dataset that includes hundreds, thousands, tens of thousands, hundreds of thousands, or more sensor data and / or process result data (e.g., measurement data such as one or more thickness profiles associated with sensor data).

[0071] To achieve training, the processing logic can input the training dataset into one or more untrained machine learning models. The machine learning models can be initialized before inputting the first input into them. The processing logic trains the untrained machine learning models based on the training dataset to produce one or more trained machine learning models that perform the various operations described above. Training can be performed by inputting one or more of the sensor data into the machine learning models one at a time.

[0072] A machine learning model processes inputs and produces outputs. An artificial neural network includes an input layer consisting of data point values. The next layer is called a hidden layer, and each node in the hidden layer receives one or more input values. Each node contains parameters (e.g., weights) that are applied to the input values. Thus, each node essentially inputs the input values ​​into a multivariate function (e.g., a nonlinear mathematical transformation) to produce output values. The next layer can be another hidden layer or an output layer. In either case, the nodes in the next layer receive output values ​​from the nodes of the previous layer, and each node applies weights to these values ​​and then produces its own output values. This can happen in each layer. The final layer is the output layer, and there is one node for each class, prediction, and / or output that the machine learning model can produce.

[0073] Therefore, the output may include one or more predictions or inferences. In some embodiments, the output predictions or inferences may include one or more predictions such as classification of sensor groups or ranking of sensors. In some embodiments, the output predictions or inferences may include one or more predictions such as anomaly data, failure data, or failure detection limits. The processing logic determines an error (i.e., classification error) based on the difference between the output of the machine learning model (e.g., predictions or inferences) and the target labels associated with the input training data. Based on the error, the processing logic adjusts the weights of one or more nodes of the machine learning model. An error term or delta may be determined for each node of the artificial neural network. Based on this error, the artificial neural network adjusts one or more of its parameters (weights of one or more inputs of the node) of one or more of its nodes. Parameters may be updated in a backpropagation manner, with the top layer nodes being updated first, followed by the nodes of the next layer, and so on. The artificial neural network consists of multiple layers of "neurons," each layer receiving values ​​from the neurons of the previous layer as input. The parameters of each neuron include weights associated with the values ​​received from each of the neurons of the previous layer. Therefore, tuning parameters can include adjusting the weights assigned to each of the inputs of one or more neurons in one or more layers within an artificial neural network.

[0074] After one or more training rounds, the processing logic can determine whether the stopping criteria have been met. The stopping criteria can be a target level of accuracy, a target number of processed images from the training dataset, a target change in a parameter across one or more previous data points, a combination of these, and / or other criteria. In one embodiment, the stopping criteria are met when at least a minimum number of data points have been processed and at least a threshold accuracy has been achieved. The threshold accuracy can be, for example, 70%, 80%, or 90% accuracy. In one embodiment, the stopping criteria are met when the accuracy improvement of the machine learning model has stopped. If the stopping criteria are not met, further training is performed. If the stopping criteria are met, training can be completed. Once the machine learning model is trained, the model can be tested using a reserved portion of the training dataset.

[0075] Once one or more trained machine learning models 190 are generated, these models can be stored in the prediction server 195 as prediction components 197, or as components of prediction components 197.

[0076] The validation engine 184 may be able to validate the machine learning model 190 using the corresponding set of features from the validation set generated by the training set generator 172. Once the model parameters have been optimized, model validation may be performed to determine whether the model has improved and to determine the current accuracy of the deep learning model. The validation engine 184 can determine the accuracy of the machine learning model 190 based on the corresponding set of features from the validation set. The validation engine 184 may discard trained machine learning models 190 that have an accuracy that does not meet a threshold accuracy. In some embodiments, the selection engine 185 may be able to select trained machine learning models 190 that have an accuracy that meets a threshold accuracy. In some embodiments, the selection engine 185 may be able to select the trained machine learning model 190 with the highest accuracy among the trained machine learning models 190.

[0077] The test engine 186 may be able to test the trained machine learning model 190 using the corresponding set of features from the test set of the dataset generator 172. For example, a first trained machine learning model 190 trained using a first set of features from the training set can be tested using a first set of features from the test set. Based on the test set, the test engine 186 can determine which trained machine learning model 190 has the highest accuracy among all the trained machine learning models.

[0078] The prediction server 195 includes a prediction component 197 that can provide data failure detection data and / or anomaly detection data. This will be described in more detail below. In some embodiments, the prediction server 195 can receive input data from, for example, a client device 110. As will be described in more detail below, one or more anonymization operations can be performed on the input data via the anonymization device 150 to, for example, sanitize and / or normalize the data.

[0079] It should be noted that in some other implementations, the functionality of server machines 170 and 180, as well as the prediction server 195, may be provided by fewer machines. For example, in some embodiments, server machines 170 and 180 can be integrated into a single machine, while in some other or similar embodiments, server machines 170 and 180, as well as the prediction server 195, can be integrated into a single machine.

[0080] In general, functions described in one embodiment as being performed by server machine 170, server machine 180, and / or prediction server 195 can also be performed on client device 110. In addition, functions that belong to a particular component can be performed by different components or multiple components working together.

[0081] In some embodiments, the manufacturing system may include two or more process chambers. For example, the exemplary manufacturing system 200 in Figure 2 shows multiple process chambers 214, 216, and 218. Note that in some embodiments, the data acquired to train the machine learning model 190 and the data collected to be provided as input to the machine learning model may be associated with the same process chamber of the manufacturing system. In other or similar embodiments, the data acquired to train the machine learning model and the data collected to be provided as input to the machine learning model may be associated with different process chambers of the manufacturing system. In other or similar embodiments, the data acquired to train the machine learning model may be associated with a process chamber in a first manufacturing system, and the data collected to be provided as input to the machine learning model may be associated with a process chamber in a second manufacturing system.

[0082] Figures 4A and 4B show exemplary FSS architectures. In particular, Figure 4A shows FSS410 and Figure 4B shows FSS420. FSS410 and FSS420 can be similar to or identical to FSS145 in Figure 1. FSS410 may include administrator components 412, a database management system 414, and a data store 416. FSS420 may include administrator components 412, a database management system 414, a data store 416, and an application 428.

[0083] Application 428 can be similar to or identical to Application 114 in Figure 1. In some embodiments, Application 428 (or Application 114) may be encrypted to prevent unauthorized access. For example, 428 may be encrypted using a public-private key pair. As will be described in more detail below, Application 428 may require access to data stored in data store 416 to perform, for example, data analysis, predictive operations, and / or corrective operations.

[0084] The data store 416 can store data acquired from one or more of the manufacturing equipment 124, measuring equipment 128, prediction system 160, or any other components of the system 100 in Figure 1. In one example, the data store 416 can store trace data, sensor data, statistical data, alarm data, fault data, etc. The data store 416 can be similar to or identical to the data store 140 in Figure 1. In some embodiments, the data stored in the data store 416 can be encrypted. In one example, the data stored in the data store 416 can be encrypted using one or more encryption keys, one or more tokens, one or more certificates, etc. In some embodiments, the data can be encrypted using the public key of a public key / private key pair. For example, the data can be encrypted via the public key by FSS 410, 420, manufacturing equipment 124 and / or measuring equipment 128. The data can then be decrypted using the private key of the key pair. In some embodiments, the private key pair can be held by an anonymization device 150 or a different entity. Therefore, the data cannot be decrypted by FSS410 or 420.

[0085] The database management system 414 can be a system used for storing, retrieving, and querying data. In particular, the database management system 414 can be an interface between entities (e.g., applications 114, 428, manufacturing equipment 124, etc.) and databases (e.g., data stores 416, 140), enabling entities to create, read, update, and delete data in the database. In one example, the database management system 414 can be used to obtain access to data stored in data store 416. The database management system 414 can be encrypted (e.g., via one or more cryptographic keys, one or more tokens, one or more certificates, etc.). In some embodiments, access to the database management system 414 may require joint authorization. Joint authorization requires authorization from two or more entities to access the database management system 414. In an exemplary example, the database management system 414 may be encrypted first by a first entity (e.g., via a public key) and then by a second entity (e.g., via a public key). Therefore, in order to access the database management system 414, a second entity can decrypt the database management system 414 (for example, via a private key), and then the first entity can decrypt the database management system 414 (for example, via a private key). In some embodiments, the public key from the first entity and the public key from the second entity can be combined (for example, via an XOR operation) to form a combined encryption key, and this combined encryption key can be used to encrypt the database management system 414. In the decryption operation, the private key from the first entity and the private key from the second entity can be combined (for example, via an XOR operation) to form a combined decryption key, and this combined decryption key can be used to decrypt the database management system 414.

[0086] The administrator component 412 can manage access by application 114 (not shown) or application 428 to the database management system 414 and / or data store 416. In some embodiments, the administrator component 412 is configured to allow applications to access the database management system 414 (and therefore the data store 416). In particular, the administrator component 412 can determine whether applications 114, 428 can access specific data, at what time applications 114, 428 can access the data, and what data they can access. For example, FSS 410, 420 can receive requests from application 114 or application 428 to access sensor data associated with a specific process running in a specific process chamber. The administrator component 412 can determine whether applications 114, 428 can access the requested data, whether to reject specific data from the request, and at what time or time interval applications 114, 428 can access the requested data.

[0087] Figure 5 is a table illustrating exemplary examples of cryptographic key relationships according to certain embodiments of the present disclosure. As shown, column 510 lists key names, each key name reflecting which component each key is associated with. For example, an administrator key can be used to encrypt and / or decrypt administrator component 412, a data management system key can be used to encrypt and / or decrypt data management system 414, a datastore key can be used to encrypt and / or decrypt datastore 416 (or datastore 140), and an application key can be used to encrypt and / or decrypt applications 114, 428. Column 520 lists key types. For example, a public key can be the public key in a public-private key pair, a private key can be the private key in a public-private key pair, and a symmetric key can be an encryption algorithm that uses the same cryptographic key for both plaintext encryption and ciphertext decryption, or any combination thereof. Column 530 lists the owners of each key (e.g., the first entity, the second entity, the third entity, etc.). As illustrated, the first entity (e.g., a customer) can access the administrator key and one of the decryption keys for the database management system 414. The second entity (e.g., a service provider) can access the encryption key for encrypting the datastore 416, the encryption key for encrypting the database management system 414, other decryption keys for the database management system 414, and the encryption and decryption key pair for application 428. The third entity (e.g., an anonymization device provider) can access the decryption key for the datastore 416.

[0088] Figure 7 is a flowchart of a method 700 for obtaining data requested from an FSS, according to some embodiments of the present disclosure. The method 700 is performed by processing logic that may include hardware (circuits, dedicated logic, etc.), software (such as that which runs on a general-purpose computer system or a dedicated machine), firmware, or any combination thereof. In one embodiment, the method 700 can be performed by a computer system, such as the computer system architecture 100 of Figure 1. In other or similar embodiments, one or more operations of the method 700 can be performed by one or more other machines not shown in the figures. In some embodiments, one or more operations of the method 700 can be performed by a client device 110, an FSS 145, an anonymization device 150, and / or a prediction system 160. In some embodiments, the method 700 is performed by the FSS 145.

[0089] In some embodiments, diagnostic data may refer to data analysis, predictive operations, corrective operations, etc. In some embodiments, diagnostic data may be generated using, for example, a predictive system 160.

[0090] In operation 710, the processing logic receives a request for data stored in the data store. For example, the processing logic may receive a request from application 114 for sensor data related to a specific process execution performed by a specific process chamber of the manufacturing apparatus 124. In some embodiments, the requested data can be encrypted. In some embodiments, the application can be hosted by an FSS server. In other embodiments, the application can be hosted by another server or computing device.

[0091] In operation 715, the processing logic grants access to the requested data. In some embodiments, access may be granted via user input. For example, a user interface may display a prompt requesting access to the data. In response to receiving a user selection that allows access to the data (e.g., a button selection), the processing logic may grant access to the requested data. In embodiments where access is not granted, the processing logic may reject the request. In some embodiments, the processing logic grants access based on predetermined criteria. These criteria may include the identification of the requesting application, the type of data requested, and the time the data was requested. For example, the processing logic may receive a request from a specific application, perform a lookup of a data table to determine whether the application has permission to access the requested data, and, based on the lookup, grant access to the requested data.

[0092] In operation 720, the processing logic decrypts the database management system (e.g., database management system 414). In some embodiments, to decrypt the database management system, the processing logic may use a first secret key and then a second secret key. One of the secret keys may be controlled by a first entity (e.g., a customer), and the second secret key may be controlled by a second entity (e.g., a service provider). In some embodiments, a request from an application may be configured to provide the processing logic with one of the secret keys or to grant access to a secret key stored locally on the FSS. Access to the second secret key can be provided to the processing logic by receiving access to the requested data.

[0093] In operation 725, the processing logic sends the requested data to the anonymization device. For example, the processing logic may use a database management system to retrieve the requested data from a data store and send the retrieved data to the anonymization device. In some embodiments, the retrieved data may be encrypted. In some embodiments, the processing logic may send one or more algorithms and / or applications configured to perform one or more anonymization operations on the requested data to the anonymization device. In some embodiments, one or more algorithms and / or applications may be encrypted.

[0094] Figure 8 is a flowchart of Method 800 for anonymizing data obtained from an FSS, according to some embodiments of the present disclosure. Method 800 is performed by processing logic that may include hardware (circuits, dedicated logic, etc.), software (such as that which runs on a general-purpose computer system or a dedicated machine), firmware, or any combination thereof. In one embodiment, Method 800 can be performed by a computer system, such as the computer system architecture 800 of Figure 1. In other or similar embodiments, one or more operations of Method 800 can be performed by one or more other machines not shown in the figures. In some embodiments, one or more operations of Method 800 can be performed by a client device 110, an FSS 145, an anonymization device 150, and / or a prediction system 160. In some embodiments, Method 800 is performed by the anonymization device 150. In some embodiments, one or more operations of Method 800 can be performed in a privacy-enhanced environment (e.g., TEE, MPC, FL, FHE, etc.).

[0095] In operation 810, the processing logic receives encrypted data. For example, the processing logic may receive encrypted data from the FSS via operation 725 in Figure 7. In some embodiments, the processing logic may also receive one or more algorithms and / or applications configured to perform one or more anonymization operations on the received data. In some embodiments, one or more algorithms and / or applications configured to perform one or more anonymization operations may already be stored in the anonymization device (for example, received from a previous instance).

[0096] In operation 815, the processing logic decrypts the encrypted data to obtain the decrypted dataset. For example, the processing logic may decrypt the data using one or more cryptographic keys stored in the anonymization device. In some embodiments, the processing logic may also decrypt one or more algorithms and / or applications configured to perform one or more anonymization operations on the received data, for example, using one or more cryptographic keys stored in the anonymization device.

[0097] In operation 820, the processing logic sanitizes the dataset. In some embodiments, the processing logic may perform one or more anonymization operations related to one or more algorithms and / or applications received. For example, the processing logic may remove sensitive data (e.g., secret data, proprietary data, etc.) from the dataset by performing one or more of the following: heuristic-based methods, machine learning-based methods, k-source anonymity-based methods, algorithm-based methods, etc.

[0098] In operation 825, the processing logic normalizes the dataset. In some embodiments, the processing logic can generate one or more from the dataset, such as normalized summary statistics, synthetic data, scaled time series data, and symbolic data.

[0099] In operation 830, the processing logic sends the dataset to the requesting application. Upon receiving the dataset, the application can perform one or more operations on the dataset to obtain diagnostic data (e.g., data analysis, predictive operations, corrective operations). In some embodiments, the processing logic may encrypt the dataset before sending it to the requesting application. In such embodiments, upon receiving the encrypted dataset, the requesting application can decrypt it. For example, the application may use an encryption key to decrypt the encrypted dataset.

[0100] Figure 9 is a block diagram showing an exemplary computer system architecture 900 for a multi-entity data source according to some embodiments of the present disclosure. In some embodiments, the computer system architecture 900 includes a manufacturing apparatus 924, an FSS server 945, a measurement server 928, anonymization devices 950A-B, applications 914A-B, and results 930. The manufacturing apparatus 924 can produce products and may be similar to or identical to the manufacturing apparatus 124. The manufacturing apparatus 924 can generate manufacturing process data (e.g., sensor data, trace data, etc.) and transmit the data to the FSS server 945 for storage. The manufacturing process data may be encrypted by the manufacturing apparatus 924 and / or the FSS server 945. The manufacturing apparatus 924 may further transmit the data to the measurement server 928, and / or the measurement server 928 may generate measurement data from the products produced by the manufacturing apparatus 924. The measurement server 928 may be similar to or identical to the measurement device 128. In some embodiments, the measurement server 928 may include an architecture similar to that of the FSS145. For example, the measurement server 928 may include one or more of the following: an administrator configuration, a database management system, and / or a data store.

[0101] The manufacturing device 924 can transmit encrypted data to the anonymization devices 950Aa and 950B. The measurement server 928 can transmit encrypted data to the anonymization devices 950Aa and 950B. The anonymization devices 950A and 950B can decrypt, sanitize, and normalize the received data and transmit the data to their respective applications 914A and 914B. The applications 914A and 914B can use the received data to generate diagnostic data 930.

[0102] Figure 10 is a block diagram showing a computer system 1000 according to a particular embodiment. In some embodiments, the computer system 1000 can be connected to other computer systems (for example, via a network such as a local area network (LAN), intranet, extranet, or the Internet). The computer system 1000 can operate as a server or client computer in a client-server environment, or as a peer computer in a peer-to-peer or distributed network environment. The computer system 1000 may be provided by a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), mobile phone, web appliance, server, network router, switch or bridge, or any device capable of executing a set of instructions (sequential or otherwise) specifying actions to be taken by such device. Furthermore, the term “computer” includes any set of computers that individually or collectively execute a set of instructions (or sets of instructions) to perform one or more of the methods described herein.

[0103] In a further embodiment, the computer system 1000 may include a processing unit 1002, a volatile memory 1004 (e.g., random access memory (RAM)), a non-volatile memory 1006 (e.g., read-only memory (ROM) or electrically erasable programmable ROM (EEPROM)), and a data storage device 1016, which can communicate with each other via a bus 1008.

[0104] The processing unit 1002 may be provided by one or more processors, such as a general-purpose processor (e.g., a composite instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, a microprocessor implementing other types of instruction sets, or a microprocessor implementing a combination of multiple types of instruction sets) or a dedicated processor (e.g., an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), or a network processor).

[0105] The computer system 1000 may further include a network interface device 1022 (for example, connected to network 1074). The computer system 1000 may also include a video display unit 1010 (for example, an LCD), a character / number input device 1012 (for example, a keyboard), a cursor control device 1014 (for example, a mouse), and a signal generation device 1020.

[0106] In some embodiments, the data storage device 1016 may include a non-temporary computer-readable storage medium 1024 on which instructions 1026 may be stored that encode one or more of the methods or functions described herein, including components of the FSS 145 and / or anonymization device 150 in Figure 1 (e.g., a decryption device 152, a sanitizer 154, a normalization device 156, etc.) for carrying out the methods described herein.

[0107] Instruction 1026 may also be entirely or partially present in the volatile memory 1004 and / or the processing unit 1002 during its execution by the computer system 1000, and thus the volatile memory 1004 and the processing unit 1002 may also constitute a machine-readable storage medium.

[0108] Although computer-readable storage medium 1024 is shown as a single medium in the illustrative examples, the term “computer-readable storage medium” includes a single or multiple mediums (e.g., a centralized or distributed database, and / or associated caches and servers) that store one or more sets of executable instructions. The term “computer-readable storage medium” also includes any tangible medium capable of storing or encoding a set of instructions for execution by a computer, which causes a computer to perform one or more of the methods described herein. The term “computer-readable storage medium” includes, but is not limited to, solid memory, optical media, and magnetic media.

[0109] The methods, components, and features described herein may be implemented by individual hardware components or integrated into the functionality of other hardware components such as ASICs, FPGAs, DSPs, or similar devices. Furthermore, the methods, components, and features may be implemented by firmware modules or functional circuits within hardware devices. Moreover, the methods, components, and features may be implemented in any combination of hardware devices and computer program components, or in computer programs.

[0110] Unless otherwise specified, terms such as “receive,” “execute,” “provide,” “acquire,” “cause,” “access,” “determine,” “add,” “use,” and “train” refer to actions and processes performed or implemented by a computer system that manipulate data represented as physical (electronic) quantities in the registers and memory of the computer system and convert them into other data similarly represented as physical quantities in the memory or registers of the computer system, or other such information storage devices, transmission or display devices. Furthermore, terms such as “first,” “second,” “third,” and “fourth” as used herein are labels to distinguish different elements and cannot have an ordering meaning due to their numerical designation.

[0111] The examples described herein also relate to apparatus for performing the methods described herein. Such apparatus may include a general-purpose computer system that is specifically constructed for performing the methods described herein, or that is selectively programmed by a computer program stored in the computer system. Such a computer program may be stored in a computer-readable tangible storage medium.

[0112] The methods and exemplary embodiments described herein are not inherently related to any particular computer or other device. Various general-purpose systems may be used in accordance with the teachings described herein, or it may be convenient to construct more specialized devices to perform each of the methods and / or their individual functions, routines, subroutines, or operations described herein. Examples of the construction of various such systems are described above.

[0113] The above description is illustrative and not limiting. While this disclosure has been described with reference to certain exemplary examples and embodiments, it should be recognized that this disclosure is not limited to the described examples and embodiments. The scope of this disclosure should be determined with reference to the following claims, along with the entire scope of equivalents to which the claims are granted.

Claims

1. The first computing system's processor receives a request for manufacturing process data, The steps include requesting a database management system to retrieve the manufacturing process data from a data store using a first encryption key controlled by a first entity and a second encryption key controlled by a second entity, A step of obtaining the manufacturing process data stored in the data store using the database management system, wherein the manufacturing process data is encrypted. The steps include transmitting the encrypted manufacturing process data to a second computing system configured to perform one or more anonymization operations on the manufacturing process data, Methods that include...

2. The method according to claim 1, wherein the encrypted manufacturing process data is decrypted using an encryption key stored by the second computing system.

3. The method according to claim 2, wherein the processor of the second computing system is operable to perform one or more sanitization operations on the decoded manufacturing process data.

4. The method according to claim 2, wherein the processor of the second computing system is operable to perform one or more normalization operations on the decoded manufacturing process data.

5. The method according to claim 1, wherein the processor of the second computing system is operable to transmit anonymized manufacturing process data to the requesting application.

6. A step of receiving anonymized manufacturing process data by the processor of the first computing system, wherein the anonymized manufacturing process data is encrypted. The steps include decrypting the encrypted, anonymized manufacturing process data, The method according to claim 1, further comprising:

7. The method according to claim 1, wherein the one or more anonymization operations are performed in a privacy-enhanced environment.

8. The method according to claim 2, wherein the second computing system and the encryption key are managed by a third entity.

9. The method according to claim 1, wherein the manufacturing process data is encrypted by the processor using the public key of a public-key-private key pair, and the private key of the public-key-private key pair is managed by the second computing system.

10. The method according to claim 1, wherein the request for the manufacturing process data is issued by at least one of the applications hosted on the first computing system or the applications hosted on the third computing system.

11. The step of transmitting to the second computer system an application component associated with one or more anonymization operations or an executable file of at least one application, The method according to claim 1, further comprising:

12. The method according to claim 11, wherein the application component or at least one of the executable files of the application is encrypted.

13. The method according to claim 1, wherein the processor of the second computing system is operable to receive additional data from the third computing system and to perform one or more additional anonymization operations on the additional data.

14. The steps of decrypting the database management system using the first encryption key and the second encryption key, The method according to claim 1, further comprising:

15. The first computing system's processor receives first encrypted data from the second computing system, The steps include receiving second encrypted data from a third computing system, A step of obtaining first decrypted data by decrypting the first encrypted data using a first key, wherein the first key is part of a first public-key-private-key pair managed by the second computing system, A step of obtaining second decrypted data by decrypting the second encrypted data using a second key, wherein the second key is part of a second public-key-private key pair managed by the third computing system, The steps include obtaining output data by performing one or more anonymization operations on the first decrypted data and the second decrypted data, The steps include: encrypting the output data using a third key; The steps include transmitting the encrypted output data to at least one of the second computing system or the third computing system, Methods that include...

16. The method according to claim 15, wherein the one or more anonymization operations are performed in a privacy-enhanced environment.

17. The steps of receiving at least one application component or application associated with one or more anonymization operations from the second computing system, The method according to claim 15, further comprising:

18. The method according to claim 15, wherein the second computing system is managed by the first entity, and the third computing system is managed by the second entity.

19. The method according to claim 15, wherein one of the one or more anonymization operations includes at least one of a sanitization operation or a normalization operation.

20. Data store and A database management system configured to manage data on the aforementioned data store, A processing device operably coupled to the data store and the database management system, Steps include receiving requests for manufacturing process data, The steps of requesting the database management system to retrieve the manufacturing process data from the data store using a first encryption key controlled by a first entity and a second encryption key controlled by a second entity, The steps include: obtaining the manufacturing process data stored in the data store using the database management system, wherein the manufacturing process data is encrypted; The steps include transmitting the encrypted manufacturing process data to a computing system configured to perform one or more anonymization operations on the manufacturing process data, A processing unit that performs operations including, A computing system equipped with [the following features].

Images