Detecting pulse width tampering of signals

Abstract

The sensor system can include a sensor having a charge storage device controllably connected to a voltage source under control of a signal under test, and a readout circuit coupled to the charge storage device that determines whether a pulse width of the signal under test has changed by more than a threshold amount according to the voltage of the charge storage device. In some cases, determining whether the pulse width of the signal under test has changed can include determining whether the voltage satisfies a condition related to a comparison voltage. In some cases, determining whether the pulse width of the signal under test has changed can be based on a propagation delay through a delay chain, the propagation delay being voltage dependent.

Description

[Background technology]

[0001] Tampering with or hacking into electronic systems can allow unauthorized users to access sensitive information. Such tampering can include accessing sensitive information in an unintended manner. One technique that an unauthorized user or attacker may use to obtain such sensitive information is to exploit vulnerabilities in the implementation of a design in an integrated circuit (IC). For example, vulnerabilities may exist that allow an attacker to perform a side-channel analysis attack or a fault exploitation attack.

[0002] An attack by an attacker can involve the manipulation of a time base, such as a clock signal or other control signal, any of which can determine the function of a sensitive operation. Manipulation of a time base is commonly referred to as a clock manipulation attack. In a clock manipulation attack, an attacker manipulates a time base with the intent of causing unintended behavior of the system that can be used to compromise the security of the system. A similar effect occurs when other signals with expected pulse widths (e.g., some control signals) are similarly manipulated. Summary of the Invention [Problem to be solved by the invention]

[0003] Detection of pulse width tampering of a signal is provided. Described herein are sensors and methods of using the sensors that can be used in electronic systems to monitor a signal and determine whether tampering of the signal has occurred with respect to the pulse width of the signal. The signals monitored may include, but are not limited to, clock signals (e.g., a system clock or a cryptographic clock) and control signals (e.g., a reset). The signals monitored may be referred to as "signals under test."

[0004] The sensor system described herein can include a sensor comprising a charge storage device (CSD) controllably connected to a voltage source under control of a signal under test (SUT), and a readout circuit coupled to the CSD. The SUT can directly or indirectly control the connection of the CSD to the voltage source. The readout circuit can determine whether the pulse width of the signal under test has changed by more than a threshold amount according to the voltage of the CSD. The voltage of the CSD is related to the pulse width of the SUT. Thus, the readout circuit can determine whether the pulse width of the SUT has been tampered with based directly or indirectly on the voltage of the CSD. For example, the readout circuit can determine the change in the pulse width of the SUT by determining whether the voltage read from the CSD ("CSD voltage") satisfies a condition on a comparison voltage. The condition can be whether the difference between the CSD voltage and the comparison voltage is greater than a predetermined amount. The readout circuit can include or be coupled to a comparator. As another example, the readout circuit can include a delay chain and can determine the change in the pulse width of the SUT based on the propagation delay through the delay chain (which depends on the CSD voltage).

[0005] A method of operating a sensor can include capturing at least one duty cycle of a pulse width of a signal under test and evaluating the duty cycle to determine whether tampering has occurred. Evaluating the duty cycle can include determining whether the CSD voltage meets a condition on a comparison voltage. In some cases, a sensor enable signal is used to control when the sensor operates. The sensor can operate (to monitor for pulse width tampering) based on a periodic and pre-determined schedule, a random schedule, a trigger event, a trigger command, or a trigger environment or operating condition.

[0006] In some cases, multiple sensors are used to monitor the signal under test and the CSD voltages of each of the multiple sensors are compared to each other to ensure that the voltages are consistent within tolerances. In some cases, multiple sensors are used to monitor different signals under test and the voltage values ​​are compared to check for relative consistency. In some cases, the CSD voltage of a single sensor or from multiple sensors is compared to a preset value.

[0007] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 illustrates an example of an electronic system that can incorporate the pulse width detection described herein.

[0009] [Figure 2A] 2A shows an example implementation of a sensor for detecting pulse width tampering, with FIG 2A showing an implementation using a single switch and FIG 2B showing an implementation using two switches. [Figure 2B] 2A and 2B show example implementations of a sensor for detecting pulse width tampering, with FIG 2A showing an implementation using a single switch and FIG 2B showing an implementation using two switches.

[0010] [Figure 2C] FIG. 2C illustrates an example implementation of a balanced clock tree network.

[0011] [Diagram 3] FIG. 3 is a diagram showing an example implementation of a sensor with a conditioning circuit.

[0012] [Figure 4] FIG. 4 is a process flow diagram of a method for pulse width detection using the sensing system described herein.

[0013] [Diagram 5] FIG. 5 illustrates an example implementation of a signal tree in an electronic system.

[0014] [Figure 6] FIG. 6 illustrates an example implementation of a comparator for comparing VCSD values.

[0015] [Figure 7] FIG. 7 is a graph of VCSD versus time.

[0016] [Figure 8A] FIG. 8A is a diagram showing an example waveform of a signal that may be subject to tamper monitoring.

[0017] [Figure 8B] FIG. 8B is a diagram showing an example of pulse width tampering of the signal shown in FIG. 8A. [Figure 8C] FIG. 8C is a diagram showing an example of pulse width tampering of the signal shown in FIG. 8A. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] Detection of pulse width tampering of a signal is provided. Described herein are sensors and methods of using the sensors that can be used in electronic systems to monitor a signal and determine whether tampering of the signal has occurred with respect to the pulse width of the signal. The signals monitored may include, but are not limited to, clock signals (e.g., a system clock or an encryption clock), control signals, reset signals, status signals, command bus signals, and data bus signals. The signals monitored may be referred to as "signals under test."

[0019] The sensors and methods of using same described herein may be implemented in any electronic system, such as an integrated circuit (IC), system on a chip (SOC), or board level system that includes at least one signal providing a timebase or other periodic signal having a consistent pulse width.

[0020] 1 illustrates an example electronic system that may incorporate the pulse width detection described herein. The example electronic system 100 may have a non-secure power domain 102 and a secure power domain 104, where the power domains represent power delivery mechanisms to the circuits within those domains. That is, the electronic system 100 may include multiple time bases that may or may not be related to each other. For example, the time bases for the non-secure power domain 102 operation may include, but are not limited to, system clocks such as Sys Clk1 106 and Sys Clk2 108. The time bases for the secure power domain 104 operation may include, but are not limited to, a secure power time base (SPTB) 110 that may be used to control a charge distribution system to provide an isolated power supply to power sensitive circuits (e.g., protected block 114) and an encrypted (crypto) clock 112. The electronic system 100 may also generate or use other signals (not shown), including control signals such as reset signals, which may have expected periodic behavior with consistent pulse widths.

[0021] An example of a protected block 114 may be a standard cryptographic cell implementing a cryptographic operation such as AES. The secure power domain 104 may be derived from, independent of, or separate from the non-secure power domain 102. The protected circuit block 114 may be partially or fully powered for part or all of the time as part of the secure power domain 104. For example, the secure power domain 104 may include a power supply consisting of a protective charge storage device and a controlled switch for controlling power to the protected block 114. In some cases, multiple power supplies (e.g., multiple capacitors forming a capacitor system) may be used to power the secure power domain 104. The output of the capacitor system may be an input to the protected block 114.

[0022] The described sensors and detection methods are suitable for systems incorporating secure power domains, since it may be beneficial to be able to detect clock manipulation attacks used to extract sensitive information. For example, the described sensors and detection methods are suitable for detecting manipulation or tampering with the SPTB. However, the sensor systems described herein may be implemented for any time base in the non-secure power domain 102 or the secure power domain 104. Additionally, multiple detection systems and / or sensors may be used to detect manipulation of multiple signals in the electronic system 100.

[0023] 2A and 2B show implementations of a sensor for detecting pulse width tampering. FIG. 2A shows an implementation using a single switch, and FIG. 2B shows an implementation using two switches. Referring to FIG. 2A, a sensor 200A can include a charge storage device 202 controllably connected to a voltage source 204 under direct or indirect control of a signal under test 206. In some implementations, a clock signal can be used as the signal under test 206. Often, the clock signal is constructed as a balanced clock tree network, and the clock signal can directly or indirectly control whether the charge storage device 202 is connected to the voltage source 204.

[0024] 2C illustrates an example implementation of a balanced clock tree network 220. The clock source signal 222 can controllably connect the charge storage device 202 to the voltage source 204 directly (e.g., by being tapped at the source). Alternatively, the clock source signal 222 can controllably connect the charge storage device 202 to the voltage source 204 indirectly, e.g., by being tapped at one of the branches. For example, one of the branches of the balanced clock tree network 224 can be used as a control signal (even though the clock source signal 222 is the intended signal under test in this example scenario). It should be understood that direct / indirect control refers to whether it is the signal under test or a derived signal that is being used, and does not refer to whether there is a conditioning circuit (as described below with respect to FIG. 3) or other components that allow the signal under test to be coupled to the sensor and switch circuitry.

[0025] The read circuit 208 is coupled to the charge storage device 202 and can determine whether the pulse width of the signal under test has changed by more than a threshold amount according to the voltage of the charge storage device. The voltage of the charge storage device 202 is related to the pulse width of the signal under test 206. The read circuit 208 determines whether the pulse width of the signal under test 206 has changed by more than a threshold amount, which can indicate signal tampering. For example, since the voltage of the charge storage device 202 is related to the pulse width of the signal under test 206, the read circuit 208 can determine whether the voltage read out from the charge storage device 202 (V CSD ) satisfies a condition on the comparison voltage, it can be determined whether the pulse width of the signal under test 206 has been tampered with. The condition can be whether the difference between the charge storage device voltage and the comparison voltage is greater than a predetermined amount. As described with respect to FIG. 6, the comparison voltage can be a reference voltage or a voltage from another charge storage device of another sensor. In some cases, the comparison voltage can be the voltage of the charge storage device, but from a different point in time (e.g., the same sensor but a different point in time).

[0026] In some cases, instead of reading the voltage directly from the charge storage device 202, the readout circuitry 208 can indirectly read the voltage of the charge storage device by monitoring the effect of the voltage change. For direct monitoring, the voltage can be measured directly using an analog measurement circuit. For indirect monitoring, the readout circuitry 208 can measure the frequency of an oscillator powered by the voltage or can measure the propagation delay through a chain of gates powered by the voltage of the charge storage device 202, as some examples. The propagation delay of the chain of gates is proportional to the voltage of the charge storage device 202. Thus, in some cases, the readout circuitry 208 can include a delay chain and determine whether the pulse width of the signal under test has changed by more than a threshold amount based on the propagation delay through the delay chain.

[0027] The voltage source 204 may be part of the sensor 200 or may be external to the sensor 200. The signal under test 206 may be, for example, SPTB, a cryptographic clock, a reset signal, or any other pulse signal. The signal under test 206 may provide an input to a switch S1 210 to controllably connect the voltage source 204 and the charge storage device 202. For example, when S1 210 is closed, the charge storage device 202 may charge. Optionally, a second switch S2 212 may be included in the sensor 200, as provided for the sensor 200B shown in FIG. 2B. Referring to both FIG. 2A and FIG. 2B, a third switch S3 214 may be coupled in parallel with the charge storage device 202. When S3 214 is closed, the charge in the charge storage device 202 may be partially or completely discharged.

[0028] Switches S1, S2, and S3 may each be controlled by a characteristic of the signal under test 206. For example, S1 210 and S2 212 may both be controlled by the signal under test 206, and S3 214 may be controlled by the inverse of the signal under test (e.g., the inverted signal under test).

[0029] Although charge storage device 202 is shown in Figures 2A and 2B as a capacitor, other devices capable of holding a charge can also be used for the charge storage device.

[0030] The sensor may or may not need to continuously monitor the signal under test. A command signal may be used to control the monitoring of the signal under test. In some cases, a conditioning circuit may be coupled to the input of the sensor to control the monitoring of the signal under test and to remove transient signals for cleaner switching. FIG. 3 shows an example implementation of a sensor with a conditioning circuit. The conditioning circuit 300 may be, for example, a latching device. The conditioning circuit 300 may be used to latch a positive edge or a negative edge of the input signal under test 306 and remove transient signals before the sensor 302 receives the signal under test. The conditioning circuit may be coupled to receive a command signal 304 and the signal under test 306 (which may be a signal as described with respect to the signal 206 of FIGS. 2A and 2B). The conditioning circuit 300 may receive the command signal 304 from a processor. The processor may be either internal to the electronic system or external to the electronic system. When the conditioning circuit 300 receives the command signal 304 from the processor, monitoring of the signal under test begins.

[0031] The decision to send the command signal can be determined by one or more of the following methods: a periodic and pre-determined schedule, a random schedule, an event-triggered, a command-triggered, or an environmental or operating condition-triggered. Upon receiving a command signal 304 to monitor the signal under test, the conditioning circuit 300 can latch a positive edge or a negative edge of the signal under test 306 and output a transient-removed signal under test 308 to the sensor 302. In some cases, an inverter 310 can be coupled to the output of the conditioning circuit 300 to receive the transient-removed signal under test 308 and provide an inverted signal under test 312 to the switch S3 (e.g., switch S3 214 in FIG. 2A or FIG. 2B). The inverter can be designed with an appropriate delay time so that the voltage across the charge storage device C1 can be measured after C1 is charged.

[0032] A method for detecting pulse width tampering may include capturing a duty cycle of the pulse width of the signal under test and evaluating the duty cycle. FIG. 4 illustrates a process flow for a pulse width detection method using a sensing system described herein. The process 400 may be performed by a sensor system including a sensor and a readout circuit, for example as described with respect to FIGS. 2A and 2B. In a particular example, a conditioning circuit 300 as shown in FIG. 3 may be used to control when the sensor system starts monitoring. That is, if the sensor system includes a conditioning circuit, the method 400 begins when a command signal to start monitoring is sent by the processor. Of course, the monitoring may be controlled by any suitable mechanism and may not even require a trigger (e.g., the sensor system may operate whenever there is power to the electronic system).

[0033] When the sensor system begins monitoring a signal under test (SUT) (402), the sensor may receive a positive edge or a negative edge of the pulse width of the signal under test (404). Upon receiving the positive edge or the negative edge of the pulse width, switches S1 and (optionally) S2 close and S3 opens, allowing the charge storage device (CSD) to begin charging (406). The CSD continues charging until the sensor receives the opposite polarity edge of the pulse width (408). Upon receiving the opposite polarity edge of the pulse width, switches S1 and (optionally) S2 open (410A). Switch S3 receives an inverted signal under test and may therefore close after a small delay (410B), thereby causing the CSD to begin discharging. The CSD may discharge after receiving the first negative edge of the pulse width, or the CSD may store charge for a specified number of multiple pulse cycles. If the CSD accumulates charge for a specified number of multiple pulse cycles, it begins discharging on the negative edge of the final pulse of the specified number of multiple pulse cycles. In either case, between operation 410A and operation 410B resulting from the signal under test, the readout circuitry draws a voltage V from the CSD. CSDThe readout circuit captures (412) the voltage V while all the switches are open, for example, due to delays caused by the signal path of the signal under test through the inverter (or due to other circuitry that controls when switch S3 switches). CSD In some cases, the readout circuitry reads out the voltage while the CSD is accumulating charge, so that the voltage is evaluated while the switch is closed for the duration of the pulse of the signal under test. V CSD When is captured, the readout circuitry reads V CSD to determine whether tampering has occurred (414). As described above, the CSD then discharges (410B).

[0034] FIG. 5 illustrates an example implementation of a signal tree in an electronic system. The signal tree illustrated in FIG. 5 reflects an example path of a signal that may branch through an electronic system. The described sensors may be coupled to any one of the branches in the tree. In some cases, multiple sensors may be placed throughout the electronic system 500 to monitor the signal under test. The signal under test may be, for example, a time base 502 generated by a circuit on a motherboard or other board (not shown) on which the electronic system is located or via an on-chip clock generator. Sensor 504 may be placed to monitor the time base 502 (whether on-chip or off-chip) before the signal tree branches. In some cases, sensor 506 may be placed on branch 505A. Alternatively, multiple sensors, for example, sensors 506 and 508, may be placed on the same branch (e.g., 505A) or on different branches throughout the tree, such as sensor 508 on branch 505A and sensor 510 on branch 505C.

[0035] The time base 502 can be distributed to multiple functional blocks in the electronic system 500 according to a signal tree configuration, so that different branches can operate using the original time base or a variation of the original time base. Each sensor in the signal tree is associated with its V CSDThe voltages read from each sensor for a single branch (e.g., via sensors 506 and 508) can be compared to obtain a V CSD It can be determined whether the value of is within an acceptable range.

[0036] In some cases, multiple sensors (e.g., 508 and 510) located on different branches (e.g., 505A and 505C) can be evaluated, for example to monitor different time bases. The readout circuitry for each sensor can be configured to read the V CSD can be measured and the relative consistency of timebase characteristics such as pulse width can be checked.

[0037] In some cases, a single readout circuit may be switchably coupled to multiple sensors.

[0038] In some cases, multiple sensors may CSD The V from the multiple sensors can be compared to one another or to a preset reference value or set of preset reference values ​​stored in memory. CSD It may include a single comparator circuit that can be used to compare values ​​to determine whether or not the values ​​are within a threshold amount.

[0039] Figure 6 shows the V CSD 6 shows an example implementation of a comparator for comparing values. The comparator system 600 can include a comparator 602 selectively coupled to receive a number of inputs. A controller (not shown) can selectively control the inputs to the comparator 602 using a switching mechanism 604. The switching mechanism 604 can be an array of switches. The controller can be a dedicated controller or part of the electronic system. The inputs can include V captured from various sensors (via corresponding readout circuitry) throughout the electronic system. CSD In some cases, one or more preset values ​​stored in a memory may be used as the reference voltage for the comparator 602.

[0040] The controller selectively controls the inputs to the comparators to generate V CSD Value,V on the same branch of the signal tree CSD Value, or V CSD The value can be compared to a preset reference value. In some cases, the previous V CSD Use the value as the input to a comparator to determine the current V CSD Value of that V CSD 6. Compare the V CSD The value is V CSD1 , V CSD2 , ..., V CSDn It is expressed as V CSD If the difference between the values ​​is greater than a threshold, the comparator 602 outputs an "alert" signal to alert the electronic system to the possible tampering. The electronic system can then initiate countermeasures to mitigate damage from the attack. Alternatively, the comparator system 600 can include multiple comparators (not shown) to selectively compare multiple inputs simultaneously. For example, the comparator system 600 can include multiple two-input comparators to compare voltages from multiple inputs two by two.

[0041] Figure 7 shows the V CSD A graph of the V vs. time is shown. CSD The value of V is directly related to the time the CSD is allowed to charge. CSD Voltage threshold range for values ​​of T clk_max and T clk_min V CSD If the value of V lies between these thresholds, the signal under test can be considered untampered. CSD V CSD increases with time until it reaches a saturation point where V reaches its maximum operating limit, which is determined by the physical constraints of the CSD. If the pulse width is shorter than expected, the CSD is not allowed to fully charge and V CSDIf the pulse width is longer than expected, the CSD will charge above the threshold amount.

[0042] FIG. 8A shows an example waveform of a signal that may be subject to tamper monitoring, and FIGS. 8B and 8C show examples of pulse width tampering of the signal shown in FIG. 8A. Tampering is shown at duty cycle 3 in both FIG. 8B and FIG. 8C. In FIG. 8B, the shortened duty cycle results in a lower than expected V CSD In Figure 8C, the extended duty cycle leads to a higher than expected V CSD leads to.

[0043] Although the subject matter has been described in language specific to structural features and / or operations, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or operations described above. Rather, the specific features and operations described above are disclosed as example forms of implementing the claims, and other equivalent features and operations are intended to be within the scope of the claims.

Claims

1. 1. A sensor system comprising: a sensor comprising a charge storage device controllably connected to a voltage source under control of a signal under test having an expected periodic behavior with consistent pulse width, the charge storage device controllably connected to the voltage source by at least one switch; a conditioning circuit coupled to the at least one switch, the conditioning circuit being coupled to receive a command signal and the signal under test and to output the signal under test, with transient signals removed, to the at least one switch, the charge storage device charging when the at least one switch is closed by the signal under test; a read circuit coupled to the charge storage device that determines whether a pulse width of the signal under test has changed by more than a threshold amount in accordance with a voltage of the charge storage device; The voltage of the charge storage device is related to the pulse width of the signal under test.

2. The sensor system of claim 1 , wherein the sensor further comprises a discharge switch coupled in parallel with the charge storage device.

3. The sensor system of claim 2 , wherein the discharge switch is controlled by an inverse of the signal under test.

4. The sensor system according to any one of claims 1 to 3, wherein the readout circuit determines whether the pulse width of the signal under test has changed by more than the threshold amount by determining whether the voltage satisfies a condition regarding a comparison voltage.

5. The sensor system of claim 4 , wherein the comparison voltage is a reference voltage.

6. The sensor system of claim 4 , wherein the comparison voltage is a voltage from another charge storage device of another sensor.

7. The sensor system of claim 4 , wherein the comparison voltages are from the same sensor but from different times.

8. 8. The sensor system of claim 1, wherein the readout circuit includes a comparator that receives the voltages read out from the charge storage devices and compares the voltages read out from the charge storage devices with each other or with a preset reference value.

9. The sensor system of any one of claims 1 to 8, wherein the signal under test is a clock signal, a reset signal, a control signal, a status signal, a command bus signal, or a data bus signal.

10. 1. A method for detecting pulse width tampering of a signal, comprising: receiving an edge of a pulse of a signal under test having an expected periodic behavior with consistent pulse width, the edge being a positive edge or a negative edge; controllably coupling, by at least one switch, a charge storage device to a voltage source for the duration of a pulse of the signal under test; receiving, by a conditioning circuit coupled to the at least one switch, a command signal and the signal under test; outputting the signal under test from which a transient signal has been removed by the adjustment circuit to the at least one switch; reading a voltage value from the charge storage device that charges when the at least one switch is closed by the signal under test; disconnecting the charge storage device from the voltage source after receiving an edge of the opposite polarity of the pulse of the signal under test; determining whether the voltage value satisfies a condition related to a comparison voltage to determine the occurrence of pulse width tampering.

11. The method of claim 10 , wherein the signal under test is a clock signal.

Images