Tamper-resistant circuits, post-process memory, and physical unclonability for supply chain protection

Abstract

Tamper-resistant memory is formed by placing a solid-state memory array between metal wiring layers in the upper portion of an integrated circuit (post-processing). The metal layers form a mesh that surrounds the memory array, protecting it from picosecond imaging circuit analysis, side-channel attacks, and delayering by electrical measurements. The interconnects between the memory cells and their measurement circuitry are designed to protect each layer below; that is, the interconnect metal portion in a particular metal layer is equal to or greater than the interconnect metal portion in the next layer below. The measurement circuitry is covered by the metal mesh. The substrate, metal layers, and memory array are part of a single monolithic structure. The memory array, adapted for chip identification protocols, contains a physical, unclonable functional identifier that uniquely identifies the tamper-resistant integrated circuit, a symmetric encryption key, and an unlock key.

Description

[Technical field]

[0001] The present invention relates generally to integrated circuits, and more particularly to tamper-resistant integrated circuits having non-volatile memory for storing secret information such as trusted functions or cryptographic keys. [Background technology]

[0002] Integrated circuits are used in a wide variety of electronic applications, from simple devices such as watches to the most complex computer systems. A microelectronic integrated circuit (IC) chip can generally be thought of as a collection of logic cells with electrical interconnections between the cells, formed on a semiconductor substrate (e.g., silicon). An IC may contain a very large number of cells, requiring complex connections between the cells. A cell is a group of one or more circuit elements, such as transistors, capacitors, resistors, inductors, and other basic circuit elements, that combine to perform a logical function. Types of cells include, for example, core cells, scan cells, input / output (I / O) cells, and memory (storage) cells. Each of the cells of an IC may have one or more pins, and each of the pins may be connected by wires to one or more other pins of the IC. The wires connecting the pins of the IC are also formed on the surface of the chip. In more complex designs, there may be many separate layers of conductive media available for wiring, such as polysilicon layers and multiple metal layers (metal 1, metal 2, etc.).

[0003] IC chips are manufactured by first devising a logical circuit description and then translating that logical description into a physical description or geometric layout. This process is usually performed using a "netlist", which is a record of all the nets or interconnects between cell pins, including information about various components such as transistors, resistors, and capacitors. The layout is typically composed of a series of planar geometric shapes in several layers. The layout is then checked to ensure that it meets all of the design requirements, especially timing requirements. The result is a set of design files known as intermediate forms that describe the layout. The design files are then run through a "dataprep" process, which is used to generate patterns, called masks, by optical or electron beam pattern generators. During manufacturing, these masks are used to etch or deposit features into silicon wafers in a series of photolithography steps.

[0004] As humans become more dependent on electronic systems and autonomous machines that use integrated circuits, there are growing concerns about the hardware security of these devices. Chip designers are increasingly attempting to maintain the confidentiality of the proprietary designs of integrated circuits. In more complex systems, it is also desirable to prevent unauthorized parts from being substituted. Various approaches have been devised to address these concerns, particularly by enabling "trusted" chips and circuit boards. For example, the Trusted Platform Module (TPM) is an international standard for crypto-processors dedicated to protecting hardware through an integrated cryptographic key. TPMs can create nearly unforgeable hash key summaries of hardware and software configurations. This allows a third party to verify that the software has not been altered.

[0005] Security measures also include a physical unclonable function. A physical unclonable function (PUF) is a device that uses inherent randomness introduced during manufacturing to give a physical entity a unique "fingerprint" or trust anchor. PUFs can be used to provide a unique, unpredictable identification number for each chip that is generated during manufacturing.

[0006] Another technique for protecting circuits is obfuscation circuitry, which involves modifying the structure of an integrated circuit to intentionally conceal its functionality. One way this modification can be done is by splitting the manufacture of an IC chip into two parts: a "trusted" part and an "untrusted" part. The untrusted chip or base manufactured front-end of the line (FEOL) forms the core of the chip's functionality, while the wiring for the logic is manufactured in trusted facilities as the back-end of the line (BEOL). In this way, the chip owner can maintain confidentiality of the details of the hidden wiring.

[0007] In addition to these techniques, physical security can be provided by various styles of tamper-resistant packaging. The packaging can be designed to electronically detect possible tampering and take some action such as generating an alarm, deleting the cryptographic keys, or zeroing them. Some hardware is capable of cold zeroisation, which allows zeroisation without enabling normal system power. Custom-made encapsulation methods used for chips employed in some crypto products are designed to internally pre-stress the chip and therefore physically break if it is tampered with. One example of a secure cryptoprocessor with tamper-resistant packaging is the IBM® 4758 cryptographic coprocessor sold by International Business Machines Corporation. Summary of the Invention

[0008] The present invention generally relates to an integrated circuit comprising: a substrate having a plurality of logic cells forming an operational circuit; a plurality of metal wiring layers disposed on the substrate and providing wiring for the operational circuit, the metal wiring layers including a first metal wiring layer overlying a second metal wiring layer; and a memory array of solid state non-volatile memory cells disposed between the first metal wiring layer and the second metal wiring layer, the first metal wiring layer and the second metal wiring layer having metal portions that together form a metal mesh at least partially surrounding the memory array. In one embodiment, the substrate includes measurement circuitry for the solid state non-volatile memory cells, a given one of the solid state non-volatile memory cells being connected to a corresponding one of the measurement circuitry via a vertical stack of interconnect metal portions in the plurality of metal wiring layers, the footprint of a given one of the interconnect metal portions in a particular metal wiring layer being equal to or larger than the footprint of a next interconnect metal portion in a next lower metal wiring layer below the particular metal wiring layer. Because the memory array is fabricated in a back-end process, the fabrication can preferably be performed in a trusted foundry. In an exemplary embodiment, each measurement circuit has a differential sense amplifier that provides a constant current flow for the memory cell measurement to prevent picosecond imaging circuit analysis of the semiconductor non-volatile memory cells. Advantageously, the substrate, metal layers and memory array may be constructed as part of a single monolithic structure. In an embodiment adapted for a chip identification protocol, the memory array includes a physical unclonable functional identifier that uniquely identifies the tamper-resistant integrated circuit, an encryption key, and an unlock key.

[0009] The above as well as additional objects, features and advantages of various embodiments of the present invention will become apparent in the following detailed description. [Brief description of the drawings]

[0010] The present invention may be better understood, and its numerous objects, features and advantages of various embodiments will become apparent to those skilled in the art by referencing the accompanying drawings.

[0011] [Figure 1] 1 is a cross-sectional elevation view of an integrated circuit showing a tamper-resistant non-volatile memory and various metal wiring layers according to one embodiment of the present invention. [Diagram 2] 2 is a schematic diagram of a memory read circuit using current-mode logic latches for use in reading a memory cell of the tamper-resistant nonvolatile memory of FIG. 1 in accordance with one embodiment of the present invention. [Diagram 3] 3 illustrates the active silicon area of ​​a particular transistor pair of the memory read circuit of FIG. 2, according to one embodiment of the present invention. [Figure 4] FIG. 2 is a plan view of a tamper-resistant non-volatile memory according to one embodiment of the present invention showing particular metal wiring layers for word lines and bit lines and active silicon areas for a differential amplifier. [Diagram 5] 2 is a cross-sectional elevation view of an integrated circuit illustrating bit line wiring of a tamper-resistant non-volatile memory according to one embodiment of the present invention. [Figure 6] 1 is a chart illustrating a logical flow of a trusted manufacturing, chip obfuscation, and encryption process according to one embodiment of the present invention. [Figure 7] 1 is a pictorial representation of chip identification in the field using symmetrical encryption, according to one embodiment of the present invention. [Figure 8] 4 is a chart illustrating the logic flow of a chip identification protocol using symmetric encryption according to one embodiment of the present invention.

[0012] The use of the same reference symbols in different drawings indicates similar or identical items. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Techniques like tamper-resistant circuits, obfuscation, and physical unclonability go a long way in protecting the supply chain of chips and boards for critical systems like networking, trucks, ships, energy production, etc., and are also very useful in preventing the introduction of unauthorized chips and boards. However, all of these techniques require secret or hidden data, such as a PUF identification number or cryptographic key, and this data must be kept secret for the protection to work. It is difficult to store digital information like a secret key in a device that is resistant to physical attacks. Current solid-state memories can be read non-invasively, or invasively with some effort, using techniques like picosecond imaging circuit analysis (PICA) and delayering by measurement. Traditional memory technologies like electrically programmable read-only memory (EPROM), static random access memory (SRAM), dynamic random access memory (DRAM), flash memory, and electrically programmable fuse memory (eFuse) are all vulnerable to these techniques. Other methods, such as spying on current consumption while the memory is running (side-channel attacks), may allow a malicious actor to infer memory state. Additionally, tamper-resistant packaging, such as that found in the IBM® 4758 cryptographic coprocessor, is too expensive and infeasible for most supply chain concerns. Also, these packaging solutions cannot be monolithically integrated with silicon technology.

[0014] It is therefore desirable to devise an improved tamper-resistant memory for supply chain protection. It would be even more advantageous if the tamper-resistant memory could be monolithically integrated with other circuits such as a microprocessor. These and other advantages are achieved in various embodiments of the present invention by providing a tamper-resistant memory that uses an array of solid-state memory cells at least partially surrounded by a metal mesh formed from metal wiring layers of an integrated circuit chip as part of back-end (BEOL) chip fabrication. In a preferred embodiment, the memory is a resistive random access memory (ReRAM). The mesh pitch provides a spacing for PICA readout of the memory that is smaller than the wavelength of an infrared camera. Delayering and electrical measurements can be prevented by providing an area of ​​metal in the metal layer n+1 above the memory array that is equal to or greater than the area of ​​metal in the metal layer n below the memory array, and ensuring that the lower level metal does not extend beyond the edges of the upper level regions. The read / write circuitry for the cells can also be placed below these memory metal layers without extending beyond the edges of the lowest memory metal layer. By using differential circuitry to read the memory values, electrical side-channel attacks and PICA reads are further thwarted. By providing this improved protection, along with providing for the manufacturing and programming of the memory in trusted facilities, secrets stored in the memory remain undiscoverable by current reverse engineering techniques.

[0015] Referring now to the figures, and in particular to FIG. 1, there is shown one embodiment 10 of a tamper-resistant integrated circuit constructed in accordance with the present invention. The tamper-resistant integrated circuit 10 includes a trusted portion (BEOL) 12 and an untrusted portion (FEOL) 14. The trusted portion 12 may be fabricated separately from the untrusted portion 14 and the two portions attached thereafter, or the trusted portion 12 may be fabricated above the untrusted portion 14 such that the integrated circuit 10 has a monolithic (single) design. Each circuit portion has wiring in various horizontal metal layers m1-m6, with layers m1-m2 being FEOL and layers m3-m6 being BEOL. Logic cells are formed on a semiconductor substrate 16 (e.g., silicon) to form the core operating circuitry of the integrated circuit 90 according to the particular design at hand. The integrated circuit 90 may have other layers not depicted, e.g., polysilicon layers. Vias provide vertical connections between adjacent horizontal layers and the logic cells in the silicon layer 16. According to this embodiment, the untrusted portion 14 is manufactured by an untrusted foundry and the trusted portion 12 is manufactured by a trusted foundry.

[0016] The trusted portion 12 includes an array of solid-state non-volatile memory cells 18 disposed between metal layers m3 and m5. In this cross-sectional view, not all connections in the metal layers are shown for all memory cells. Also, some of the illustrated metal wiring, such as wiring in layers m5 and m6, are used by other unrelated circuitry, e.g., power or signal. Although only one row of memory cells is shown, it is understood that there may be many rows of cells arranged side-by-side in the array. In some embodiments of the invention, as described further below, the memory cells 18 may include one or more keys, such as a PUF key, an encryption key, and an unlock key. The memory cells 18 are preferably resistive random access memory (ReRAM), although other memory types, e.g., magnetoresistive random access memory (MRAM), phase change memory (PCM), or conductive bridge random access memory (CBRAM), may be used. The metal of layer m4 overlies the memory array, as do the metal interconnects of layer m3. In this manner, the two metal wiring layers form a protective mesh that at least partially surrounds the array, thereby creating a tamper-resistant memory. In an exemplary embodiment, the mesh completely surrounds the top and bottom of the array.

[0017] In some embodiments, the read circuit for the tamper-resistant memory uses a differential amplifier to make the memory PICA read-resistant and side-channel tamper-resistant. FIG. 2 shows one embodiment of such a differential ReRAM measurement circuit 20 suitable for use with the tamper-resistant memory of the present invention. The differential ReRAM measurement circuit 20 includes a front-end circuit 22 and a current-mode logic (CML) latch circuit 24. The front-end circuit 22 generates two bit lines (Bit Line 1 and Bit Line 2) from the word line of the ReRAM cell m, and the CML latch circuit 24 captures each bit line and generates complementary output signals (OUT+ and OUT-). The CML latch circuit 24 is particularly useful for converting very small voltage differences (e.g., a few millivolts) into logic 0 or 1 values ​​using higher system (chip) voltage levels.

[0018] Word line WL from memory cell m + is connected to a first resistor 26 (R1) and the complement of the word line WL m - is connected to a second resistor 28 (R2). Resistors 26, 28 are respectively connected to the drains of two foot transistors 30, 32. The sources of the foot transistors 30, 32 are connected to system ground. The gates of each foot transistor 30, 32 are connected to a respective bias voltage V b1 , V b2 The bias voltages can be selected based on the specific specifications of the ReRAM cell and can be the same voltage. This allows resistors 26, 28 to create a voltage difference ΔV between bitline 1 and bitline 2. m , which is amplified and latched by the CML latch circuit 24. When the ReRAM cell holds a logic "1" value at its local voltage level, the voltage difference ΔV is relatively large, the value of the output signal OUT+ is logic "1" (system high voltage) and the value of the output signal OUT- is logic "0". Conversely, when the ReRAM cell holds a logic "0" value (zero voltage), the voltage difference ΔV is low or zero, the value of the output signal OUT+ is logic "0" and the value of the output signal OUT- is logic "1".

[0019] Figure 2 shows how the same latch circuit can be used to read other memory cells in the memory array, for example cell m-1, which is selected by activating a different word line. The unselected word lines remain open, and therefore the δV from the selected word line m m The other word line resistors only add a small amount of parasitic capacitance that does not affect the read operation.

[0020] In a preferred embodiment, the foot transistors 30, 32 together form a differential circuit implemented with two field effect transistors (FETs) in a common active (conductive) area of ​​the silicon substrate for PICA read immunity. Figure 3 shows a diagrammatic representation of such a differential circuit in an active silicon island RX. The voltage from resistor 26 is applied to the first drain region D1 of the foot transistor 30 and the voltage from resistor 28 is applied to the second drain region D2 of the foot transistor 32. The drains D1 and D2 are part of the same diffusion for a double gate design with a common source region S. If the voltage of the gate G1 is higher than the threshold voltage and the voltage of the gate G2 is lower than the threshold voltage, the current flows from the drain region D1 to the source region S. If the voltage of the gate G2 is higher than the threshold voltage and the voltage of the gate G1 is lower than the threshold voltage, the current flows from the drain region D2 to the source region S. The current is kept constant through the active area RX, so that constant PICA radiation and switching states and activities cannot be detected. The RX region conducts heat well, so the PICA readout cannot distinguish whether the output current of the differential circuit comes from the + or - branch. The power usage also remains constant, so the switching state and activity cannot be detected by thermal / acoustic measurements.

[0021] 3 can also be applied to the other transistor pairs of the CML latch circuit 24, as shown by the dashed boxes for the input transistor pair 34, the clock gating transistor pair 36, the voltage regulator transistor pair 38, and the output transistor pair 40. In this manner, the PICA readout of the latch circuit is similarly disabled.

[0022] FIG. 4 is a plan view showing how metal layers m2, m3, and m3 can be arranged for an embodiment having a differential amplifier in a single RX island. Five m4 horizontal strips are shown in FIG. 4 extending across the design from left to right, with the top and bottom strips "m4 shield" providing shielding for the memory array. Seven m3 vertical strips are shown in FIG. 4 extending from top to bottom across the design, with the leftmost and rightmost strips "m3 shield" providing shielding for the memory array as well. A pair of word lines WLm+ and WLm- in the m4 layer connect the active area RX of memory cell m. m1 Only one differential word line in the memory array is active at a time, while the other memory cells (one of which is RX m2 All bits along that word line can be read simultaneously from the metal pitch P (shown as R1, R2, R3) of the m3 layer. A pair of bit lines BL1 and BL2 of the m3 layer is used to read the value of memory cell m. The word line and bit line pitch P preferably provides a spacing of less than an infrared camera wavelength, or about 1.3 micrometers, to prevent picosecond imaging circuit analysis (PICA) of the memory. In alternative embodiments, the spacing is even smaller, effectively building a Faraday cage around the memory. Generally, the holes in the Faraday cage should be less than about 1 / 10 of the detector wavelength, so in such embodiments the metal spacing is less than about 0.13 micrometers. This configuration further protects the memory array from side channel attacks as well as delayering and measurement. In the embodiment of FIG. 4, a given differential amplifier RX is larger than the metal pitch P, so the differential amplifiers are interleaved to read out all of the differential Rn / Rn+1 bits. The differential amplifiers can be placed in the center of the memory array to reduce bit line resistance. Other metal layer features such as latches, ground connections, and bias voltages are not shown to keep the representation of Figure 4 manageable. Similarly, it will be understood that the drawing of Figure 4 is not to scale.

[0023] A given memory cell is connected to its read / write circuitry in the silicon substrate 16 through vertical interconnects with multiple metal layers, in this example layers m1, m2, and m3. Each metal layer in the interconnect can be designed to protect the layer below, i.e., its footprint is larger than (or at least equal to) the footprint of the next lower layer below each cell. This structure improves resistance to delayering and voltage probing. The read / write circuitry for each memory cell can also be located under the footprint of the metal layer (in this case m4) that forms a shroud over the tamper-resistant memory, and under the interconnect portion of metal layer m4. Figure 5 shows how the bottom metal layers can be configured for the bitline wiring of the memory cells. In this embodiment, the first bitline 50a of memory cell R1 is a single vertical stack, and the second bitline 50b of the same memory cell R1 is zig-zag across two adjacent vertical stacks to achieve the differential circuit configuration described above. Thus, each metal layer of the vertical stack of bitline 50a protects the previous layer. For bitline 50b, an additional metal portion 52 connected to system ground is provided in metal layer m1 directly below the bitline connection to the memory cell to protect the first portion of that bitline. Shallow deep trench isolation (STI) blocks 54 can be used to prevent leakage currents between adjacent devices. The bitlines of the other memory cells of the memory array are similarly spread out, as shown by bitlines BLi and BLi+1 of memory cell Ri.

[0024] In addition to the side shielding of the memory array provided by the m3 layer ("m3 shield" in Figure 4), additional side shielding may be provided by the m1 and m2 layers to also protect the bitlines, as shown at 54, 56.

[0025] The description herein may, for convenience and to conform to the illustration of the embodiments as presented in the figures, refer to terms such as above / below, upper / lower, and horizontal / vertical. These terms are also typically used in describing integrated circuit structures in this manner, e.g., horizontal metal layers. However, those skilled in the art will understand that these terms are relative and that different orientations or perspectives may result in the use of other terms that are equivalent.

[0026] As discussed above, the tamper-resistant memory of the integrated circuit 10 can be used to hold a variety of secrets, including one or more keys, such as encryption and decryption keys, as well as a PUF identification number or serial number. One embodiment in which all of these types of secrets are used for chip identification and activation is described with reference to FIGS. 5-7. However, those skilled in the art will appreciate that a wide variety of secrets can be stored in the tamper-resistant memory for other purposes. For example, tamper-resistant memories are very useful for encoding obfuscation functions, such as Boolean functions. Further details of a tamper-resistant memory having a reliable Boolean obfuscation function are provided in co-pending U.S. patent application Ser. No. 2005 / 0233634, entitled "TAMPER RESISTANT OBFUSCATION CIRCUIT," filed concurrently herewith. issue (Attorney Docket No. P201909869US01), which is incorporated herein by reference.

[0027] The features of the encryption key, decryption key, and PUF ID can be further understood with reference to the chart of FIG. 6, which illustrates the logic flow of a trusted manufacturing, chip identification, and encryption process 100 according to one embodiment of the present invention. The process 100 can be broken down into two sets of steps 102, 104. Step 102 is performed by an untrusted foundry, and step 104 is performed by a trusted foundry. The process 100 begins with the untrusted foundry setting up 106 the chip manufacturing based on a particular layout provided. Untrusted manufacturing 108 is then performed for the front-end logic and metal layers. At this point, the process is handed over to a trusted foundry, which performs trusted manufacturing 110 for the remaining back-end processes including the tamper-resistant memory. Any final steps such as packaging are performed to complete 112 the chip manufacturing. The tamper-resistant memory is written 114 with the encryption key. The tamper-resistant chip 10 includes appropriate pins to allow the memory cells to be programmed. The unlock key is also written to the tamper-resistant memory 116. The chip's PUF identifier is synthesized and loaded into the tamper-resistant memory 118. The chip is now ready for deployment.

[0028] Including all three of the unlocking key, encryption key, and PUF identifier in a tamper-resistant memory provides significant advantages in identifying chips that are already deployed. Techniques such as chip challenge / response can be exhaustively probed by malicious actors and are therefore not a secure solution. FIG. 7 shows an example 120 of how chip identification in the field can be accomplished using symmetric encryption. A server or other computer system 122 is used to manage the identification and unlocking functions of multiple chips 124 (chip 1 through chip m). The server 122 is preferably a cloud server operating in a cloud environment. Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the provider of the service. This cloud model can include a variety of characteristics, service models, and deployment models.

[0029] Characteristics may include, but are not limited to, on-demand service, wide area network access, resource pooling, rapid elasticity, and metered service. On-demand self-service refers to the ability of cloud consumers to automatically and unilaterally provision computing capacity, such as server time and network storage, as needed without the need for human interaction with the provider of the service. Wide area network access refers to the ability to be available over a network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and personal digital assistants). Resource pooling occurs when a provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated depending on demand. There is a sense of location independence in that consumers generally do not control or know the exact location of the resources provided, but may be able to specify a location (e.g., country, state, or data center) at a higher level of abstraction. Rapid elasticity means that functionality can be provisioned quickly and elastically, sometimes automatically, to scale out quickly, release quickly, and scale in quickly. To the consumer, the functionality available for provisioning often appears unlimited and can be purchased at any time and in any quantity. Metering service is the ability of a cloud system to automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both the provider and consumer of the utilized service.

[0030] Service models may include, but are not limited to, Software as a Service, Platform as a Service, and Infrastructure as a Service. Software as a service (SaaS) refers to the capability provided for a consumer to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin client interfaces such as web browsers. With the possible exception of limited user-specific application configuration settings, the consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functions. Platform as a service (PaaS) refers to the capability provided for a consumer to deploy applications created or acquired by the consumer on a cloud infrastructure, created using programming languages ​​and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does control the deployed applications and possibly the configuration of the application hosting environment. Infrastructure as a service (IaaS) refers to the capability provided to consumers to provision processing, storage, network, and other basic computing resources on which the consumer can deploy and run any software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but do control the operating systems, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0031] Deployment models can include, but are not limited to, private cloud, community cloud, public cloud, and hybrid cloud. A private cloud refers to a cloud infrastructure that is operated solely for an organization. It may be managed by the organization or a third party and may exist on-premise or off-premise. A community cloud has a cloud infrastructure that is shared by several organizations to support a specific community with common concerns (e.g., mission, security requirements, policies, and compliance considerations). It may be managed by the organization or a third party and may exist on-premise or off-premise. In a public cloud, the cloud infrastructure is made available to the general public or large industry groups and is owned by the organization that sells the cloud services. In a hybrid cloud, the cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that allow for data and application portability (e.g., cloud bursting for load balancing between clouds).

[0032] Returning to FIG. 7, the chips 124 are assembled into one or more devices with communication hardware that allows the chips to communicate with external networks. The cloud server 122 can thereby communicate with the chips 124 over a network 126, such as the Internet. Each chip has a PUF key IC.i, an unlocking key, and an encryption key loaded into the chip's tamper-resistant memory. Each PUF key is used to uniquely identify its respective chip, and the unlocking key is used to authorize unlocking of the PUF identifier. The cloud server 122 can access a chip identification database 128 that contains all of the PUF keys, unlocking keys, and encryption keys that are symmetric with the encryption keys in the chip. When identification of a particular chip is desired, the cloud server 122 sends an identification request to the chip according to one or more secure protocols. The chip can then send its PUF key back to the cloud server 122, which can verify the PUF key to identify the particular chip.

[0033] A number of different protocols may be used to verify the chip identification. The protocols are preferably adapted to prevent man-in-the-middle attacks as well as any misrepresentation of the chip or cloud. Also, the protocols can advantageously be designed to be secure even if the communication link is not secure or if the chip or local device is not trustworthy. One suitable protocol 130 is shown in FIG. 8 and uses symmetric encryption according to an exemplary embodiment. The protocol 130 begins when the cloud server receives a request for chip identification (132). The cloud server sends a transmission to the chip with a first initialization vector and a decryption key encrypted with an encryption key based on the initialization vector (134). Here, the initialization vector is randomly generated and used to generate different encrypted transmissions even when the same data is transmitted, preventing man-in-the-middle attacks. When the chip receives this transmission, the chip decrypts the decryption key and compares it to the corresponding decryption key currently stored in the tamper-resistant memory (136). If the two keys do not match, random data is sent (138) to prevent the PUF key from being disclosed to unknown parties. Because the unlock key is encrypted, it cannot be discerned using a rogue chip.

[0034] If the two unlock keys match, the chip confirms the chip identity by sending (142) a response transmission to the cloud server with the second initialization vector and its PUF key encrypted with an encryption key based on the initialization vector. The cloud server decrypts (144) the transmission to determine if the decrypted PUF key matches any of the PUF identifiers in the database. If there is a match, the chip is deemed good (146) and the system of which it is a part can be considered trusted. If the decrypted PUF key does not match anything in the database (which would be the result from any random data in transmission 138), the chip is marked (148) as unknown, i.e., untrusted. The results can be provided to a system administrator. The protocol 130 is effective even when the communication channel is untrusted and the end device containing the chip that needs to be programmed is untrusted.

[0035] The present invention, in its various embodiments, provides a good solution to supply chain protection by establishing a reliable way to identify trusted chips. This method prevents unauthorized chips from being inserted into the system. Circuit boards can also be protected by inserting an identification chip into the board, thereby marking the board as a good board, preventing unauthorized boards from being inserted into the system. Due to its small volume, the tamper-resistant chip can also be inserted into any object that needs to be identified and can be identified via wireless or wired contact. The tamper-resistant memory can be used to store additional information such as block chain records involved in the product's supply chain, making it possible to store all transactions along the supply chain within the chip.

[0036] Although the present invention has been described with reference to specific embodiments, this description is not intended to be construed in a limiting sense. Various modifications of the disclosed embodiments, as well as alternative embodiments of the invention, will become apparent to those skilled in the art upon reference to the description of the invention. It is therefore contemplated that such modifications can be made without departing from the scope of the invention as defined in the appended claims.

Claims

1. 1. An integrated circuit comprising: a substrate having a plurality of logic cells forming operational circuits; a plurality of metal wiring layers disposed over the substrate, at least a portion of which provide wiring for the operational circuitry, the plurality of metal wiring layers including a first metal wiring layer overlying a second metal wiring layer; a memory array of solid state non-volatile memory cells disposed between the first metal wiring layer and the second metal wiring layer, the first metal wiring layer and the second metal wiring layer having metal portions that together form a metal mesh at least partially surrounding the memory array; wherein the substrate includes measurement circuits for the solid state non-volatile memory cells, each measurement circuit having a differential sense amplifier that provides a constant current flow for memory cell measurements to prevent picosecond imaging circuit analysis of the solid state non-volatile memory cells.

2. 10. The integrated circuit of claim 1, wherein the metal mesh has a spacing of 1.3 micrometers or less.

3. A given one of the solid-state non-volatile memory cells is connected to a corresponding one of the measurement circuits via one or more vertical stacks of interconnect metal portions in a plurality of metal wiring layers; the footprint of a given one of the interconnect metal portions in a particular metal wiring layer is equal to or larger than the footprint of a next metal portion in a next lower metal wiring layer immediately below the particular metal wiring layer; 10. The integrated circuit of claim 1.

4. 4. The integrated circuit of claim 3, wherein said measurement circuitry is covered by said metal mesh, and metal portions of an additional metal wiring layer are provided along sides of said memory array to shield said measurement circuitry.

5. 2. The integrated circuit of claim 1, wherein said substrate, said plurality of metal wiring layers, and said memory array are part of a single monolithic structure.

6. 2. The integrated circuit of claim 1, wherein said solid-state non-volatile memory cells are resistive random access memories.

7. 2. The integrated circuit of claim 1, wherein said memory array includes a physical unclonable functional identifier that uniquely identifies said integrated circuit.

8. 8. The integrated circuit of claim 7, wherein the memory array further includes encryption and decryption keys.

9. 1. A tamper-resistant integrated circuit, comprising: a substrate having a plurality of logic cells forming operational circuits; a plurality of metal wiring layers disposed over the substrate, at least a portion of which provide wiring for the operational circuitry, the plurality of metal wiring layers including a first metal wiring layer immediately above a second metal wiring layer; a memory array of solid state non-volatile memory cells disposed between the first metal wiring layer and the second metal wiring layer, the first metal wiring layer and the second metal wiring layer having metal portions that together form a metal mesh having a spacing of 1.3 micrometers or less surrounding the memory array, the substrate, the metal wiring layers, and the memory array being part of a single monolithic structure, the substrate including measurement circuits for the solid state non-volatile memory cells, each measurement circuit having a differential sense amplifier that provides a constant current flow for memory cell measurements to prevent picosecond imaging circuit analysis of the solid state non-volatile memory cells; A tamper-resistant integrated circuit comprising:

10. a given one of the solid-state non-volatile memory cells is connected to a corresponding one of the measurement circuits via one or more vertical stacks of interconnect metal portions in a plurality of metal wiring layers; the footprint of a given one of the interconnect metal portions in a particular metal wiring layer is equal to or larger than the footprint of a next metal portion in a next lower metal wiring layer immediately below the particular metal wiring layer; 10. The tamper-resistant integrated circuit of claim 9.

11. 11. The tamper-resistant integrated circuit of claim 10, wherein the measurement circuitry is covered by the metal mesh, and metal portions of an additional metal wiring layer are provided along the sides of the memory array to shield the measurement circuitry.

12. 12. The tamper-resistant integrated circuit of claim 11, wherein said memory array contains a physical unclonable functional identifier that uniquely identifies said tamper-resistant integrated circuit, an encryption key, and a decryption key.

13. 1. A method for verifying the identity of an integrated circuit chip, comprising: receiving a request for chip identification on the integrated circuit chip from a chip identification system, the integrated circuit chip having a tamper-resistant memory including a physical unclonable functional identifier that uniquely identifies the integrated circuit chip, an unencrypted decryption key, and an encryption key, the request including the encrypted decryption key; decrypting the encrypted decryption key using the encryption key to generate a decrypted decryption key; determining that the decrypted decryption key matches the unencrypted decryption key; in response to said determining, encrypting said physically unclonable functional identifier using said encryption key and sending a response to said chip identification system including said encrypted physically unclonable functional identifier; A method comprising:

14. 14. The method of claim 13, wherein the request further includes an initialization vector for use with the encryption key to decrypt the encrypted decryption key.

15. 15. The method of claim 14, wherein the encryption key is a first symmetric encryption key, the initialization vector is a first initialization vector, and the response further includes a second initialization vector for use with a second symmetric encryption key corresponding to the first symmetric encryption key to decrypt the encrypted physical unclonable functionality identifier.

16. The method of claim 13 , wherein the tamper-resistant memory is manufactured in a later process.

17. The method of claim 13, wherein the encryption key is a symmetric encryption key.

18. The method of claim 13 , wherein the encrypted physical unclonable functional identifier is transmitted to the chip identification system over a network.

Images