Electronic device and method for enhancing the security of an electronic device

Abstract

An electronic device is provided, comprising integrated circuits (ICs) and packaged components. The packaged components include die bond pads connected to the IC; the IC includes (i) measurement circuitry configured to measure electrical characteristic values ​​of the die bond pads and (ii) safety control circuitry configured to initiate a reaction action in response to an error value detected between the measured electrical characteristic value of the die bond pads and an initial measured electrical characteristic value.

Description

Electronic devices and methods to enhance the security of electronic devices This invention relates to the security of integrated circuits (ICs), and in particular to apparatus and methods for detecting security attacks through the back-end manufacturing process of ICs. In order to access stored secrets, attackers sometimes attempt to physically access the IC from the back side of various leadframe package components. Currently, there are many methods to prevent ICs from being attacked from the backside. For example, the article "Preventing Physical Security Attacks on Flip Chip Devices Using Silicon-Backside Protection Circuits," published by Takuji et al. in October 2020, Volume 55, Issue 10 of the IEEE Solid State Circuits magazine, demonstrates a cryptographic key protection technology to prevent physical security attacks via the silicon backside of the IC chip. This article advocates using a backside buried metal (BBM) structure, which forms a meandering wire pattern on the silicon backside, to detect unexpected breakage of the meandering wires and warn malicious acts intending to expose vulnerable silicon substrates. Furthermore, this BBM meandering wire can also prevent key information of cryptographic circuits from being attacked by passive side-channel attacks and active laser fault injection attacks. US Patent No. 9965652 discloses an IC protection device to prevent attacks targeting the back-side security of ICs. This protection device includes an N-type well formed in a substrate, a P+ type center region located in the center of the N-type well, and a P+ type ring surrounding the N-type well. A pair of N+ type rings are arranged inside and outside the N-type well to prevent latch-up. When a current source is applied to the P+ type center region, the current flows through a portion of the substrate and is picked up by the P+ type ring. When an attacker mills or slots in the substrate, the resistance value on the substrate changes; therefore, attempts to attack the bare die can be detected by monitoring the voltage difference between the P+ type center region and the P+ type ring. Finally, the Intel white paper, titled "Countermeasures Against Large-Scale Fault Injection" (Intel No. 0822 / DCC / MZ / PDF), written by Nemiroff and Tokunaga (August 2022), details the design, calibration, and verification methods for fault injection detection circuits. It also mentions the impact of fault injection attacks on circuit clock speeds, Tunable Replica Circuits (TRCs), the data collection phase of High Volume Manufacturing (HVM), methods for creating calibration reports, false positive detection, fault injection detection, and the final HVM calibration process. The embodiments of the present invention described herein provide an electronic device comprising an IC and a package element. The package element includes a die bond pad for connection to the IC, and the IC includes (i) a measurement circuit configured to measure the electrical characteristic value of the die bond pad, and (ii) a safety control circuit configured to initiate a reaction action in response to detecting an error value between the measured electrical characteristic value of the die bond pad and an initial measurement value of the electrical characteristic value. In some embodiments, the electrical characteristics of the die bond pad include the resistance value bonded to the die bond pad between at least two wires. In other embodiments, the electrical characteristics of the die bond pad include the capacitance value between the die bond pad and an electrical junction in the IC. In an exemplary embodiment, the electrical junction comprises a metal deposition layer. In the disclosed embodiment, the IC further includes non-volatile memory configured to store initial measurements of the electrical characteristics of the die-bonded pads. These initial measurements are programmed into the non-volatile memory during the manufacture of the electronic device. In one embodiment, the electronic device further includes an adhesive or film for connecting the IC to the die bond pad. The present invention describes another method for enhancing the security of an electronic device according to an embodiment, wherein the electronic device includes an IC and a packaged component, the packaged component including a die bond pad for connection to the IC. The method includes measuring the electrical characteristic values ​​of the die bond pad and initiating a reaction action in response to an error value detected between the measured electrical characteristic value of the die bond pad and the initial measured electrical characteristic value. The invention will be more fully understood through the detailed description of embodiments thereof below, together with the accompanying drawings. Overview Attacks targeting the security of electronic devices are sometimes carried out via die-attach pads connected to ICs that store confidential data. We will refer to the ICs that store secrets below as security ICs. Secrets such as encryption keys and authentication keys are generally stored in memory, such as non-volatile memory (NVM). Security ICs are vulnerable to attacks using various techniques, such as fault injection, failure analysis, and focused ion beam (FIB) modifications (and others). These techniques are often easier to perform from the back side of the IC. For example, laser fault injection for advanced semiconductor processes is most easily performed from the back side of the die through a transparent substrate, rather than from the front side through an opaque metal layer. Similarly, FIB is most easily performed from the back side because modern ICs may have six to ten electron layers (sometimes even more), making access from the top of the device extremely difficult. However, since all signals originate and terminate at the first metal layer (metal-1) (the bottom of the metal layers), performing FIB from the back side is relatively simple. Inexpensive leadframe packages such as Quad Flat Packages (QFP), Quad Flat No Leads Packages (QFN), and Thin Shrink Small Outline Packages (TSSOP) are mostly used in security ICs. In these packages, the bare die is bonded to a central metal pad (called a "die bond pad"), and the pad is bonded to the surrounding leads. For these packaged components, accessing them from the bottom of the package to the back of the die without damaging the chip is relatively simple. For example, by drilling a hole in the bottom of the package and using the die bond pad (and its adhesive), the bottom of the die can be exposed to attack. In contrast, drilling a hole in a Ball Grid Array (BGA) package is not a feasible attack method, as it is highly likely to damage the package and disconnect some pins. This document discloses and proposes embodiments of an apparatus and method for detecting attacks through die-attach pads. In some embodiments, the electrical characteristic values ​​of the die-attach pads are measured during IC fabrication and stored in an NVM (referred to as an electrical characteristic reference value). In this embodiment, the electrical characteristic value includes the resistance value through the die-attach pad, while in another embodiment, the electrical characteristic value includes the capacitance value between the die-attach pad and a metal deposition layer in the IC. In some embodiments, this IC includes measurement circuitry that measures the electrical characteristics of the die-attach pads, and a security control circuit (SCC) that compares the electrical characteristics with a reference value and takes protective measures (e.g., deleting stored secrets) based on the error measurement. In this embodiment, this measurement is performed once the IC is powered on, protecting the IC from die-attach tampering when power is off. In other embodiments, the security control circuitry continuously measures the electrical characteristics, again providing protection for the die-attach pad against tampering whether the IC is powered on or off. The embodiments disclosed herein provide a relatively inexpensive protection method because it does not add any additional IC manufacturing steps. Furthermore, because the die-bonding pads, which are the targets of attacks, are directly inspected, more reliable protection against attacks can be achieved (compared to indirect protection that relies on indirect protection effects). System Description In some embodiments, the electronic device includes an IC connected to a packaged IC element via die-bonded pads. Such electronic devices may be vulnerable to attacks carried out via die-bonded pads (“hacking”). For example, an attacker could drill or otherwise penetrate the die-bonded pads to access the IC and read confidential information that may be stored inside. Figure 1 schematically illustrates a block diagram of an electronic device 100 with die-bonded pad tamper protection according to an embodiment of the present invention. The electronic device 100 includes an IC 102 connected to a packaged element (not shown) via a die-bonded pad 104. The IC 102 is substantially connected to the die-bonded pad 104 using a suitable adhesive or film. Any alteration to the die bond pad 104, including breaking it down using a laser beam, electron beam, mechanical drilling, or other means, will inevitably change some electrical characteristic values ​​of the die bond pad 104 (e.g., changing the resistance and / or capacitance values, as described below). IC 102 includes an electrical characteristic measurement circuit 106 configured to measure the electrical characteristics of the die-bonding pad 104, and an NVM 108 configured to store electrical characteristic reference values. In some instances, the NVM 108 is programmed during the manufacturing process of the electronic device as part of the final testing and / or calibration process. In some embodiments, the electrical characteristic measurement circuit 106 measures the electrical characteristics during manufacturing, and a test device writes the measured values ​​(referred to as "reference values") into the NVM 108. In other embodiments, the electrical characteristic reference values ​​may be measured by a test device. IC 102 also includes a security control circuit 110 configured to obtain an error value between the electrical characteristic value measured by the electrical characteristic value measurement circuit 106 and a reference value stored in NVM 108. If this error value exceeds a predetermined threshold, the security control circuit 110 is configured to protect sensitive data in IC 102, for example, by deleting all stored confidential information. In some embodiments, the security control circuit 110 operates when the device is powered on and protects the die-attach from drilling when the electronic device is powered off. In other embodiments, the security control circuit 110 operates continuously (when powered on) to provide protection against in-vivo attacks. As shown below (refer to Figures 2 and 3), in some embodiments, the measurement of electrical characteristic values ​​utilizes a clock within IC 102. In some embodiments, because an attacker can essentially pause the clock, the error value at the time the clock stops will exceed a predetermined threshold, and the protection mechanism will not be compromised. In one embodiment, the user can directly solder the die bond pad 104 onto the PCB during the printed circuit board (PCB) manufacturing process to modify the electrical characteristic values ​​of the die bond pad 104 (e.g., by providing a parallel path to reduce the resistance value). In this embodiment, updating the reference value stored in NVM 108 should be part of the PCB manufacturing process. Therefore, in some embodiments, confidential data stored in IC 102 is protected from physical attacks carried out through die bond pad 104, such attacks altering the electrical characteristics of die bond pad 104 to exceed a predetermined threshold. Figure 2 schematically illustrates a block diagram of an electronic device 200 having a resistance-based tamper detection circuit according to an embodiment disclosed herein. IC 202 is connected to die bond pad 204. IC 202 includes a resistance-measurement circuit 206. In an exemplary embodiment, the resistance-measurement circuit 206 includes a current source for providing current through the resistor being measured, and an analog-to-digital converter for converting the voltage across the resistor to a digital value. The resistance measurement circuit 206 is connected to a first region 212A on the die bond pad 204 via a solder pad 208A and a wire 210A, and to a second region 212B on the die bond pad 204 via a solder pad 208B and a wire 210B. Therefore, the resistance measurement circuit 206 measures the resistance 214 through the die bond pad 204. In some embodiments, the first region 212A and the second region 212B on the die bond pad 204 are far apart, essentially located at opposite corners or the center points of opposite sides of the die bond pad 204. It should be noted that since the benchmark for tamper detection is the error value between the two measurement results, as long as the readings are consistent, this resistance measurement circuit 206 does not need to be linear or precise. In some embodiments, because the resistance values ​​of wires 210A and 210B are substantially greater than the resistance value of the die bond pad 204, multiple parallel wires are used to connect the resistance measurement circuit 206 to the die bond pad 204. In other embodiments, a die bond pad 204 with higher sheet resistance is used, for example, by utilizing a different material with low conductivity or a thinner profile. Figure 3 schematically illustrates a block diagram of an electronic device 300 having a capacitance-based tamper detection circuit according to an embodiment disclosed herein. IC 302 is connected to an electrically floating die bond pad 304. IC 302 includes a capacitance-measurement circuit 306 connected to a floating node 308 (essentially an electrically insulating metal deposition area), and a bonding pad 314 connected to the die bond pad 304 via a bond 310 and a wire 312. The capacitance-measurement circuit 306 is configured to measure the capacitance value located between the floating node 308 and the die bond pad 304. Since the benchmark for tamper detection is the error value between two measurements, the capacitance measurement result should be consistent and sensitive, but not necessarily linear or precise. In some embodiments, the capacitance measurement circuit 306 includes a current source for charging (or discharging) capacitor 316. In other embodiments, a simpler (though less precise) circuit for charging (or discharging) capacitor 316 via a voltage source connected in series with a resistor can be used. In some embodiments, the voltage across capacitor 316 is measured after a predetermined time (which can be extrapolated, e.g., from a clock cycle on the wafer). In other embodiments, the capacitance measurement circuit 306 measures the time it takes for the voltage across capacitor 316 to reach a predetermined standard (e.g., by calculating a clock cycle). In some embodiments, because the variation of the capacitance 316 located between the metal layer and the die bond pad 304 is small, the floating node 308 may contain other metal layers. In an alternative embodiment, a redistribution layer (RDL) covering almost all areas of the wafer (except for the metal pads and power lines) is used as a top-side shield to prevent FIB / laser attacks and can also be used as the top electrode of capacitor 316. The distance between the RDL and the die bond pad 304, or the die thickness, essentially comprises 7 mils (one-thousandth of an inch) of silicon and 0.5 mils of epoxy. In some embodiments, the die thickness is reduced to 5 mils of silicon and 0.5 mils of epoxy. In other embodiments, the die thickness is reduced to 3 mils plus a thin film (used as a substitute for liquid adhesive). With a gap size of 3.5 mils, the capacitance values ​​corresponding to a 1 square millimeter capacitor and a 1 square centimeter capacitor are 0.1 pF and 10 pF, respectively. The configurations of electronic devices 200 and 300 are illustrated in Figures 2 and 3, and are cited for illustrative purposes only. Other configurations may be used in alternative embodiments. In some embodiments, for example, the die bond pad is connected to ground (in the IC and / or in the circuit board) and can be used as the negative node for capacitance measurement, while a floating metal plate built inside the IC is used as the positive node. In other embodiments, both resistance and capacitance values ​​are measured. In some embodiments, the capacitance value located between the die bond pad and ground is measured (and therefore the floating node 308 is not required). Figure 4 is a flowchart 400, which schematically illustrates a method for temporarily storing the electrical characteristic values ​​of the die bond pads in an electronic device during the manufacturing process according to the embodiments disclosed herein. This method is performed by test equipment used for the final testing of the electronic device. This flowchart 400 begins with an operation 402 of measuring electrical characteristics, in which a test device measures the electrical characteristics (e.g., resistance or capacitance) of the die bond pads. In some embodiments, this test device measures these characteristics directly. In other embodiments, this test circuit activates a characteristic measurement circuit in the electronics (e.g., electrical characteristic measurement circuit 106 in Figure 1). Next, in operation 404, which involves writing the measurement value, the test device writes the measurement result from operation 402 into the NVM in the electronic device (e.g., NVM 108 in Figure 1). This flowchart ends at operation 404. Figure 5 is a flowchart 500, which schematically illustrates a method for line protection of an electronic device to prevent tampering with the die bond pads according to the embodiments disclosed herein. This method is performed by a safety control circuit 110 and an electrical characteristic value measurement circuit 106 (Figure 1). This flowchart 500 begins upon power-up and continues to execute as long as power is applied to the electronic device. The flowchart begins with operation 502, which measures electrical characteristics, where electrical characteristic measurement circuit 106 measures the electrical characteristics (e.g., resistance or capacitance) of the die-bonding pads. Next, in operation 504, which calculates the error, the safety control circuit compares the measured value with a reference value (e.g., stored in NVM 108 of Figure 1). In some embodiments, this error value is the absolute value of the difference between the measured value and the reference value. In other embodiments, a relative error measurement is used, such as the absolute difference divided by the reference value. Next, in operation 506 (Compare Deviation), the security control circuit compares the error value with a predetermined threshold. If the error value is not greater than the predetermined threshold, the flowchart re-enters operation 502 to re-detect the electrical characteristic value (thus providing continuous protection). If the error value is greater than the predetermined threshold in operation 506, the flowchart enters operation 508 (Destroy-Secrets), where the security control circuit destroys some or all of the stored secrets (in some embodiments, alternative or additional security control circuitry may permanently disable access to stored secrets). After operation 508, the operation of the IC terminates. The configurations of flowcharts 400 and 500 are illustrated in Figures 4 and 5, and the above are examples of configurations. Other configurations may be used in alternative embodiments. For example, in some embodiments, the safety control circuit executes flowchart 500 only once immediately after power-on, and in operation 506, if the error value does not exceed a predetermined threshold, the safety control circuit will exit (this action reduces power loss, but only provides protection against tampering of the die bond pads when power is off). In some embodiments, a package element that does not require die bond pads (e.g., a BGA package element) is used. However, this package element is modified to contain a metal plate covering almost or all areas of the IC substrate, which is used for attack detection, with similar uses for the die bond pads as described above. The configurations of electronic devices 100, 200, and 300 include a resistance measurement circuit 206, a capacitance measurement circuit 306, and the methods described in flowcharts 400 and 500, as illustrated in Figures 1 through 5. These configurations and methods are illustrative only for conceptual clarification. Any other suitable system configurations and methods may be used as alternative embodiments. Different components in electronic device 100 may be practically applied to ICs, such as application-specific integrated circuits (ASICs) or field-programmable gate arrays (FPGAs). The embodiments described above are cited as exemplary, and the invention is not limited to the specific examples or descriptions above. Rather, the scope of the invention includes combinations and partial combinations of the features described above, as well as variations and modifications of prior art that may occur to those skilled in the art upon review of the foregoing description and those not disclosed. Reference to documents incorporated herein by reference should be considered part of the invention, except for any terms defined in those incorporated documents in a manner that conflicts with the explicit or implicit definitions in the specification of the invention, and only the definitions in the specification should be considered. 100, 200, 300: Electronic Devices 102, 202, 302: Integrated Circuits (ICs) 104, 204, 304: Die Bonding Pads 106: Electrical Characteristic Measurement Circuits 108: Non-Volatile Memory (NVM) 110: Security Control Circuits (SCC) 206: Resistance Measurement Circuits 208A, 208B: Bonding Pads 210A, 210B, 312: Wires 212A: Region 1 212B: Region 2 214: Resistance 306: Capacitance Measurement Circuits 308: Floating Nodes 310, 314: Bonding Pads 316: Capacitors 400, 500: Flowcharts 402, 502: Operations for Measuring Electrical Characteristic Values 404: Operations for Writing Measurement Values 504: Operations for Calculating Error Values 506: Operations for Comparing Error Values 508: Operations for Destroying Confidential Information Figure 1 is a block diagram schematically illustrating an electronic device with die bond pad tamper protection according to an embodiment of the present invention. Figure 2 is a block diagram schematically illustrating an electronic device with a tamper detection circuit based on resistance value according to an embodiment disclosed herein. Figure 3 is a block diagram schematically illustrating an electronic device with a tamper detection circuit based on capacitance value according to an embodiment disclosed herein. Figure 4 is a flowchart schematically illustrating a method for temporarily storing the electrical characteristic values ​​of the die bond pads in the electronic device during the manufacturing process according to an embodiment disclosed herein; and Figure 5 is a flowchart schematically illustrating a method for line protection in an electronic device according to an embodiment disclosed herein to prevent tampering with the die bond pads. 100: Electronic devices 102: Integrated Circuits (ICs) 104: Die Bond Pad 106: Electrical Characteristic Value Measurement Circuit 108: Non-volatile memory (NVM) 110: Safety Control Circuit (SCC)

Claims

1. An electronic device comprising: an integrated circuit; a package element including a die bond pad connected to and adhered to the bottom of the integrated circuit, wherein the integrated circuit includes: a measurement circuit configured to measure an electrical characteristic value of the die bond pad; a safety control circuit configured to initiate a reaction action in response to detecting an error value between a measured electrical characteristic value of the die bond pad and an initial measurement value of the electrical characteristic value; a non-volatile memory configured to store the initial measurement value of the electrical characteristic value of the die bond pad, wherein the initial measurement value is encoded into the non-volatile memory during the manufacture of the electronic device; and a resistor bonded to the die bond pad and located between at least two wires, and having a resistance value, wherein the electrical characteristic value includes the resistance value.

2. The electronic device as claimed in claim 1, wherein the electrical characteristic value of the die bond pad includes a capacitance value located between the die bond pad and the electrical junction in the integrated circuit.

3. The electronic device as claimed in claim 1, wherein the electrical interface comprises a metal deposition layer.

4. The electronic device as claimed in claim 1 further includes an adhesive or a thin film for connecting the integrated circuit to the die bond pad.

5. A method for enhancing the security of an electronic device, wherein the electronic device includes an integrated circuit, a package element, and a resistor, the package element including a die bond pad connected to the integrated circuit and bonded to the bottom of the integrated circuit, the resistor being bonded to the die bond pad and located between at least two wires and having a resistance value, the method comprising: measuring an electrical characteristic value of the die bond pad; initiating a reaction action in response to detecting an error value between a measured electrical characteristic value of the die bond pad and an initial measurement value of the electrical characteristic value; and storing the initial measurement value of the electrical characteristic value of the die bond pad in a non-volatile memory of the integrated circuit; wherein measuring the electrical characteristic value of the die bond pad includes measuring the resistance value; and wherein storing the initial measurement value of the electrical characteristic value of the die bond pad includes encoding the initial measurement value into the non-volatile memory during the manufacture of the electronic device.

6. The method as described in claim 5, wherein the operation of measuring the electrical characteristic value of the die bond pad includes measuring a capacitance value located between the die bond pad and the electrical junction in the integrated circuit.

7. The method as described in claim 6, wherein the electrical interface comprises a metal deposition layer.

8. The method as described in claim 5, wherein the electronic device includes an adhesive or a thin film for connecting the integrated circuit to the die bond pad.

Images