Active ASIC Intrusion Shield Using Dynamic Trace Arrays
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
High-performance application-specific integrated circuits (ASICs) are vulnerable to sophisticated physical probing, modifying, and destroying attacks, which existing security measures fail to detect effectively, especially during active operation and upon startup after potential tampering.
Innovation Solution
An apparatus comprising an array of trace wires across the top metal layer of the ASIC, a pseudo-random binary sequence generator, a true random number generator, and comparison circuitry to detect faults and generate alerts, along with an alert response system to initiate protective actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional physical security measures are used to protect ASIC, then manufacturing simplicity is maintained, but detection capability against sophisticated attacks is insufficient
Solution Approach 1:
The security system is segmented into multiple independent components: an array of trace wires distributed across the ASIC, pseudo-random binary sequence generators placed at strategic locations, and comparison circuitry positioned to monitor specific regions. Each component performs a specialized function, and together they form a comprehensive detection network that covers the entire device while maintaining individual component simplicity.
Solution Approach 2:
The security system employs dynamic pseudo-random binary sequences that continuously change over time, making the security pattern unpredictable and adaptive. The sequence generators produce evolving patterns that are monitored in real-time, allowing the system to detect intrusions dynamically rather than relying on static security configurations.
2Area of stationary object
If dense array of trace wires is implemented across metal layers, then coverage area increases, but manufacturing complexity increases
Solution Approach 1:
The trace wires serve multiple functions simultaneously: they are part of the normal ASIC wiring infrastructure for signal transmission, and they also serve as security monitoring elements for the intrusion detection system. This multi-functionality allows the system to achieve comprehensive coverage without adding dedicated separate monitoring structures, thereby simplifying manufacturing.
Solution Approach 2:
The existing metal layer infrastructure of the ASIC is utilized to create the trace wire array, rather than requiring separate dedicated security wiring layers. The system leverages the ASIC's own structural elements for security purposes, eliminating the need for additional manufacturing steps and reducing overall complexity.
3Reliability
If pseudo-random binary sequence generator with true random number generator is used, then entropy and security strength improve, but device complexity increases
Solution Approach 1:
The true random number generator is nested within the pseudo-random binary sequence generator architecture, where it provides entropy input to seed and refresh the pseudo-random sequence. This hierarchical nesting allows the simpler pseudo-random generator to benefit from the security strength of the more complex true random number generator, achieving high security reliability while managing overall circuit complexity through structured integration.
4Speed
If comparison circuitry monitors trace wires in real-time, then detection speed improves, but energy consumption increases
Solution Approach 1:
The comparison circuitry operates periodically rather than continuously, monitoring the trace wires at regular intervals determined by the pseudo-random binary sequence generation rate. This periodic operation maintains rapid detection capability by checking security conditions frequently enough to catch intrusions, while reducing energy consumption by allowing the circuitry to remain idle between monitoring cycles.
Data Source
AI summary
Provided are systems, methods, and apparatus for protecting an integrated circuit against invasive attacks and various forms of tampering. A defensive mechanism is an active physical security shield that includes an array of traces at a high metal of the integrated circuit, covering a high percentage of the surface area of that layer, and a collection of digital logic components that drive signals across the traces. The driving of the signals across the traces is done in an active manner such that a short, open, or stuck-at fault on any of the traces is detected within a very short period of time. The active security system is connected to or in communication with an alert response mechanism, such that a fault detected by the security system results in a signal being sent to the alert response mechanism.