CN109934021B

CN109934021B - Layout method of switch capacitor PUF circuit for preventing probe detection

Info

Publication number: CN109934021B
Application number: CN201910078051.9A
Authority: CN
Inventors: 张寅�; 万美琳; 章珍珍; 贺章擎; 张志文; 卢仕; 顾豪爽
Original assignee: Hubei University
Current assignee: Hubei University
Priority date: 2019-01-28
Filing date: 2019-01-28
Publication date: 2023-08-08
Anticipated expiration: 2039-01-28
Also published as: CN109934021A

Abstract

The invention discloses a layout method of a switch capacitor PUF circuit for preventing probe detection, wherein the capacitor sampled by the switch capacitor PUF only adopts parasitic capacitance formed by upper metal, lower metal and an insulating layer between the upper metal and the lower metal which form a capacitive protection layer, and the parasitic capacitance does not comprise fixed capacitance; and then, amplifying the output voltage difference value of the switch capacitor by adopting an analog amplifier/comparator without an input/output feedback path to obtain a final output key. Meanwhile, a metal wire net with a longer length is not used for protecting a sensitive area of the chip, a plurality of shorter metal wires or metal blocks with smaller areas are used as electrode plates of a switch capacitor PUF sampling capacitor and cover the sensitive area, and the area of the sampling capacitor is reduced to prevent damage+reconstruction+detection attack of the same layer and different layers and increase the probe detection sensitivity of the metal capacitive protection layer.

Description

Layout method of switch capacitor PUF circuit for preventing probe detection

Technical Field

The invention relates to a safety chip secret key generating circuit and a safety protection circuit, in particular to a switch capacitor PUF secret key generating circuit and a probe detection prevention layout method based on the same, belonging to the technical field of hardware information safety.

Background

In face of increasingly serious information security threat, the application of the security chip is more and more widespread, and the security chip is required to be adopted to ensure the security of data from the traditional banking and telecommunication industries to mobile payment, electronic passports, electronic identity cards, anti-counterfeiting devices, smart grids, intellectual property protection and the like, so that the security has become a basic and necessary characteristic of electronic products. Nowadays, hacking means are not limited to software attacks such as viruses, trojans and the like, but an invasive attack mode with stronger aggression and higher protection difficulty is adopted to directly steal key information of a user. The intrusion attack is to directly observe a key in a chip by reverse engineering or directly detect the key in the chip by combining a probe with a violent means such as laser etching, focused Ion Beam (FIB), etc., and has strong aggressiveness and great loss.

In order to avoid direct reverse engineering attacks, the most effective method is to use a physical unclonable function (Physically Unclonable Function, PUF) to provide a key, the PUF detects random changes of physical characteristics of materials constituting a circuit device in the production process of an integrated circuit, even a chip manufacturer cannot copy the same key by adopting the same circuit, and an attacker cannot reversely push the key through layout analysis. Although the PUF technology can prevent direct reverse engineering attack, the detection attack cannot be prevented, and an attacker can directly detect the electric signals of sensitive parts in the chip by adopting a probe; if the sensitive information is at the bottom layer of the chip, an attacker can also adopt a damage and detection attack, firstly, the layout of the top layer is removed, and then the micro probe is used for detecting the internal sensitive signal; in addition, if the top protective layer has electrical signal characteristics, after the layout of the top protective layer is damaged, in order to maintain the electrical signal connection state of the damaged circuit, it is necessary to reconstruct the signal line at other places. The reconstruction, destruction and detection attack is to reconnect the destroyed signal line at other positions by using the FIB so as to maintain the correct connection state of the circuit, and then detect the sensitive information inside the chip in the destroyed area by using the probe. It can be seen that the three attack modes adopting probe detection, such as direct detection, damage+detection, damage+reconstruction+detection, are very strong in attack capability and very high in protection difficulty.

In order to prevent the above-mentioned detection attack, the existing research mainly adopts a capacitive protection layer to protect the sensitive area, and the capacitive characteristic of the protection layer is related to the secret key. For example, chinese patent application No. CN 104052604B discloses a structure for preventing cracking based on a switched capacitor PUF, as shown in fig. 1. Because the process of sampling the capacitance proportion of the switch capacitor PUF is random deviation, and the upper polar plate and the lower polar plate of the sampled capacitor are led to the top layer metal and the sub-top layer metal of the chip, if an external probe detects the top layer metal or the sub-top layer metal, the capacitance value of the sampled capacitor connected with the top layer metal or the sub-top layer metal also changes, so that the capacitance proportion sampled by the switch capacitor PUF also changes, and the output secret key of the switch capacitor PUF is changed. When an external damage attack occurs, a key generation circuit or a detection circuit connected with the protection layer detects the change of the characteristics of the protection layer circuit, and then the output key is changed, so that the probe detects the wrong key. However, it should be noted that the invention has four problems:

(1) Firstly, the capacitor sampled by the switch capacitor PUF consists of a fixed capacitor and a parasitic capacitor, and the parasitic capacitor formed by the metal wire net used for detecting the external detection attack is only one part of the sampled capacitor, so that the sensitivity of the external detection attack is surely reduced;

(2) Secondly, it has all adopted signal metal wire and the ground wire mixed wire winding of being connected to sampling capacitor polar plate at top layer and sub-top layer, and the purpose is that let signal metal wire and ground wire closely distribute, increases the degree of difficulty that the outside probe surveyed: because the distance between the signal metal wire and the ground wire is small, the large probe is required to short the signal metal wire and the ground wire if detected; for the attack of destruction and reconstruction, if the operation is performed on the same layer, the operation space is very small, and the operation can only be performed between the metal wire and the ground wire, as shown in fig. 2, under a certain 0.18 micron CMOS process, the space for reconstruction on the same layer is only 0.36 micron, and the difficulty is greatly increased. The layout mode of the mixed wiring of the signal metal wires and the ground wires can effectively prevent large probe detection and same-layer damage+reconstruction+detection attack, but still has serious risks: as shown in fig. 3, the current common mode of the FIB is to lead the metal signal below the passivation layer to the outside of the passivation layer through the FIB and then reconnect the metal signal at the passivation layer, so that the problem of small operation space is avoided, and an attacker can simply lead the top layer and the sub-top layer metal to the passivation layer respectively for reconnection, leak the important signal line at the bottom layer and detect the important signal line by using a probe. For such attacks, the above-mentioned patent of the invention has hardly any protection capability;

(3) Again, although this patent merely directs the top plate of the capacitor to the top metal, which is connected to a fixed potential, the sense signal N, P is at the sub-top metal, which does not appear to be present when the key is generated. It should be noted that, as shown in fig. 4, the switch capacitor PUF uses a Latch type comparator to compare the sensitive information point N, P, and when the enable signal EN becomes 1, the voltage at the two points N, P is the voltage after the charge redistribution, but the Latch type comparator will amplify and compare the two points N, P immediately, and quickly amplify the N, P sensitive signal to the actually output digital key from the rail to rail "0/1", and it can be seen that the two points N, P will be changed from the dc level to "0/1" quickly, i.e. undergo a rapid pulse change. Since the charge stored in the capacitor cannot be suddenly changed, i.e. the capacitor has a high-frequency coupling effect, the rapid change of the voltage at two points N, P will be coupled to the metal signal line of the upper electrode plate of the capacitor connected to the top metal, if an external attacker detects the top metal with a probe, the final voltage value (i.e. final key value) of the corresponding N, P can be determined by observing whether the detected metal line is pulsed: if negative pulse or burr appears, the corresponding N or P is 0, otherwise if positive pulse or burr appears, the corresponding N or P is 1. Meanwhile, it should be pointed out that after the probe is connected to the top metal, the parasitic capacitance introduced by the probe is equivalent to that introduced by connecting a probe between the upper polar plate and the ground, but because the upper polar plate is connected with a fixed potential, the mismatch sampling of the original capacitance is not affected, namely, the original secret key is not affected by observing the attack mode of positive or negative burrs or pulses of the top metal, and the attack is very effective;

(4) In addition, the invention adopts a capacitive metal wire net connected with a sampling capacitor of the switch capacitor PUF to protect other sensitive areas needing to be protected, and if the sensitive areas are larger, the actual capacitive metal wire net is very long, so that the sensitivity of the capacitive metal protection layer is greatly reduced. If an external attacker cuts off and damages the metal wire net within a very small range, and guides the metal wire net to the passivation layer at the top layer for reconstruction, the actual capacitance change of the metal wire net is very small for the whole metal wire net, and is very likely to be lower than the resolution capability of a comparator, and finally, the method is equivalent to that an external probe can detect other sensitive information below the protective layer on the premise of not damaging the capacitive protective layer, so that the detection prevention sensitivity of the capacitive metal protective layer is greatly reduced.

In summary, it can be seen that the existing capacitive metal protection layer based on the switch capacitor PUF has the problems of low detection sensitivity of the external probe detection attack, serious protection defect, and the like, so that in order to make the capacitive metal protection layer based on the switch capacitor PUF have real detection attack prevention capability, firstly, the sampled capacitor should not introduce a fixed capacitor, but should all adopt parasitic capacitance formed by the capacitive metal; secondly, mixed winding of a signal wire and a ground wire is not needed, the wire mesh is not required to be excessively long, and a plurality of metal blocks or metal wires with smaller areas or shorter lengths are required to be used for layout; finally, and most importantly, the amplifier for comparing and amplifying the two points N, P cannot adopt an input-output coupled latch type amplifier, and the voltage of the two points N, P cannot be suddenly changed.

Disclosure of Invention

The invention provides a layout method of a switch capacitor PUF circuit for preventing probe detection, aiming at the problems in the background technology, wherein the capacitor sampled by the switch capacitor PUF only adopts parasitic capacitance formed by upper metal, lower metal and an insulating layer between the upper metal and the lower metal which form a capacitive protective layer, and the parasitic capacitance does not comprise fixed capacitance; and then, amplifying the output voltage difference value of the switch capacitor by adopting an analog amplifier/comparator without an input/output feedback path to obtain a final output key. Meanwhile, a metal wire net with a longer length is not used for protecting a sensitive area of the chip, a plurality of shorter metal wires or metal blocks with smaller areas are used as electrode plates of a switch capacitor PUF sampling capacitor and cover the sensitive area, and the area of the sampling capacitor is reduced to prevent damage+reconstruction+detection attack of the same layer and different layers and increase the probe detection sensitivity of the metal capacitive protection layer.

In order to achieve the above purpose, the present invention adopts the following scheme:

a layout method of a switch capacitor PUF circuit for preventing probe detection comprises the following steps: the capacitor sampled by the switch capacitor PUF only adopts parasitic capacitance formed by upper metal, lower metal and insulating layer between the upper metal and the lower metal which form the capacitive protective layer, and does not comprise fixed capacitance; and then the analog amplifying/comparing device without feedback path is used to amplify the output voltage difference of the switch capacitor to obtain the final output key, which is characterized in that:

the two layers of metals forming the upper and lower polar plates of the sampling capacitor of the switch capacitor PUF can be any two adjacent layers of metals, and also can be non-adjacent metals without other metal wires, but the two layers of metals have the same area and are completely overlapped;

the insulating layer forming the sampling capacitance dielectric layer of the switch capacitance PUF can be a general insulating layer between adjacent metal layers in the CMOS process, and can also be a high dielectric constant insulating layer of a metal-insulating layer-metal capacitance device in the CMOS process.

Furthermore, the area of each sampling metal capacitor of the switch capacitor PUF is several square micrometers, and a plurality of metal capacitor arrays are used for covering a sensitive area in the chip, so that the sensitivity of preventing probe detection is improved;

the metal capacitance value sampled by the switch capacitance PUF is at fF level, and can be a linear structure with the length of several micrometers to tens of micrometers, or a block structure with the area of several square micrometers.

Furthermore, the comparator for amplifying and comparing the output voltage difference of the switch capacitor is composed of an analog comparator, a feedback path from the output key to the input sensitive signal point does not exist, and an external attacker is prevented from obtaining the output key value by detecting a metal wire connected to a fixed potential at the upper layer.

The beneficial effects of the invention are as follows:

on the premise of ensuring the function of the PUF key generating circuit of the switch capacitor, the invention only comprises the parasitic capacitor formed by the capacitive metal protective layer, and does not comprise the fixed capacitor, thereby increasing the detection sensitivity of the external probe detection. Meanwhile, a plurality of metal short wires or metal blocks with smaller areas are used for covering the sensitive area, so that a long metal wire net with lower sensitivity is avoided, and the detection sensitivity of external probe detection can be further improved. In addition, the latch type input-output coupling amplifier is avoided, and the analog amplifying/comparing device is adopted, so that secret key information leakage caused by capacitive coupling can be effectively prevented, and safety is improved.

Drawings

Fig. 1 is a schematic diagram of a switch capacitor PUF-based anti-hacking structure according to the present invention;

FIG. 2 is a schematic diagram of a layout structure of the reference invention patent for preventing the same layer damage+reconstruction+detection attack;

FIG. 3 is a schematic diagram of a different layer destruction+reconstruction+detection attack structure;

FIG. 4 is a waveform diagram of transient signals of reference patent N, P capacitively coupled to the top metal;

fig. 5 is a schematic diagram of an anti-probe detection layout based on a switched capacitor PUF according to the present invention;

FIG. 6 is a schematic diagram of the present invention and the present invention as being destroyed + rebuilt + probed at the same layer;

FIG. 7 is a schematic diagram of the reference invention patent and the present invention under a corruption + reconstruction + detection attack at different layers;

fig. 8 is a schematic diagram of an analog amplifier/comparator with no feedback between input and output as used in the present invention.

Detailed Description

The present invention is further described below with reference to the drawings and specific examples of embodiments, examples of which are illustrated in the drawings, wherein the same or similar reference numerals refer to the same or similar elements or elements having the same or similar functions throughout. The embodiments described below are exemplary and intended to illustrate the present invention and should not be construed as limiting the invention, but any modifications, equivalent substitutions or improvements made within the spirit and principles of the present invention should be included within the scope of the claims of the present invention, which are not described in detail in the present technical solution.

Implementation example: the anti-probe detection layout mode based on the switched capacitor PUF shown in fig. 5 still adopts the switched capacitor principle, and the detection is that the ratio of two capacitors is C _UP1 /C _DN1 C (C) _UP2 /C _DN2 Mismatch between four sampling capacitances C _UP1 、C _DN1 、C _UP2 、C _DN2 Parasitic metal-insulating layer-metal structure capacitors can be adopted, the upper metal layer and the lower metal layer respectively form two polar plates of the capacitor, the two metal layers can adopt any two adjacent metal layers, also can adopt non-adjacent two metal layers without other signal wires, and a common insulating layer between the metal layers in the CMOS process forms a dielectric medium; the dielectric layers of the four sampling capacitors can also be special dielectric layers with higher dielectric constants, which are used for the metal-insulating layer-metal capacitor in the CMOS process. For the SC PUFi unit, C is set in design _UP1 ＝C _UP2 ，C _DN1 ＝C _DN2 Thereby having C _UP1 /C _DN1 ＝C _UP2 /C _DN2 . But due to bias in CMOS process, C _UP1 And C _DN1 And not be respectively and completely equal to C _UP2 And C _DN2 But rather introduces a mismatch between the two capacitance ratios: c (C) _UP1 /C _DN1 ＝δ+C _UP2 /C _DN2 . The circuit firstly passes through a discharging stage, namely EN=0, and two ends of all capacitors are connected with GND, so that charges stored in all capacitors are 0; then en=1, the circuit enters a charge redistribution state, C _UP1 And C _UP2 The upper electrode plates of (a) are connected with the voltage of the two points VDD and P, N and the voltage of the two points C _UP1 /C _DN1 And C _UP2 /C _DN2 Related to the following. At this point, the mismatch δ in capacitance ratio will introduce a voltage difference between P and N:

the capacitor ratio mismatch is thus converted into a voltage difference, which is then amplified by a comparator and finally converted into the rail-to-rail output digital Key [ i ].

The key generation principle based on the SC PUF is consistent with the reference invention patent, but in order to improve the probe detection attack detection sensitivity of the capacitive metal protection layer, the sampling capacitor C is adopted in the invention _UP1 、C _UP2 、C _DN1 、C _DN2 The fixed capacitor is not included any more, but only the parasitic capacitor formed by two layers of metal and an insulating layer between the two layers of metal is formed, so that the change of the metal protection layer is totally reflected into the switch capacitor PUF, and the detection sensitivity of probe detection attack is increased.

In addition, in FIG. 5, a sampling capacitor C is formed _UP1 、C _UP2 、C _DN1 、C _DN2 Instead of the long wire mesh of the reference patent, the metal wire mesh of the reference patent is a block-like structure with a smaller area or a wire-like structure with a shorter length, and when an external attack tries to destroy or reconstruct the metal protection layers, as shown in fig. 6 (a) and fig. 7 (a), since each metal wire is very long, if the metal wires are destroyed and reconstructed in the same layer or different layers in a small range to leak out important sensitive information under the metal wire mesh, the capacitance change caused by the destruction and reconstruction+probe detection attack may be negligible with respect to the total capacitance, so that an attacker is likely to acquire correct information by adopting the destruction and reconstruction+probe detection attack, and the change of the output secret key of the switch capacitance PUF will not be caused. For the present invention, each metal capacitor uses either a metal wire with a shorter length or a metal block with a smaller area, the length or area of which is in the same order of magnitude as the minimum area (several square micrometers) required by an external attack, and a plurality of metal wires or an array of metal blocks are used to cover the whole area to be protected, which necessarily causes a larger range of variation in the sampling capacitance if an external damage+reconstruction attack occurs, so as to greatly improve the sensitivity against the external detection attack, as shown in fig. 6 (b, c) and fig. 7 (b, c). Taking the currently available destruction + reconstruction capability as an example, the minimum operating area available for FIB is about a few square microns, thus constituting C _UP1 、C _UP2 、C _DN1 、C _DN2 The total area of the metal wires or metal blocks of the four sampling capacitors is also about several square micrometers, and the corresponding capacitance value is about several fF to several tens of fF.

Finally, in order to avoid voltage abrupt change at the sensitive signal point N, P, which may cause external attack by detecting positive pulse or negative pulse related to N, P final voltage also at the upper metal layer connected to the upper plate of CUP1/CUP2, and further obtain an output key value, the N, P voltage should avoid abrupt change, which is avoided by using a latch type input-output coupled amplifier, but an amplifier/comparator without feedback between input and output commonly used in an analog circuit is adopted, and at the end of comparison, the voltage of N, P does not change, and the external attack cannot obtain the final key value of the PUF by detecting the upper metal layer, as shown in fig. 8.

The above embodiments are merely illustrative of the principles of the present invention and its effectiveness, and are not intended to limit the invention. Modifications and variations may be made to the above-described embodiments by those skilled in the art without departing from the spirit and scope of the invention. Accordingly, it is intended that all equivalent modifications and variations of the invention be covered by the claims, which are within the ordinary skill of the art, be within the spirit and scope of the present disclosure.

Claims

1. A layout method of a switch capacitor PUF circuit for preventing probe detection comprises the following steps: the capacitor sampled by the switch capacitor PUF only adopts parasitic capacitance formed by upper metal, lower metal and insulating layer between the upper metal and the lower metal which form the capacitive protective layer, and does not comprise fixed capacitance; and then the analog amplifying/comparing device without feedback path is used to amplify the output voltage difference of the switch capacitor to obtain the final output key, which is characterized in that:

the two layers of metals forming the upper and lower polar plates of the sampling capacitor of the switch capacitor PUF are any two adjacent layers of metals or non-adjacent metals without other metal wires, but the two layers of metals have the same area and are completely overlapped;

the insulating layer forming the sampling capacitance dielectric layer of the switch capacitance PUF is a general insulating layer between adjacent metal layers in the CMOS process or a high dielectric constant insulating layer of a metal-insulating layer-metal capacitance device in the CMOS process;

the area of each sampling metal capacitor of the switch capacitor PUF is several square micrometers, and a plurality of metal capacitor arrays are used for covering a sensitive area in the chip, so that the sensitivity of probe detection prevention is improved;

the metal capacitance value sampled by the switch capacitor PUF is at fF level, and the switch capacitor PUF is a linear structure with the length of several micrometers to tens of micrometers or a block structure with the area of several square micrometers;

the comparator for amplifying and comparing the output voltage difference of the switch capacitor is composed of an analog comparator, a feedback path from an output key to an input sensitive signal point does not exist, and an external attacker is prevented from obtaining the output key value by detecting a metal wire connected to a fixed potential at the upper layer.