CN219349067U - Single-power continuous source mode voltage burr fault injection device - Google Patents

Abstract

The utility model provides a single-power continuous source mode voltage burr fault injection device, which is characterized in that an SMB connector is connected with a hysteresis comparison circuit in parallel and then outputs the SMB connector to a first input end of a control circuit, a data memory is connected with a second input end of the control circuit, an output end of the control circuit is connected with a digital-to-analog conversion module, and the digital-to-analog conversion module is sequentially connected with a power amplifier and a voltage burr output interface. The advantage is that the target object is continuously supplied with the operating power and the spur voltage by one power supply. The working voltage Vn and the voltage burr Vg are set through a digital technology, the burr width is determined by the waveform of the voltage burr Vg, and the method is convenient and flexible. The voltage burr depth Vg generated according to the setting may be a positive voltage, a zero voltage, a negative voltage, or a voltage waveform. The trigger signal edge is used as the moment when the voltage glitch fault injection occurs, so that the influence of trigger signal noise is avoided.

Description

Single-power continuous source mode voltage burr fault injection device

Technical Field

The utility model relates to the field of integrated circuits and information security, in particular to a single-power continuous source mode voltage burr fault injection device.

Background

Integrated circuits are an indispensable infrastructure for information systems, and thus information security of information systems depends greatly on security defenses of integrated circuits. Voltage glitch attack is an important method for evaluating information security of an integrated circuit, and the basic principle is that voltage pulses which change instantaneously are injected into key nodes of the integrated circuit so as to change the running state of the integrated circuit and thus obtain internal information of the integrated circuit in an illegal way. The integrated circuit security assessment involves two main bodies: one is the evaluation implementation, namely the voltage glitch generation device; and secondly, the object to be evaluated, namely the integrated circuit. Voltage glitches are entered from the practitioner into the target object via the injection channel, referred to as voltage glitch fault injection.

Integrated circuits are of a wide variety and function, and their operating principles may vary widely. Therefore, a suitable voltage glitch fault injection device should be designed for generating a voltage glitch according to the working principle of the target object, otherwise not only the desired effect cannot be obtained, but even the target object may be damaged.

Disclosure of Invention

The utility model aims to provide a novel burr voltage injection device so as to achieve the purpose of providing a working power supply and burr voltage for a target object by adopting a single power supply.

The technical scheme of the utility model provides a single-power continuous source mode voltage burr fault injection device, which comprises: the system comprises a trigger signal input interface composed of an SMB connector and a hysteresis comparison circuit, a data register composed of an SRAM and a control circuit, a digital-to-analog conversion module, a power amplifier, a voltage burr output interface, a data memory and a digital technology interface. The SMB connector is connected with the hysteresis comparison circuit in parallel, and then outputs the hysteresis comparison circuit to a first input end of the control circuit, the data memory is connected with a second input end of the control circuit, an output end of the control circuit is connected with the digital-to-analog conversion module, and the digital-to-analog conversion module is sequentially connected with the power amplifier and the voltage burr output interface.

As a preferable mode of the above technical solution, the hysteresis comparison circuit is preferably composed of a TVS tube, a first resistor, a second resistor, a third resistor, a fourth resistor, a fifth resistor and a comparator D1, where the TVS tube, the first resistor and a capacitor C1 form a first branch; the second resistor and the fifth resistor form a second branch; the third resistor and the fourth resistor form a third branch; the first branch and the second branch are connected with the circuit node A and the circuit node B; the third branch is connected in parallel with the capacitor C1.

As a preferred aspect of the foregoing technical solution, preferably, the third branch is connected in parallel to the capacitor C1, and includes: one end of the third resistor is connected with the IN-terminal of the comparator D1 and the circuit node C, the other end of the third resistor is connected with the VEE terminal of the comparator and the circuit node D, and the circuit node D is communicated with the circuit node E of the first branch.

As a preferred aspect of the foregoing technical solution, preferably, the third branch is connected in parallel with the capacitor C1, and further includes:

one end of the fourth resistor is connected with the IN-terminal of the comparator D1 through a circuit node C, the other end of the fourth resistor is connected with the VCC terminal of the comparator D1 through a circuit node F, and the fourth resistor is communicated with the circuit node B through the circuit node F.

As a preferable aspect of the above technical solution, the circuit node a is preferably directly connected to the in+ terminal of the comparator.

As a preferable aspect of the above-mentioned technical solution, the output terminal of the comparator D1 is preferably connected to the input terminal of the control circuit through a circuit node G, and one end of the circuit node G is connected to the second resistor, and the other end is connected to the fifth resistor.

Preferably, the second input end of the control circuit is connected with the data memory, and the voltage value is pre-stored in the SRAM, so as to achieve the purpose of rapidly transmitting the voltage value to the digital-to-analog conversion module.

The technical scheme of the utility model provides a single-power continuous source mode voltage burr fault injection device, wherein an SMB connector is connected with a hysteresis comparison circuit in parallel and then outputs the voltage burr fault injection device to a first input end of a control circuit, a data memory is connected with a second input end of the control circuit, an output end of the control circuit is connected with a digital-to-analog conversion module, and the digital-to-analog conversion module is sequentially connected with a power amplifier and a voltage burr output interface.

The utility model has the advantage that the working power supply and the burr voltage are continuously supplied to the target object through one power supply. The working voltage Vn and the voltage burr Vg are set through a digital technology, the burr width is determined by the waveform of the voltage burr Vg, and the method is convenient and flexible. The voltage burr depth Vg generated according to the setting may be a positive voltage, a zero voltage, a negative voltage, or a voltage waveform. The trigger signal edge is used as the moment when the voltage glitch fault injection occurs, so that the influence of trigger signal noise is avoided.

Drawings

In order to more clearly illustrate the embodiments of the present utility model or the technical solutions in the prior art, a brief description will be given below of the drawings required for the embodiments or the prior art descriptions, and it is obvious that the drawings in the following description are some embodiments of the present utility model, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

Fig. 1 is a schematic structural diagram provided in an embodiment of the present utility model.

Fig. 2 is a schematic structural view of an exemplary detailed embodiment of the present utility model.

Fig. 3 is a circuit configuration diagram of the SMB connector and the hysteresis comparator circuit.

Fig. 4 is a circuit configuration diagram of the SRAM and the control circuit.

FIG. 5 is a schematic diagram of an analog voltage signal and a spur width.

Wherein the thin solid line represents the analog voltage signal converted from the value Vn and the thick solid line represents the analog voltage signal converted from the value Vg.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the embodiments of the present utility model more apparent, the technical solutions of the embodiments of the present utility model will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present utility model, and it is apparent that the described embodiments are some embodiments of the present utility model, but not all embodiments of the present utility model. All other embodiments, which can be made by those skilled in the art based on the embodiments of the utility model without making any inventive effort, are intended to be within the scope of the utility model. The utility model is intended to cover alternatives, modifications and equivalents, which may be included within the spirit and scope of the utility model as defined by the description, as may be practiced by those skilled in the art without the specific details. It should be noted that the drawings of the embodiments of the present utility model are semi-diagrammatic and not drawn to scale.

Fig. 1 is a schematic diagram of a structure provided in an embodiment of the present utility model, as shown in fig. 1, including a digital technology interface 101, a data memory 102, a trigger signal input interface 103, a data register 104, a digital-to-analog conversion 105, a power amplification 106, and a voltage glitch output interface 107.

The digital technology interface 101 is used for communicating with a digital technology controller and receiving and transmitting data. The digital technology controller includes but is not limited to MCU, FPGA, computer. The digital technology interface 101 has a function of analyzing a communication protocol used by the digital technology controller to realize reception and transmission of data. The data includes the value of the operating voltage Vn and the value of the burr voltage Vg.

The data memory 102 is used for storing the value of the operating voltage Vn and the value of the burr voltage Vg. When the digital technology interface 101 receives new data (manually input or imported), the corresponding value will be updated; the digital technology interface 101 may send the value of the memory to report the value of the current operating voltage Vn, the value of the glitch voltage Vg.

The trigger signal input interface 103 has a physical connector for connection to a pulse signal source. The pulse signal source may be a microwave source, a signal generator, digital logic circuitry, etc. capable of providing pulses. The moment when the voltage glitch fault injection occurs is determined by the edges of the input trigger signal. The trigger signal input interface 103 has an edge detection function, so that the trigger signal edge is used as the moment when the voltage glitch fault injection occurs, and is free from the noise influence of the trigger signal. An output of the trigger signal input interface 103 is connected to an input of the data register 104 for instructing the data register 104 to perform a data strobe.

The data stored in the data register 104 is drive data for digital-to-analog conversion 105. The data register 104 has a data strobe function. When the trigger signal has no edge change, i.e. when the output terminal of the trigger signal input interface 103 is invalid, the data register 104 gates the value of the working voltage Vn of the data memory 102 and latches it into the register; when an edge change occurs in the trigger signal, i.e., when the output of the trigger signal input interface 103 is active, the data register 104 gates the value of the glitch voltage Vg of the data memory 102 and latches it into the register.

The digital-to-analog conversion 105 is used to convert the driving data into analog data according to the value of the driving data. When the data stored in the data register 104 is the value of the operating voltage Vn, the digital-to-analog conversion 105 converts it into an analog operating voltage Vn; when the data stored in the data register 104 is the value of the spur voltage Vg, the digital-to-analog conversion 105 converts it into an analog quantity spur voltage Vg, while the spur width is converted with the conversion of the waveform of the value of the spur voltage Vg. The value of the spur voltage Vg may be a positive value, a zero value, a negative value, or a waveform value, so that the analog spur voltage Vg may be a positive voltage, a zero voltage, a negative voltage, or a voltage waveform after the conversion by the digital-to-analog converter 105.

The power amplification 106 is used to power amplify the output of the digital-to-analog conversion 105. The output of the digital-to-analog converter 105 is an analog voltage signal, and its current driving capability is weak, and it cannot be directly applied to voltage glitch fault injection, so that it is power-boosted by the power amplifier 106, so that its driving current covers the requirement of the target object. The power amplifier 106 only boosts the current driving capability without changing the analog voltage value. The power amplifier 106 power amplifies the analog voltage signal with a single power supply Vs, so that its power source of output Vn or Vg is continuous.

The voltage spike output interface 107 has a physical connector for connecting to an injection site of a target object. The main function of the voltage glitch output interface 107 is to adapt the output of the power amplifier 106 to a physical connector, and at the same time, the output can have protection functions such as overcurrent protection and overvoltage protection according to the electrical specification of the target object.

The method is suitable for the target object with the injection point not having active power supply capability. The output of the utility model provides a working power supply Vn for the injection point of the target object and provides a burr voltage with the depth Vg for the injection point of the target object. The injection point of the target object is used as an electric energy consumer, the output of the utility model is used as an energy source, and the active electric energy supply capability is not provided.

Fig. 2 shows an exemplary detailed embodiment of the present utility model. While the utility model will be described in conjunction with the embodiments, it will be understood that they are not intended to limit the utility model to these embodiments. In the present embodiment, the digital technology interface 101 is illustrated by taking the IIC interface 201 as an example, the data register 102 is illustrated by taking the EEPROM202 as an example, the trigger signal input interface 103 is illustrated by taking the circuit configuration composed of the SMB connector and the hysteresis comparison circuit 203 as an example, the data register 104 is illustrated by taking the circuit configuration composed of the SRAM and the control circuit 204 as an example, the digital-to-analog conversion module 105 is illustrated by taking the DAC205 as an example, the power amplifier 106 is illustrated by taking the operational amplifier 206 as an example, and the voltage burr input interface 107 is illustrated by taking the BNC connector and the overvoltage protection circuit 207 as an example.

In this embodiment, as shown in fig. 2, the SMB connector and the hysteresis comparator circuit are connected in parallel to form a SMB connector and a hysteresis comparator circuit 203, and the SMB connector and the hysteresis comparator circuit 203 are connected in parallel to the first input terminal of the control circuit, and the EEPROM202 is connected to the second input terminal of the SRAM and the control circuit 204. The output end of the SRAM and control circuit 204 is connected to a DAC205, and the DAC205 is connected in turn to an operational amplifier 206, a BNC connector, and an overvoltage protection circuit 207.

The trigger signal input interface circuit structure composed of the SMB connector and the hysteresis comparator 201 is shown in fig. 3: the hysteresis comparison circuit is composed of a TVS tube FV1, a first resistor R1, a second resistor R2, a third resistor R3, a fourth resistor R4, a fifth resistor R5 and a comparator D1. TVS tube FV1, resistor R1 and capacitor C1 form a first branch; the resistor R2 and the resistor R5 form a second branch; the resistor R3 and the resistor R4 form a third branch; the first branch and the second branch are connected with the circuit node A and the circuit node B; the third branch is connected in parallel with the capacitor C1. The circuit node a is directly connected to the in+ terminal of the comparator D1.

Specifically, one end of the resistor R3 is connected to the circuit node C with the IN-terminal of the comparator D1, and the other end is connected to the circuit node D with the VEE terminal of the comparator D1, and the circuit node D is directly connected to the circuit node E on the first branch. One end of the resistor R4 is connected with an IN-terminal of the comparator D1 through the circuit node C, and a passage is formed between the resistor R3 and the resistor R4 after connection. The other end of the resistor R4 is connected with the VCC terminal of the comparator D1 through the circuit node F, and after connection, a path is formed between the resistor R4 and the resistor R5, and between the resistor R4 and the capacitor C1.

The output end of the comparator D1 is connected with the input terminal of the control circuit through a circuit node G, and the circuit node G is connected with the resistor R2 and also connected with the resistor R5.

The circuit configuration of the data register 104 composed of the SRAM and control circuit 204 is shown in fig. 4: one input end of the SRAM and control circuit 204 is connected with the EEPROM202, and the other input end of the control circuit is connected with the SRAM, so that the voltage value is pre-stored into the SRAM in actual operation, and the purpose of rapidly transmitting the voltage value to the digital-to-analog conversion module is achieved.

The implementation of the present utility model will now be described in detail,

the IIC interface 201 is an interface between an embodiment and a computer, and has functions of resolving IIC communication protocols and enabling data reception and transmission. The data includes an analog voltage vn=3.3, a number of spike voltages vg= -2, and vg=3.3 (spike width=200ns is set by waveform of Vg value).

The EEPROM202 is used to store the value of the operating voltage Vn and the value of the burr voltage Vg. When the IIC interface 201 receives new data, the corresponding value is updated and stored; the IIC interface 201 may send the value of the memory to report the value of the current operating voltage Vn, the value of the glitch voltage Vg.

The SMB connector and hysteresis comparator 203 has an SMB connector X1, the SMB connector X1 is connected to a digital logic circuit, a pulse signal generated by the digital logic circuit is used as a trigger input of the embodiment, and the edge detection function of the SMB connector and hysteresis comparator 203 is used to trigger the input edge as the moment when the voltage glitch fault injection occurs. The SMB connector and hysteresis comparator 203 also has a hysteresis comparison function to prevent the pulse signal generated by the digital logic circuit from being affected by noise. Fig. 3 shows an example of the SMB connector and the hysteresis comparison circuit. Wherein X1 is a coaxial radio frequency connector of the SMB type, through which the trigger input enters the present embodiment; FV1 is a TVS tube to suppress transient disturbances carried by the trigger input; the comparator D1, the comparator R2, the comparator R3 and the comparator R4 form an in-phase hysteresis comparison circuit through positive feedback, and the high threshold value and the low threshold value of the hysteresis comparison circuit can be adjusted by adjusting the resistance values of the comparator R1, the comparator R2, the comparator R3 and the comparator R4, so that the influence of noise carried by trigger input on edge detection can be effectively filtered. The SMB connector and hysteresis comparison circuit 203 outputs a clean, stable, steep STROBE signal data_strobe to the SRAM and control circuit 204.

SRAM and control circuitry 204 functions as a data register. When the DATA_STROBE has no edge change, the SRAM and control circuit 204 gates the value of the working voltage Vn of the EEPROM202 and outputs the value to the DAC 205; when the data_strobe changes, the SRAM and control circuit 204 gates the value of the burr voltage Vg of the EEPROM202 and outputs it to the DAC 205.

FIG. 4 provides one example of an SRAM and control circuit, with the control circuit being core of an FPGA. On the one hand, the FPGA loads the values Vn and Vg stored in the EEPROM202 into the SRAM in advance through the IIC bus, and the quick read-write performance of the SRAM is fully utilized to achieve the quick digital-to-analog conversion of the DAC. On the other hand, the FPGA generates a control time sequence of the DAC according to preset information, wherein the control time sequence comprises signals such as data and a clock and the like, and the signals are used for controlling the DAC. When the data_strobe has no edge change, the FPGA reads the working value vn=3.3 from the SRAM, latches into the transmit register and continuously outputs to the DAC 205; when the FPGA detects that the rising edge transition occurs in the data_strobe, the FPGA reads the values of the spur voltage Vg from the SRAM, that is, several values vg= -2 and vg=3.3 (the spur width=200ns is set by the waveform of the Vg value), and sequentially latches the values to the transmission register and outputs the values to the DAC 205.

The DAC (model: AD 5761R) 205 converts the values outputted from the SRAM and control circuit 204 into analog quantities, that is, the values vn=3.3, vg=2, vg=3.3 into analog voltages vn=3.3V, vg=2V, vg=3.3V, respectively, and obtains a burr width=200ns. Fig. 5 provides a schematic diagram of the analog voltage signal and the spur width of the present embodiment, wherein the thin solid line represents the analog voltage signal converted from the value Vn, and the thick solid line represents the analog voltage signal converted from the value Vg.

The operational power supply vs= (v+) - (V-) = (+12) - (-12) =24v of the operational amplifier (model: OPA 544) 206 power-amplifies the analog voltage signal output from the DAC205, and improves the current driving capability of the analog voltage vn=3.3v and the analog voltage vg= -2V without changing the analog voltage value.

The BNC connector and the overvoltage protection circuit 207 have a BNC connector. The BNC connector is connected to an injection point of a target object through a voltage spike fault injection probe with a BNC interface, and injects the generated voltage spike into the target object. The overvoltage protection circuit can prevent the operational amplifier 206 from being damaged by the excessive external voltage.

In summary, the embodiment provides the operating power vn=3.3v for the injection point of the target object, and when the pulse signal generated by the digital logic circuit changes along the edge, the voltage burr fault injection with the burr depth vg= -2V and the burr width=200ns is generated. The present utility model thus provides a device capable of supplying an operating power Vn and a burr voltage having a depth Vg to an injection point of a target object, and energy sources of the operating power Vn and the burr voltage Vg are continuously supplied from a single power source.

Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present utility model, and not for limiting the same; although the utility model has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some or all of the technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit of the utility model.

Claims (7)

1. A single-power continuous source mode voltage glitch fault injection apparatus, said apparatus comprising: a trigger signal input interface composed of an SMB connector and a hysteresis comparison circuit, a data register composed of an SRAM and a control circuit, a digital-to-analog conversion module, a power amplifier, a voltage burr output interface, a data memory and a digital technology interface,

the SMB connector is connected with the hysteresis comparison circuit in parallel, and then outputs the hysteresis comparison circuit to a first input end of the control circuit, the data memory is connected with a second input end of the control circuit, an output end of the control circuit is connected with the digital-to-analog conversion module, and the digital-to-analog conversion module is connected with the power amplifier and the voltage burr output interface in sequence.

2. The single electric continuous source mode voltage glitch injection apparatus of claim 1 in which said hysteresis comparator circuit is comprised of a TVS tube, a first resistor, a second resistor, a third resistor, a fourth resistor, a fifth resistor and a comparator,

the TVS tube, the first resistor and the capacitor form a first branch;

the second resistor and the fifth resistor form a second branch;

the third resistor and the fourth resistor form a third branch;

the first branch and the second branch are connected with a circuit node A and a circuit node B;

the third branch is connected in parallel with the capacitor.

3. The single electric continuous source mode voltage glitch fault injection apparatus of claim 2 in which said third leg is connected in parallel with said capacitor and comprises:

one end of the third resistor is connected with the IN-terminal of the comparator and the circuit node C, the other end of the third resistor is connected with the VEE terminal of the comparator and the circuit node D, and the circuit node D is communicated with the circuit node E of the first branch.

4. The single electric continuous source mode voltage glitch fault injection apparatus of claim 2 in which said third branch is connected in parallel with said capacitor, further comprising:

one end of the fourth resistor is connected with the IN-terminal of the comparator through a circuit node C, the other end of the fourth resistor is connected with the VCC terminal of the comparator through a circuit node F, and the fourth resistor is communicated with the circuit node B through the circuit node F.

5. The single-power continuous-source mode voltage glitch injection apparatus of claim 2 IN which said circuit node a is directly connected to the in+ terminal of said comparator.

6. The single electric continuous source mode voltage glitch injection apparatus of claim 2 in which the output of said comparator is connected to the input terminal of the control circuit via a circuit node G, one end of said circuit node G being connected to said second resistor and the other end being connected to said fifth resistor.

7. The device of claim 6, wherein the second input terminal of the control circuit is connected to the data memory, and the voltage value is pre-stored in the SRAM, so as to achieve the purpose of rapidly transmitting the voltage value to the digital-to-analog conversion module.

Images