DE102017207046B4 - Method for producing and reading out a cryptographic circuit - Google Patents

Abstract

A manufacturing method (200), comprising the steps of: providing (202) a semiconductor substrate (102), the semiconductor substrate (102) having a cryptographic circuit (104) and a nonvolatile memory (106); detecting (204) cryptographic information of the cryptographic circuit (104) storing (206) the cryptographic information on the memory (106); andclearing (208) the semiconductor substrate (102) between the cryptographic circuit (104) and the memory (106) such that the cryptographic circuit (104) and the memory (106) are disposed on portions of the semiconductor substrate (102) completely separate from one another; wherein the cryptographic information of the semiconductor-level cryptographic circuit (104) is read out and stored in the memory, wherein the cryptographic information is a request-response pair.

Description

Embodiments of the present invention relate to a manufacturing process of semiconductor technology, and more particularly to a manufacturing process for manufacturing and reading a cryptographic circuit.

For security applications PUFs (PUF = physical uncloneable function) are a possibility to enable a secure authentication, whereby for so-called strong PUFs (PUFs) previously certain pairs of values measured individually on each manufactured part (Challenge Response Pairs, CRP, dt. Request-Response Pair).

Currently it is the case that the PUF structures are fabricated and subsequently the CRPs are read out and stored in a database.

The major disadvantage of this method is that the manufacturer (possibly contract manufacturer) as well as unknown persons in the entire transport chain theoretically have access to the PUFs and could read out the CRPs, which represents a high security risk. The possibility of attack exists because lines, connections and possibly circuit parts are required for the readout process, which can also be used by the attacker. There are therefore solutions in which the corresponding circuit parts are rendered unusable after the initial determination of the CRPs by a modification, e.g. by burning through electronic fuses or by writing on one-time programmable memory (OTP). These solutions, on the one hand, have weaknesses in long-term stability or can be reversed or circumvented by relatively simple modifications to the fabricated part (e.g., by means of a focused ion beam, FIB). Assuming a relatively large number of known CRPs, predictions about the next CRP can be made by the attacker, which is why it is absolutely necessary to prevent access as described above.

The US 4,446,475 A shows an integrated circuit chip with a digital memory, wherein direct access to at least a part of the memory is prevented. Contact pads with leads for connecting the contact pads to the memory bus are provided, and a security code may be programmed into a portion of the memory during the wafer test, destroying the coupling lines between the contact pads and the memory bus as the integrated circuit chip is removed from the wafer becomes.

The DE 10 2011 081 421 A1 shows a system for secure transmission of data with a control device, which is adapted to generate a cryptographic key by means of a physically non-imitable function, PUF, and with a security module, which is adapted to the control device, based on the generated cryptographic keys, encrypted and / or authenticated to communicate.

The US 6 365 443 B1 FIG. 12 shows a semiconductor wafer, wherein chip areas for storing memory areas, scribe areas for cutting the semiconductor wafer, pad for supplying electrical signals from the outside for writing data into the memory areas, and lead wires for electrically connecting the pads are provided on the semiconductor wafer. After data has been written in the storage areas by the pads, the semiconductor wafer is cut along the scribe areas, whereby semiconductor chips are obtained. At the time of this cutting, the pads or the lead wires are cut off.

US 2003/0 021 421 A1 discloses a method of manufacturing a decryption device including a cryptographic device and a decryption key.

US 2012/0 199 948 A1 shows a semiconductor chip with a semiconductor substrate, an integrated circuit area with an integrated circuit and conductor tracks which extend over the integrated circuit area. In order to protect the semiconductor chip against physical attack, the semiconductor chip includes an array of protection capacitors extending over the traces.

US 2015/0 226 785 A1 relates to a test method for testing a chip. There is provided a semiconductor wafer having a die region and a scribe region, and the semiconductor wafer includes a die and a test circuit. The chip is formed on the chip area of the semiconductor wafer, and the chip includes a main circuit. The test circuit is disposed on the scribe area of the semiconductor wafer and is electrically connected to the chip for testing the main circuit.

The present invention is therefore based on the object to improve the security of the cryptographic circuit against unauthorized readout.

This object is solved by the independent claims.

Advantageous developments can be found in the dependent claims.

• - Bereitstellen eines Halbleitersubstrats, wobei das Halbleitersubstrat eine kryptographische Schaltung und einen nichtflüchtigen Speicher aufweist;
• - Ermitteln einer kryptographischen Information der kryptographischen Schaltung;
• - Speichern der kryptographischen Information auf dem Speicher; und
• - Auftrennen des Halbleitersubstrats zwischen der kryptographischen Schaltung und dem Speicher, so dass die kryptographische Schaltung und der Speicher auf voneinander vollständig getrennten Teilen des Substrats angeordnet sind.

Embodiments provide a manufacturing method, comprising the following steps:

• Providing a semiconductor substrate, the semiconductor substrate having a cryptographic circuit and a nonvolatile memory;
• Determining cryptographic information of the cryptographic circuit;
• - storing the cryptographic information on the memory; and
• - Separating the semiconductor substrate between the cryptographic circuit and the memory, so that the cryptographic circuit and the memory are arranged on parts of the substrate completely separated from each other.

The present invention is based on the idea, in the production of the cryptographic circuit, of reading the cryptographic information of the semiconductor-level cryptographic circuit and storing it in a memory which is arranged on the same semiconductor substrate as the cryptographic circuit, and the semiconductor substrate following the read-out the cryptographic information between cryptographic circuit and memory to the cryptographic circuit and the memory completely, eg mechanically and electrically, to separate from each other.

Further embodiments provide a semiconductor substrate, wherein the semiconductor substrate comprises a cryptographic circuit, a nonvolatile memory and a readout circuit, wherein the readout circuit is adapted to read the cryptographic circuit to obtain cryptographic information and to store the cryptographic information in the memory ,

In the following, preferred embodiments of the manufacturing method will be described in more detail.

In embodiments, the cryptographic circuit may be a physically unclonable function or may map (or implement) a physically unclonable function.

In embodiments, the cryptographic information may be a request-response pair or a set of request-response pairs.

For example, a request may be a bit string applied to the cryptographic circuit. The answer may also be a bit string that the cryptographic circuit issues in response to the request. The request and the response may be stored together as the request-response pair in the nonvolatile memory.

In embodiments, the cryptographic information may be stored exclusively on the nonvolatile memory.

For example, this can ensure that the cryptographic information is protected both during production and during transport. Even the manufacturer of the cryptographic circuit thus has no access to the cryptographic information.

In embodiments, the semiconductor substrate may include a readout circuit for reading out the cryptographic circuit. In this case, the cryptographic information can be read out by the readout circuit and stored on the nonvolatile memory.

For example, the cryptographic circuit may comprise the readout circuit. Furthermore, the memory may comprise the readout circuit. Of course, the readout circuit may also be external to the cryptographic circuit and the memory.

In embodiments, the semiconductor substrate may include a data line connecting the memory to the cryptographic circuit.

In embodiments, the readout circuit may include a data line connecting the memory to the cryptographic circuit.

By way of example, the data line may be a printed circuit trace, a semiconductor channel or an optical channel or an inductive or electromagnetic transmission path (on-chip antenna).

When disconnecting the semiconductor substrate, the data line can be disconnected.

In embodiments, the data line may be connected to the memory via an electrically disconnectable fuse (e.g., breaker or transistor). After determining the cryptographic information, the electrical connection between the data channel and memory can be disconnected by the fuse.

In embodiments, the data line may be connected to the cryptographic circuit via an electrically disconnectable fuse (eg, breaker or transistor). After determining the cryptographic information, the electrical connection between the data channel and the cryptographic circuit are separated by the electrically separable fuse.

In embodiments, the semiconductor substrate may include a shield that shields the data line.

The shield may have at least one shielding layer extending from the cryptographic circuit to the memory and wider than the data line.

The shield may have two (or more) shielding layers, with the data line extending between the two shielding layers. The manufacturing method may include a step of determining a deviation of at least one capacitance value of the two shielding layers or a deviation of a capacitance ratio between the two shielding layers to detect an external engagement.

For example, capacitance values between the respective shielding layer and the data line can be measured, wherein a change of at least one of the two capacitance values, or a change of a ratio between the two capacitance values to an external attack can be concluded.

For example, each shield layer may consist of juxtaposed, matched capacitors. Diverge their capacity ratio to each other from the target value is a manipulation of the chip.

For example, the resistance value of the shielding layer can be measured in order to be able to determine a manipulation of the chip.

In embodiments, the data line may be a differential data line.

In embodiments, the data line may be an optical data line.

• 1 ein Flussdiagramm eines Herstellungsverfahrens, gemäß einem Ausführungsbeispiel;
• 2 eine schematische Draufsicht auf das Halbleitersubstrat mit der PUF und dem Speicher, gemäß einem Ausführungsbeispiel;
• 3 eine schematische Querschnittsansicht des Halbleitersubstrats mit der PUF und dem Speicher, wobei die PUF und der Speicher über einen Kanal miteinander verbunden sind, gemäß einem Ausführungsbeispiel;
• 4 eine schematische Draufsicht auf das Halbleitersubstrat mit der PUF und dem Speicher, wobei der Kanal zwischen PUF und Speicher Sicherungen zum Trennen der elektrischen Verbindung aufweist, gemäß einem Ausführungsbeispiel;
• 5 eine schematische Draufsicht auf das Halbleitersubstrat mit der PUF und dem Speicher, wobei das Halbleitersubstrat eine Schirmung aufweist, die die Datenleitung zwischen PUF und Speicher schirmt, gemäß einem Ausführungsbeispiel;
• 6 eine schematische Draufsicht auf das Halbleitersubstrat mit der PUF und dem Speicher, wobei die PUF und der Speicher über eine symmetrische Datenleitung miteinander verbunden sind, gemäß einem Ausführungsbeispiel; und
• 7 eine schematische Draufsicht auf das Halbleitersubstrat mit der PUF und dem Speicher, wobei die PUF und der Speicher über eine optische Datenleitung miteinander verbunden sind, gemäß einem Ausführungsbeispiel.

Embodiments of the present invention will be described with reference to the accompanying figures. Show it:

• 1 a flowchart of a manufacturing method, according to an embodiment;
• 2 a schematic plan view of the semiconductor substrate with the PUF and the memory, according to an embodiment;
• 3 a schematic cross-sectional view of the semiconductor substrate with the PUF and the memory, wherein the PUF and the memory are connected to each other via a channel, according to an embodiment;
• 4 a schematic plan view of the semiconductor substrate with the PUF and the memory, wherein the channel between the PUF and memory fuses for disconnecting the electrical connection, according to an embodiment;
• 5 a schematic plan view of the semiconductor substrate with the PUF and the memory, wherein the semiconductor substrate has a shield which shields the data line between PUF and memory, according to an embodiment;
• 6 a schematic plan view of the semiconductor substrate with the PUF and the memory, wherein the PUF and the memory are connected to each other via a symmetrical data line, according to an embodiment; and
• 7 a schematic plan view of the semiconductor substrate with the PUF and the memory, wherein the PUF and the memory are connected to each other via an optical data line, according to one embodiment.

In the following description of the embodiments of the present invention, the same or equivalent elements are provided with the same reference numerals in the figures, so that their description is interchangeable.

1 shows a flowchart of a manufacturing process 200 according to an embodiment of the present invention. The manufacturing process 200 includes a step 202 providing a semiconductor substrate, wherein the semiconductor substrate comprises a cryptographic circuit and a non-volatile memory. Furthermore, the manufacturing process includes 200 one step 204 determining cryptographic information of the cryptographic circuit. Furthermore, the manufacturing process includes 200 one step 206 storing the cryptographic information on the memory. Furthermore, the manufacturing process includes 200 one step 208 separating the semiconductor substrate between the cryptographic circuit and the memory, such that the cryptographic circuit and the memory are arranged on parts of the semiconductor substrate that are completely separate from one another.

This in 1 The manufacturing method shown below will be described with reference to 2 to 7 described in detail. In the following description, it is assumed by way of example that the cryptographic circuit has a physical unclonable function (PUF) and that the cryptographic information is a request-response pair or a set of request-response pairs. However, the following description is equally applicable to other cryptographic circuits and / or other cryptographic information.

The following 2 to 7 show schematic views of the semiconductor substrate 102 after the step 202 the provision of the semiconductor substrate 102 with the cryptographic circuit (PUF) 104 and the memory 106 and other optional features. The 2 to 7 Thus, show schematic views of an intermediate product of the manufacturing process 200 , this intermediate being used to carry out the steps 204 and 206 of the manufacturing process 200 can be used before following this in step 208 is disconnected.

2 shows a schematic plan view of the semiconductor substrate 102 with the PUF 104 and the memory 106 , according to an embodiment. As in 2 can be seen, the PUF 104 and the memory 106 on the same semiconductor substrate 102 , eg a wafer.

In embodiments, the PUF 104 and the memory 106 via a data line 108 be connected to each other. The data line 108 may be, for example, a conductor or a semiconductor channel.

In embodiments, the semiconductor substrate 102 a readout circuit (not shown in FIG 2 ) respectively. The readout circuit may be on the semiconductor substrate 102 be executed as an independent circuit, or in the PUF 104 or in the store 106 be integrated.

In embodiments, the readout circuit with the PUF 104 be connected. The readout circuit can be connected to the memory 104 be connected. The PUF 104 and the memory 106 can be connected directly with each other. Alternatively, the PUF 104 and the memory 106 be connected to each other via the readout circuit. For example, the readout circuit between PUF 104 and data line 108 (eg if the readout circuit in the PUF 104 integrated or adjacent to the PUF 104 is arranged) or between data line 108 and memory 106 (Eg, if the readout circuit in the memory 106 is integrated or adjacent to the memory 106 is arranged) to be switched.

In embodiments, during wafer level manufacturing, a CRP or a set of CRPs may be removed from the PUF 104 be read out and in the memory 106 get saved. The readout circuit can be designed to be a CRP or a set of CRPs from the PUF 104 read out and in the store 106 save.

For example, the read-out circuit can send a request, for example a bit sequence, to the PUF 104 invest. The answer of the PUF 104 , eg also a bit sequence, can be sent directly to the memory via the data line 106 or via the readout circuit in the memory 106 to be written. In both cases, the readout circuit may also request in memory 106 write so that a request-response pair is stored in the memory.

After reading the PUF 104 , the semiconductor substrate can 102 between the PUF 104 and the memory 106 be separated so that the PUF 104 and the memory 106 on completely separate parts of the semiconductor substrate 102 are arranged.

For example, the semiconductor substrate 102 by sawing (or another semiconductor technology separation process) between the PUF 104 and the memory 106 be separated. In 2 (and also in the 3 to 7 ) is the sawing channel 110 that between PUF 104 and memory 106 runs, exemplified drawn.

In embodiments, the CRPs (the PUF 104 ) So even at the wafer level by a memory chip 106 be read out. This allows a key-lock principle between two ICs (PUF 104 and memory 106 ) arise. The PUF structure can be read out via an integrated circuit and the CRPs can be read into a neighboring memory module via a contact 106 (For example, a ROM (ROM = read only memory) or the like) are stored. This store 106 can be protected against unauthorized read-out, for example by logging every access (counter) and making the read-out key unusable. Thus, a later access with this key can be made impossible. In addition, other methods can be used to prevent or detect invasive readout and to sort out the chips. After the CRPs have been read, the two ICs (PUF 104 and memory 106 ) are separated by normal IC separation methods (eg sawing) and each individually bonded into a package. This method can be used, for example, by automobile manufacturers who use the PUF structures for authentication with radio keys, but have them manufactured externally. As an extension, various security mechanisms can be used, such as a synchronous or asynchronous encryption of the CRPs or a shielding of the readout lines 108 with capacitive attack detection. Also, the PUF 104 determine their Hamming distance to allow only secure CRPs, thus preventing possible manipulation of its randomness. As part of a BIST (BIST = bulld-in-self-test, built-in self-test), the memory module 106 check the consistency and entropy of the CRPs.

The following are the in 2 shown PUF structure 104 and memory structure 106 considered as given and in part generally referred to as IC. The following embodiments are based on 2 out, so the pair from a PUF 104 and a memory 106 , The reading process of the keys (or CRPs) can be started (eg by the BIST) as soon as the electrical supply is produced via a wafer prober. After completion of the read-out process, a fuse can optionally be triggered (eg by the BIST) (see 4 ), so the data channel 108 can not be used anymore.

3 shows a schematic cross-sectional view of the semiconductor substrate 102 with the PUF 104 and the memory 106 , where the PUF 104 and the memory 106 over a canal 108 (eg for transmission in BIST mode) are interconnected. In detail, a contact 112 (eg output contact or output connection) of the PUF 104 with a contact 114 (eg input contact or input connection) of the memory 106 over the canal 108 be connected.

For example, the ICs 104 . 106 by means of a simple resistance channel 108 be connected. This may first have been patterned in the silicon wafer, for example by n + implantation or in an additional step with a polysilicon resistor channel or with a metal wiring. In this case, an output of the PUF 104 with an input of the memory 106 be directly connected. This is the simplest form of "pairing" the two ICs 104 . 106 However, this does not provide any security mechanisms against eavesdropping on the resistance channel 108 by microprobing during the readout process.

4 shows a schematic plan view of the semiconductor substrate 102 with the PUF 104 and the memory 106 , where the channel 108 between PUF 104 and memory 106 fuses 116 having. About the fuses 116 can the electrical connection of the channel 108 after reading the PUF 104 be separated.

Unlike the in 3 shown embodiment, in which the PUF 104 in hindsight still could be read out, since the line ends are openly accessible, this can in the in 4 shown embodiment by fuses 116 (English fuses) are prevented. These can be, for example, within the ICs 104 . 106 eg in the resistance line 108 to be built in. Once the read operation is completed, the fuses can be disconnected to break the resistance line so that open ends are no longer accessible. As a result, the lines can also be protected against external environmental influences and a degradation of the ICs 104 . 106 can be prevented.

5 shows a schematic plan view of the semiconductor substrate 102 with the PUF 104 and the memory 106 , wherein the semiconductor substrate 102 a shield 118 that has the data line 108 between PUF 104 and memory 106 shields. As in 5 it can be seen, the shielding 118 have a Schirmungslage extending from PUF 104 until memory 106 extends and / or wider than the data line 108 is, for example, so that in a plan view of the semiconductor substrate 102 the data line 108 is completely covered by the Schirmungslage. The shielding 118 may further comprise a further Schirmungslage, in the plan view of the semiconductor substrate 102 below the data line 108 runs. The shielding 118 Thus, it can have two shielding layers, which are arranged adjacent to one another or run parallel to one another, the data line 108 is arranged between the two Schirmungslagen.

By the in 5 Shielding shown 118 eg by means of metal layers or implantation in the wafer 102 The readout process can be protected against attacks such as microprobing. In this case, the metal layers on or under the resistance line 108 be processed and, for example, to a fixed potential, such as mass, are laid. The Schirmungsbahnen can be so wide that they are the resistance line 108 clearly exceed the width, see 5 , In this way, direct contacting or measuring of the electric field of the line 108 be prevented.

In embodiments, to detect an external attack, the capacitance values between the respective shield layer and the data line can be measured. A change in at least one of the two capacitance values or a deviation of the capacitance values from one another or a change in the ratio between the capacitance values may indicate an external attack.

That in terms of 5 So described principle can therefore additionally for a capacitance measurement between resistance line 108 and shielding 118 be used. For example, deviations in the capacity ratio of the upper and lower shield can be observed. This makes it possible to visualize external interference in an altered capacitance value at the top or bottom side. A compensation of the capacity ratio change by simultaneous manipulation of the top and bottom by an attacker is unlikely. For this reason, this structure can actively respond to an intervention and the compromised ICs 104 . 106 may even make us unusable.

Furthermore, for the shielding of the line 108 several matched capacitors or resistors are used. In a manipulation their capacity or resistance ratio is disturbed with each other, so that an attack can be detected. Resistances and capacitance values can also be used to detect attacks.

6 shows a schematic plan view of the semiconductor substrate 102 with the PUF 104 and the memory 106 , where the PUF 104 and the memory 106 via a symmetrical data line 108 with two channels 108_1 . 108_2 connected to each other.

In addition, in order to prevent so-called side-channel attacks, in which, for example, the power consumption is measured in order to infer the transmitted data, the data transmission can additionally be carried out differentially. The actual data and the inverse are transmitted in parallel, see 6 , It can be ensured that these are processed in a similar way, such as in 6 you can see. This can ensure that the paths each consume the same 0 and 1 stream. This concept should in this case already for the ICs 104 . 106 apply, as here only the data transfer is secured.

7 shows a schematic plan view of the semiconductor substrate 102 with the PUF 104 and the memory 106 , where the PUF 104 and the memory 106 via an optical data line 108 connected to each other. As in 7 it can be seen, the PUF 104 while an optical transmitter 120 exhibit while the memory 106 an optical receiver 122 can, wherein the optical transmitter 120 over the optical data line 108 with the optical receiver 122 connected is.

As an alternative to electrical transmission can therefore also an optical transmission with at least one transmitter 120 and at least one recipient 122 in the form of optical components according to 7 will be realized. As a result, the transmission channel can be secured against various attacks by listening. Furthermore, there are no open channel ends whereby a subsequent reading can be prevented.

Although some aspects have been described in the context of a device, it will be understood that these aspects also constitute a description of the corresponding method, so that a block or a component of a device is also to be understood as a corresponding method step or as a feature of a method step. Similarly, aspects described in connection with or as a method step also represent a description of a corresponding block or detail or feature of a corresponding device. Some or all of the method steps may be performed by a hardware device (or using a hardware device). Apparatus), such as a microprocessor, a programmable computer or an electronic circuit. In some embodiments, some or more of the most important method steps may be performed by such an apparatus.

For example, the methods described herein may be implemented using a hardware device, or using a computer, or using a combination of a hardware device and a computer.

The methods described herein, or any components of the methods described herein, may be performed at least in part by hardware and / or by software.

Claims (12)

Manufacturing process (200), with the following steps: Providing (202) a semiconductor substrate (102), the semiconductor substrate (102) having a cryptographic circuit (104) and a nonvolatile memory (106); Determining (204) cryptographic information of the cryptographic circuit (104); Storing (206) the cryptographic information on the memory (106); and Separating (208) the semiconductor substrate (102) between the cryptographic circuit (104) and the memory (106) so that the cryptographic circuit (104) and the memory (106) are disposed on parts of the semiconductor substrate (102) completely separated from each other; wherein the cryptographic information of the semiconductor-level cryptographic circuit (104) is read out and stored in the memory; wherein the cryptographic information is a request-response pair. Manufacturing process (200) according to Claim 1 wherein the cryptographic circuit (104) is a physically unclonable function. The manufacturing method (200) of any one of the preceding claims, wherein the cryptographic information is stored exclusively on the memory (106). The manufacturing method (200) according to one of the preceding claims, wherein the semiconductor substrate (102) has a readout circuit for reading out the cryptographic circuit (104); wherein the determining (204) of the cryptographic information comprises reading the cryptographic circuit (104) by the readout circuit; wherein the storing (206) of the cryptographic information comprises storing the cryptographic information on the memory (106) by the readout circuit. Manufacturing process (200) according to Claim 4 wherein the readout circuit comprises a data line (108) connecting the memory (106) to the cryptographic circuit (104); wherein in the severing (208) of the semiconductor substrate (102) the data line (108) is disconnected. Manufacturing process (200) according to Claim 5 wherein the data line (108) is connected to the memory (106) via a fuse (116); wherein the manufacturing method (200) comprises a step of disconnecting the electrical connection between the data line (108) and memory (106) after determining (204) the cryptographic information. Manufacturing process (200) according to Claim 5 or 6 wherein the data line (108) is connected to the cryptographic circuit (104) via a fuse (116); wherein the manufacturing method (200) comprises a step of disconnecting the electrical connection between the data line (108) and the cryptographic circuit (104) after determining (204) the cryptographic information. Manufacturing process (200) according to one of Claims 5 to 7 wherein the semiconductor substrate (102) has a shield (118) shielding the data line (108). Manufacturing process (200) according to Claim 8 wherein the shield (118) has at least one shielding layer extending from the cryptographic circuit (104) to the memory (106) and wider than the data line (108). Manufacturing process (200) according to one of Claims 8 to 9 wherein the shield (118) has two shielding layers, the data line (108) extending between the two shielding layers; wherein the manufacturing method (200) comprises a step of determining a deviation of at least one capacitance value of the two shield layers, or a deviation of a capacitance ratio between the two shield layers, a deviation of at least one resistance value of the two shield layers, or a deviation of a resistance ratio between the two shield layers has two Schirmungslagen to detect an external intervention. Manufacturing process (200) according to one of Claims 5 to 10 wherein the data line (108) is a differential data line. Manufacturing process (200) according to one of Claims 5 to 11 wherein the data line (108) is an optical data line.

Images