JP2731912B2 - Attack counter vessel - Google Patents

Description

Description: BACKGROUND OF THE INVENTION (1) Field of Industrial Application The present invention relates to an attack countermeasure container which is designed to counter attacks which attempt to decipher secret information stored therein.

(2) Prior Art In order to make the security of a computer system reliable, a mechanism that does not permit a user to physically access a certain part of the computer system is required.
This is particularly necessary, for example, when restricting the user from copying the contents of this part or changing the code.

In such a case, if a certain part of the system to be kept confidential is placed in a container and an attack that attempts to decipher the confidential information inside the container, for example, if there is an act of piercing the container, the internal By erasing the secret information, it is possible to face an attack. In this way, the container that counters an attack is a counter-attack container (Tamper Resistant Modul
e) is called.

As a conventional attack countermeasure container, Japanese Patent Application Laid-Open No. 63-78250 discloses a technique for detecting an attack (cut or short circuit) by a conductive path formed by a thin film technique. However, according to this conventional technique, if an attack is made after forming a bypass (a detour) in a conductive path before and after a point to which an attack is to be made, the internal information can be relatively easily detected without being detected. Is known to be stealable. As a countermeasure for improving the attack detection ability, the following improved technology has been developed.

Steve H. Weingart as another conventional attack countermeasure
(IBM Thomas J. Watson Research Center) "Physica
l Security for the μABYSS System (Proceeding
s, 1987 IEEE Symposium on Security and Privacy, Oak
land, CA, April 27-29, 1987, pp. 55-58) ".

This means that when a container containing confidential information is wrapped around with a thin wire (Nichrome wire), the resistance changes when the wire is cut, short-circuited, or the connection is changed. Was to detect an attack and delete the internal secret information.

(3) Problems to be Solved by the Invention However, the process of winding the container in multiple layers with a thin wire is not suitable for mass production, and the resistance of the wire changes due to aging and environmental changes such as temperature. There is a problem in that an attack that does not perform detection is erroneously detected and internal secret information is erased.

In addition, there is a problem that when an actual attack is overlooked and internal secret information is to be deleted, the deletion fails.

Furthermore, the two technologies described as the prior art each employ a method of detecting the presence or absence of conduction or a change in the resistance value, that is, a change in the analog value to detect an attack. There was a problem that it could or could not be detected. In addition, there is also a problem that there is no method for coping with the occurrence of a defect in the conduction path during manufacturing or during use, and the use cannot be continued.

(4) Means for Solving the Problems The present invention has been made in view of the above points, and is capable of mass production and does not erase an internal secret information by detecting an attack by mistake. The purpose is to
In order to achieve this object, a logic element is arranged on the outer peripheral surface of a container storing secret information therein, and an external attack is detected when the logic element loses its normal operation.

(5) Operation In this configuration, by arranging the logic elements on the outer peripheral surface of the container, mass production becomes possible, and by detecting the operation of the logic elements and detecting an external attack,
We try not to detect attacks by mistake.

(6) Example Hereinafter, the present invention will be described with reference to the drawings.

FIG. 1 is a perspective view showing an embodiment of a counter attack container according to the present invention. FIG. 2 is an exploded plan view showing an embodiment of an attack countermeasure container according to the present invention.

In FIG. 1, an attack counter-container 1 is composed of two substrates 2 and 3, and the substrates 2 and 3 are connected to a joint 2a of the substrate 2 and a joint 3a of the substrate 3 as shown in FIG. It is formed by joining. Joint 2a and joint
Memory element 4 also exists in 3a, and the junction is memory element 4
Directly, or via a layer that is rigidly connected to the memory element 4. The setting of the bonding area and the selection of the adhesive are performed so that the bonding strength is higher than the strength for separating the constituent layers of the transistor 8 described in FIG. The strength is a strength against an attack.

The attack counter vessel 1 made by such a joint is
Since it can be made extremely thin, it has the same detection accuracy as an up-down direction against attacks from the side direction. Attack Counter Container 1
Is thicker, the same detection accuracy as the other upper and lower surfaces can be maintained by disposing the memory element 4 also on the side surface of the attack counter container 1.

The secret information is placed in the form of a memory element or the like inside the joint surface between the joints 2a and 3a. Joint 2a and joint 3a
Are formed by applying an adhesive to the peripheral portions on one side of the substrate 2 and the substrate 3, respectively. The size of the attack counter container 1 is about several mm to several tens cm on one side,
Although there is a lower limit depending on the size of the memory element 4 described later, the upper limit is practically unlimited.

The memory element 4 shown in FIG. 3 is formed on the upper surface of the substrate 2 (FIG. 1) and the lower surface of the substrate 3 by a vapor phase method or the like. The memory element 4 shown in FIG. 3 is an example of a case where a dynamic memory is configured by three transistors Tr1, Tr2, and Tr3, and is described in “The VL” by J. Newkirk and R. Mathews.
SI Desingner's Library "(Addison-Wisley, 1983)
Are disclosed. The memory element 4 is not limited to a dynamic memory, but may be a static memory. A plurality of memory elements 4 are arranged on the surfaces of the substrate 2 and the substrate 3, and a write clock line, a read clock line, a data line, and a ground line of each memory element 4 are connected to each other. In addition,
In FIG. 1, only a part of the arrangement of the memory elements 4 is shown in an enlarged manner. Individual transistors Tr1, Tr2, Tr3
Is several tens of μm. In addition, in order to clarify the description of the drawings, the memory element 4 shown in FIG. 3A is schematically represented below as shown in FIG. 3B.

The memory element 4 has a fourth surface on the surface of the substrate 2 and the substrate 3.
It is arranged as shown in FIG. 5 or FIG. That is, the transistors Tr1, Tr2, and Tr3 are configured to form a checkered pattern. FIG. 4B is a sectional view taken along line AA of FIG.
become that way.

Transistors arranged on surfaces of substrate 2 and substrate 3
If any one of Tr1, Tr2, and Tr3 is attacked, the memory element 4 loses its function as a memory element. Therefore, the memory contents of the memory element 4 must be repeatedly read out by a circuit described later with reference to FIG. Detects the function as a memory element, and when the function as the memory element is lost and the memory element 4 is detected, the internal secret information is erased as being attacked. In addition,
An attack herein is defined as mechanical force, temperature change, chemical,
It refers to the act of trying to decipher internal secret information by biochemical means, laser, etc.

In the example shown in FIG. 4, the transistors Tr1, Tr2, Tr
Assume that the size of 3 is ε, and that the transistors Tr1, Tr2, and Tr3 function even if some of them are missing. In the worst case, attack until the side indicated by the opening 5 has a hole of about 3ε. May not be detected.

Therefore, in the example shown in FIG. 5, two layers of the first layer 6 and the second layer 7 of the memory element 4 are overlapped.
That is, the sectional view taken along the line AA in FIG. 5 (a) is as shown in FIG. 5 (c), and the sectional view taken along the line BB in FIG. 5 (b) is shown in FIG. 5 (d). So that the first layer 6 and the second layer
The layer 7 and the layer 7 are overlapped. Thus, when the first layer 6 and the second layer 7 are viewed from the outside, the transistor Tr
1, because it is covered with one of the transistors Tr2 and Tr3, the worst case is that an attack can be detected only by making a hole of about 2ε on one side.

By proceeding with this idea and further increasing the number of layers, the diameter of a hole that can detect an attack can be made as close as possible to ε. In addition, when detecting the function of the memory element 4 as a memory element, it is possible to adjust the sensitivity of attack detection by taking a logical product or a logical sum between the multilayered layers. Erroneous detection due to the error or permanent error can be avoided. Conversely, the memory element 4 can be provided only on a part of the outer peripheral surface according to the part where the secret information exists, so that erroneous detection due to an error can be avoided.

In the above-described attack counter containers shown in FIGS. 1 to 5, the small MOS transistors T
Although the embodiment in which a large number of r1, Tr2, and Tr3 are arranged has been described, it is also possible to increase the size of each of the transistors Tr1, Tr2, and Tr3 in a certain direction. FIG. 6 (a)
Shows an example of the MOS transistor 8 in which the dimension in one direction is increased as described above.

In FIG. 6 (a), the transistor 8 includes a three-layered source 8a, a gate 8b, and a drain 8c.
The lead of 8a and the drain 8c is drawn out to the right side of the drawing, and the lead of the gate 8b is drawn out to the left of the drawing. The transistor 8 is formed on the upper surface of the substrate 2 and the lower surface of the substrate 3 (both in FIG. 1) by a vapor phase method or the like. Which of the source 8a and the drain 8c is outside the attack counter vessel 1 is arbitrary.

6 (b) and 6 (c) show the case where the source 8a is outside the attack counter vessel 1 and has been subjected to a mechanical attack. FIG. 6B shows a case where the source 8a and the gate 8b are mechanically attacked, and there is an attack that divides two of the three layers of the transistor 8 into right and left (FIG. 6). In such a case, the transistor 8 loses its function as a transistor, and when it is detected that the memory element formed by the transistor 8 has lost its function, the internal secret information is erased as being attacked. I have.

FIG. 6C shows a case where the three layers of the source 8a, the gate 8b, and the drain 8c are mechanically attacked, and all of the three layers of the transistor 8 are divided into right and left (FIG. 6). Therefore, the transistor 8 loses its function as a transistor, and erases the internal secret information on the assumption that it has been attacked, as in the case shown in FIG. 6B described above.

FIG. 7 shows a transistor 8 which was linear in FIG.
Is a plan view showing a case where is formed in a zigzag shape. The lead wires of the source 8a and the drain 8c are drawn to the lower left of the drawing, and the lead wire of the gate 8b is drawn to the upper left of the drawing. The transistor 8 is formed on the upper surface of the substrate 2 and the lower surface of the substrate 3 (both in FIG. 1) by a vapor phase method or the like. Since the area of each transistor 8 shown in FIG. 7 is large, the number of transistors 8 formed on the substrate 2 or 3 can be reduced.

FIG. 8 is a plan view showing a modification in which the transistor 8 shown in FIG. 7 is formed in a zigzag shape. Source
Since all lead wires 8a, drain 8c, and drain 8c are led out to the upper left side of the drawing, wiring may be easier. In addition, since the winding is bifilar, it is possible to cancel the induced signal in the forward path and the return path, and to set a high noise margin.

FIG. 9 shows a transistor 8 which is linear in FIG.
Is a plan view showing a case where is formed in a spiral shape. Source
The lead wires of 8a and drain 8c are drawn out from the center,
The lead wire of the gate 8b is drawn out from the outer peripheral portion. Ninth
The transistor 8 illustrated in the drawing has a large area per transistor; therefore, the number of transistors 8 formed over the substrate 2 or the substrate 3 can be reduced.

FIG. 10 is a plan view showing a modification in which the transistor 8 shown in FIG. 9 is formed in a spiral shape. Source 8
Since all lead wires of a, drain 8c, and drain 8c are drawn out from the outer peripheral portion, wiring is facilitated. In addition, since the winding is bifilar, it is possible to cancel the induced signal in the forward path and the return path, and to set a high noise margin.

FIG. 11 is a perspective view showing a modification of the attack countermeasure container 1 shown in FIG. In the figure, the same components as those in FIG. 1 are denoted by the same reference numerals, and redundant description will be omitted.

In the attack counter vessel 1 shown in FIG.
As shown in FIG. 12, the substrate 2 is made of one substrate, and the substrate 2 and the substrate 3 are joined by bending a portion shown by a broken line in FIG. The setting of the bonding area and the selection of the adhesive are performed so that the bonding strength is higher than the strength for separating the constituent layers of the transistor 8 described in FIG. The strength is a strength against an attack.

FIG. 13 shows that when the substrate 2 and the substrate 3 are joined by bending the portion indicated by the broken line in FIG. 12, there is a difference in strength between the bent portion and the joined portion.
The case where the combination of the substrate 2 and the substrate 3 is made into four layers so as to be dispersed in the direction is shown. That is, the innermost substrate 2
In the combination of the substrate and the substrate 3, the position of the bent portion is in the upward direction in FIG. In the next combination of the substrates 2 and 3, the bent portion is located in the right direction in FIG. 13, and in the next combination of the substrates 2 and 3, the bent portion is located in the left direction in FIG. In the combination of the outermost substrate 2 and the substrate 3, the position of the bent portion is downward in FIG.

By dispersing the positions of the bent portions in this manner, 4
The strength against an attack from any direction can be uniform.

FIG. 14 is a perspective view showing another modification of the attack countermeasure container 1 shown in FIG. FIG. 1 or FIG. 11 to FIG.
The same components as those in FIG. 13 are denoted by the same reference numerals, and redundant description will be omitted.

In the attack counter-container 1 shown in FIG.
As shown in FIG. 15, it is made of one substrate, and the substrate 2 and the substrate 3 are joined by bending the broken line portion in FIG. At this time, a part of the substrate 2 and a part of the substrate 3 are bent so as to overlap each other at the central portion of the attack counter container 1.

FIG. 16 shows that, when a part of the substrate 2 and a part of the substrate 3 are bent so as to overlap at the center of the attack counter vessel 1, the strength of the overlapping part at the center differs from the other parts. The case where the combination of the substrate 2 and the substrate 3 is made into two layers such that the positions of the overlapping portions intersect in two directions is shown. That is, in the combination of the substrate 2 and the substrate 3 on the inner periphery, the position of the overlapping portion is in the horizontal direction in FIG. In the combination of the substrate 2 and the substrate 3 on the outer periphery, the position of the overlapping portion is in the vertical direction in FIG.

In this way, by making the positions of the overlapped portions intersect, the strength against attacks from any of the vertical and horizontal directions can be made uniform.

17 to 19 show the attack counter vessel 1 shown in FIG.
It is a perspective view which shows the other modification of. In the figure, the same components as those in FIG. 1 or FIGS. 11 to 16 are denoted by the same reference numerals, and duplicate description will be omitted.

The attack counter vessel 1 shown in FIG.
It is made of two rectangular substrates, and the portion indicated by the broken line in FIG. 12 is bent at three places to perform the joining at the joining portions 2a and 3a.

FIG. 18 means that three types of attack counter containers 1 having different positions of the joint 2a and the joint 3a are prepared. These three types of attack counter containers 1 are combined in a cubic shape as shown in FIG. In this way, by configuring the attack counter-container 1 in a cubic shape, secret information of a three-dimensional object can be placed inside the attack counter-container 1.

FIG. 20 shows a circuit for erasing secret information in order to detect an attack and counter it. The secret information is written in a secret holding circuit 14 composed of a RAM memory element.
The address generation circuit 10, the read result determination circuit 11, the secret erasure circuit 12, the write circuit 1,
7. The readout circuit 18 is placed inside the counter attack container 1, and the memory element 4 is placed outside the counter attack container 1. The power supply 13 may be placed inside the attack counter-container 1, or may be placed outside the attack counter-container 1 if a configuration described later regarding backup and instantaneous interruption is adopted.

FIG. 20 shows a case where the memory element 4 is constituted by a dynamic RAM. An address signal is supplied from the address generation circuit 10 to the memory element 4, and the write circuit 17 writes a random value or a bit of a predetermined value to the memory element 4 at the designated address. The address generation circuit 10 is constituted by, for example, a counter, and addresses all the memory elements 4 without omission. The contents of the memory element 4 in which the address is specified and the value is written in this way are immediately read out by the reading circuit 18. Therefore, the memory element 4 is constituted by a dichic RAM, but does not require a refresh operation.

The value written to the memory element 4 and the value read from the memory element 4 are supplied to the read result determination circuit 11. The read result determination circuit 11 is constituted by, for example, an exclusive OR circuit, and checks whether or not the value written in the memory element 4 and the value read from the memory element 4 match.

Next, the value to be written to the memory element 4 at the same address, that is, 0 and 1 are inverted to determine whether the value written to the memory element 4 and the value read from the memory element 4 match. Check again. Thereby, the memory element 4
The functions of all the transistors Tr1, Tr2, Tr3 constituting the above can be inspected as necessary and sufficient.

 The inspection result is supplied to the secret erasure circuit 12.

The secret erasure circuit 12, for example, connects the wiring from the power
Constituted by an analog switch that is grounded through
It is normally off. Since the secret erasure circuit 12 is turned off, the power of the power
And the secret information written in the secret holding circuit 14 composed of a RAM memory element is held. The secret information written in the secret holding circuit 14 is written via an input terminal 15 and read out via an output terminal 16. The read signal can be used only in the attack counter container 1.

When there is an attack on the attack counter vessel 1, as described above, the transistors Tr1, T
Since either r2 or Tr3 is destroyed, memory element 4
Loses the function as a memory element, and cannot correctly output written contents.

If there is a mismatch between the write / read contents of the memory element 4, the read result determination circuit 11 detects this and turns on the secret erasure circuit 12. When the secret erasure circuit 12 is turned on, the power supply of the secret holding circuit 14 is cut off.
Erase the stored contents.

The power sources of the power source 13 and the memory element 4, the address generation circuit 10, the read result determination circuit 11, the secret erasure circuit 12, the write circuit 17, and the read circuit 18 need not be batteries built in the attack countermeasure container 1. And a power supply supplied from an external commercial power supply and an external or built-in battery for backing up when the commercial power supply is turned off. In addition, when the battery of the power supply is external, when the battery is removed for battery replacement etc., an external or built-in large-capacity capacitor to respond to momentary interruption of the external commercial power supply Can also be configured.

In the case where the power supply 13 and the like are configured as described above, when the power supply is cut off, that is, when the backup battery is removed or exhausted and the external commercial power supply is cut off instantaneously, the memory element 4, Address generation circuit
10, if the operating voltage and the time constant are set so that the power supply of the read result determination circuit 11, the secret erasure circuit 12, the write circuit 17, and the read circuit 18 is turned off after the power supply of the secret holding circuit 14, The purpose of protecting the storage contents of the security circuit 14 can be achieved. This is because the attack detecting function and the secret erasing function operate while the stored contents (secret information) of the secret holding circuit 14 exist.

At extremely low temperatures, the stored contents (confidential information) of the security circuit 14 may be maintained even without a power supply. In such a case, the time from the normal operating temperature to the extremely low temperature is sufficiently long. Before the temperature becomes low, the detection is performed as an attack depending on the temperature, and the stored contents of the secret holding circuit 14 are deleted.

The circuit described in FIG. 20 can be variously modified.
For example, the memory element 4 can be constituted by a ROM or an EPROM instead of the RAM. However, the memory element 4
Alternatively, in the case of using an EPROM, a writing circuit becomes unnecessary.

The time required for the entire inspection of the memory element 4 to be completed is shorter than the time required for starting an attack and reading secret information. It is, for example, of the order of a few seconds, and the speed of testing all of the memory elements 4 may be slower than, for example, the refresh cycle of the video display memory. When the number of memory elements 4 is extremely large, the inspection speed is improved by dividing the entire memory element 4 into a plurality of banks and installing a plurality of circuits for detecting an attack corresponding to each bank. Can also.

In some cases, it is known that a detection element does not exist at a certain address or that a detection element at a certain address is defective for manufacturing reasons. In such a case, it is possible not to perform the attack detection on the address. If there are a considerable number of addresses for which no attack detection is performed, an unchecked bitmap representing addresses for which no attack detection is performed may be used. In this case, the non-inspection bit map can be configured by a ROM, and after the structure, before the shipment, an address where the detection element is absent or the detection element is defective can be checked and written to the ROM.

The device in the container protected by the attack countermeasure circuit shown in FIG. 20 may communicate with the outside. Also,
Read result judgment circuit with address holding register
The output address of the address generation circuit 10 when the 11 detects an attack may be stored to facilitate the later inspection. Similarly, a time holding register may be provided to store the output of the real-time counter when the read result determination circuit 11 detects an attack, thereby facilitating inspection at a later date.

By measuring the power supply voltage and temperature, it can be determined that an attack has occurred when the power supply voltage or the temperature is too low or too high.

As described above, the present invention has been described with reference to the embodiments. However, various modifications are possible according to the technical concept of the present invention. For example,
In the above-described embodiment, the memory element is provided on the outer peripheral surface of the container storing the secret information therein, and the attack detection is performed by detecting the stored content of the memory element. For example, a shift register, a logic element based on superconductivity, or the like may be arranged to detect an attack by detecting whether or not the operation is maintained.

(7) Effects of the Invention As described above, the present invention arranges logic elements on the outer peripheral surface of a container storing secret information therein, and detects an external attack by losing normal operation of the logic elements. Is configured to do so. This configuration enables mass production by arranging the logic elements on the outer peripheral surface of the container, and also detects erroneous attacks by detecting the operation of the logic elements and detecting an external attack. It can be eliminated. In addition, since an attack is detected by detecting a change in the digital value, it is possible to eliminate the problem of false detection or detection failure due to noise, etc. Even if it occurs, there is also an advantage that the use of the device can be continued only by modifying the program so as not to perform the attack detection on the missing portion.

[Brief description of the drawings]

FIG. 1 is a perspective view showing an embodiment of an attack countermeasure container according to the present invention, FIG. 2 is a plan view showing an embodiment of an attack countermeasure container according to the present invention, and FIG. FIG. 4 is a block diagram showing an embodiment of the container according to the present invention. FIG. 4 is a plan view and a sectional view showing an embodiment of the container against attack according to the present invention. FIG. FIG. 6 is a perspective view showing another embodiment of the counter attack container according to the present invention; FIG. 7 is a plan view showing another embodiment of the counter attack container according to the present invention; FIG. 9 is a plan view showing another embodiment of the attack countermeasure container according to the present invention. FIG. 9 is a plan view showing another embodiment of the attack countermeasure container according to the present invention. FIG. FIG. 11 is a plan view showing another embodiment of the container. FIG. 11 shows another embodiment of the attack countermeasure container according to the present invention. FIG. 12 is a plan view showing another embodiment of the attack counter container according to the present invention. FIG. 13 is a perspective view showing another embodiment of the attack counter container according to the present invention. FIG. 15 is a perspective view showing another embodiment of the attack counter container according to the present invention. FIG. 15 is a plan view showing another embodiment of the attack counter container according to the present invention. FIG. 16 is another view of the attack counter container according to the present invention. FIG. 17 is a plan view showing another embodiment of the attack countermeasure container according to the present invention. FIG. 18 is a perspective view showing another embodiment of the attack countermeasure container according to the present invention. FIG. 19 is a perspective view showing another embodiment of the attack counter container according to the present invention, and FIG. 20 is a block diagram showing one embodiment of the attack counter container according to the present invention. DESCRIPTION OF SYMBOLS 1 ... Counter attack container 2 ... Substrate 3 ... Substrate 4 ... Memory element 5 ... Opening 6 ... First layer 7 ... Second layer 8 ... Transistor 10 ... Address generation circuit 11 ... Readout result Judgment circuit 12… Secret erasure circuit 13… Power supply 14… Security preservation circuit 15… Input terminal 16… Output terminal 17… Write circuit 18… Read circuit 19… Resistance

Continuation of the front page (56) References JP-A-63-78250 (JP, A) David Chaum “Design Concepts for Tamper Responding Systems”, Proceeding of Crypto '83 (USA) Plenum Press, 1984 . 387-392 "Research Report on Microcomputers [II]", Japan Electronics Industry Development Association, June 1994, p. 101-136

Claims (5)

(57) [Claims] 1. An attack countermeasure container characterized by arranging logic elements on the outer peripheral surface of a container containing secret information therein, and detecting an external attack when the logic element loses normal operation. 2. The attack countermeasure container according to claim 1, wherein said logic element constitutes a memory element. 3. The attack countering container according to claim 1, wherein said logic element is provided on the entire outer peripheral surface of said container. 4. The attack-resistant container according to claim 1, wherein said logic element is provided on a part of an outer peripheral surface of said container. 5. The attack-resistant container according to claim 1, wherein said logic element is provided in a plurality of layers on an outer peripheral surface of said container.