JP7290846B2 - semiconductor equipment - Google Patents

Description

The present invention relates to semiconductor devices containing integrated electronic circuits.

Various semiconductor devices containing integrated electronic circuits are currently used to process signals.

Certain types of signal processing (eg, encryption and decryption thereof) may require confidentiality and/or authenticity of the processed signal. In this case, it is required that a signal containing confidential information is not transmitted to a signal line directly accessible from the outside. In addition, circuits that process signals containing confidential information are required not to leak the contents of the signals in the form of unwanted radio waves or power supply noise.

For example, U.S. Pat. No. 6,200,000 discloses enclosing a semiconductor device, such as an electronic device, mounted on a printed circuit board with a shield.

Japanese Patent Publication No. 2016-522471

In the case of using a shield such as that of Patent Document 1, if the shield is removed by an attacker, it becomes possible to directly access the signal line that transmits the signal including confidential information from the outside, or the content of the signal is not required. It leaks in the form of noise, etc. This may compromise the confidentiality and/or authenticity of the signal being processed. Also, with respect to a single semiconductor device, cutting the package may impair the secrecy and/or the authenticity of signals processed inside.

SUMMARY OF THE INVENTION An object of the present invention is to solve the above problems and to provide a novel semiconductor device in which confidentiality and/or authenticity of internally processed signals are less likely to be compromised than in the prior art.

According to the semiconductor device according to the first aspect of the present invention,
A semiconductor device comprising at least one circuit board having first and second surfaces parallel to each other,
The circuit board is
an electronic circuit including a plurality of circuit elements;
at least one well for the plurality of circuit elements, the well being formed on the second surface side of the circuit board when viewed from the electronic circuit;
at least one well connection line connected to the well on the side of the second surface of the circuit board viewed from the well;
at least one protection circuit connected to the well via the well connection line and detecting or setting the voltage of the well ;
the circuit board comprises first and second well connection lines respectively connected to different first and second positions in one well;
The protection circuit is
a first detection circuit for detecting variations in the voltage of the well at the first position;
and a voltage generation circuit for generating a bias voltage to apply to the well at the second position that at least partially cancels the detected variations in the voltage of the well.

According to the semiconductor device according to the second aspect of the present invention, in the semiconductor device according to the first aspect,
A region where the well connection line is connected to the well faces at least two of the plurality of circuit elements.

According to the semiconductor device according to the third aspect of the present invention, in the semiconductor device according to the first or second aspect,
The protection circuit is part of the electronic circuit.

According to a semiconductor device according to a fourth aspect of the present invention, in the semiconductor device according to one of the first to third aspects,
the circuit board further comprising at least one wiring conductor formed on a second surface of the circuit board and including a plurality of strip conductors;
The protection circuit includes a second detection circuit that detects disconnection of the wiring conductor.

According to the semiconductor device according to the fifth aspect of the present invention, in the semiconductor device according to the first or second aspect,
The semiconductor device comprises first and second circuit boards stacked together,
the electronic circuit and the well are formed on the first circuit board, and the protection circuit is formed on the second circuit board;
The well connection line is formed from the well on the first circuit board to the protection circuit on the second circuit board.

According to the semiconductor device according to the sixth aspect of the present invention, in the semiconductor device according to the fifth aspect,
the first circuit board further comprising at least one wiring conductor formed on a second surface of the first circuit board and including a plurality of strip conductors;
The protection circuit includes a second detection circuit that detects disconnection of the wiring conductor.

According to the semiconductor device according to the seventh aspect of the present invention,
A semiconductor device comprising at least one circuit board having first and second surfaces parallel to each other,
The circuit board is
an electronic circuit formed on the first surface of the circuit board;
at least one wiring conductor formed on the second surface of the circuit board and including a plurality of strip conductors;
A protection circuit that detects disconnection of the wiring conductor ,
The wiring conductor is embedded in a surface of the circuit board that is in contact with a predetermined package substrate.

According to the semiconductor device according to the eighth aspect of the present invention, in the semiconductor device according to the seventh aspect,
The wiring conductor is formed in a meander shape, a stripe shape, or a mesh shape.

According to the semiconductor device according to the ninth aspect of the present invention,
a first circuit board on which multilayer wiring and an electronic circuit are formed;
a second circuit board having wiring conductors including a plurality of strip conductors ;
and
A protection circuit provided in the electronic circuit detects disconnection of the wiring conductor,
electrically connecting the multilayer wiring and the wiring conductor through predetermined via conductors provided on the first circuit board and/or the second circuit board;
The wiring conductor is
A first via conductor formed on the first circuit board and a second via conductor formed on the second circuit board are formed on a surface of the second circuit board in contact with a predetermined package board. The multilayer wiring and the wiring conductor are electrically connected to each other via the multi-layer wiring.

According to the semiconductor device of one embodiment of the present invention, confidentiality and/or authenticity of a signal processed inside can be less likely to be compromised than in the prior art.

1 is a perspective view showing the configuration of a semiconductor device according to a first embodiment; FIG. FIG. 2 is a cross-sectional view taken along line AA of FIG. 1; It is a figure which shows the lower surface of the circuit board 1 of FIG. It is a figure which shows the lower surface of 1 A of circuit boards based on the modification of 1st Embodiment. 1 is a circuit diagram showing the configuration of a protection circuit for a semiconductor device according to a first embodiment; FIG. 6 is a timing chart showing the operation of the protection circuit in FIG. 5, which is normal operation and operation when the semiconductor device is attacked; FIG. 5 is a cross-sectional view showing the configuration of a semiconductor device according to a second embodiment; It is a figure which shows the lower surface of the circuit board 1B of FIG. 8 is a cross-sectional view showing a detailed configuration of a portion where wells 16 and electrodes 17 of FIG. 7 are connected to each other; FIG. FIG. 11 is a cross-sectional view showing the detailed configuration of a portion where wells 16 and electrodes 17 are connected to each other according to a first modification of the second embodiment; 8 is a schematic diagram illustrating a method of testing well connection lines for well 16 of FIG. 7; FIG. FIG. 5 is a block diagram showing the configuration of a first protection circuit of a semiconductor device according to a second embodiment; 13 is a timing chart showing the operation of the protection circuit of FIG. 12; FIG. 10 is a block diagram showing the configuration of a second protection circuit for a semiconductor device according to a second embodiment; 15 is a timing chart showing the operation of the protection circuit of FIG. 14; FIG. 10 is a diagram showing the configuration of a third protection circuit of the semiconductor device according to the second embodiment; FIG. 11 is a cross-sectional view showing the configuration of a semiconductor device according to a second modification of the second embodiment; FIG. 11 is a block diagram showing the configuration of a fourth protection circuit of the semiconductor device according to the second embodiment; 19 is a timing chart showing the operation of the protection circuit of FIG. 18; It is a cross-sectional view showing the configuration of a semiconductor device according to a third embodiment. 21 is a diagram showing the bottom surface of the circuit board 1D of FIG. 20; FIG. It is a figure which shows the upper surface of circuit board 1D of FIG. It is a sectional view showing composition of a semiconductor device concerning a modification of a 3rd embodiment. FIG. 11 is a cross-sectional view showing the configuration of a semiconductor device according to a fourth embodiment; It is a sectional view showing the composition of the semiconductor device concerning a 5th embodiment. It is a sectional view showing the composition of the semiconductor device concerning a 6th embodiment. It is a sectional view showing the composition of the semiconductor device concerning a 7th embodiment.

A semiconductor device according to each embodiment of the present invention will be described below with reference to the drawings. In each figure, the same reference numerals denote similar components.

First embodiment.
A semiconductor device is generally provided in a state of being sealed as a package with resin, ceramic, or the like, or in a state of being sealed on a printed wiring board. For example, an attack that exposes the electronic circuits integrated in the semiconductor device by cutting the resin on the surface of the package or making a hole in the printed wiring board from the back side (hereinafter referred to as "cutting attack"). may be attempted. If the electronic circuit operates in an exposed state, the confidentiality and/or authenticity of signals processed inside the semiconductor device may be compromised.

In order to protect the signal processed inside the semiconductor device against the cutting attack, it is conceivable to stop the operation of the electronic circuit, for example, when the semiconductor device receives the cutting attack. In order to realize this operation, it is required to reliably detect that the semiconductor device has received a cutting attack.

A first embodiment provides a semiconductor device capable of detecting a cutting attack.

FIG. 1 is a perspective view showing the configuration of the semiconductor device according to the first embodiment. The semiconductor device of FIG. 1 includes a circuit board 1, a package board 2, pad conductors 3, and bonding wires 4. The semiconductor device shown in FIG.

The circuit board 1 has a +Z side surface (also referred to as “upper surface” or “first surface”) and a −Z side surface (“lower surface” or “second surface”) parallel to each other along the XY plane in FIG. ”). The circuit board 1 includes a semiconductor substrate and a plurality of wiring layers formed parallel to the XY plane on the semiconductor substrate. For example, the semiconductor substrate is made of silicon and the wiring layer is made of copper. An electronic circuit 15 is formed on the circuit board 1 . Electronic circuit 15 includes a protection circuit for detecting a cutting attack on the semiconductor device, as will be described later. A plurality of pad conductors 12ac are formed on the upper surface of the circuit board 1 for supplying power to the electronic circuit 15 and inputting/outputting signals.

The circuit board 1 is fixed on its lower surface to the package board 2 by, for example, adhesion. The package substrate 2 is a part of a package such as resin or ceramic that seals the semiconductor device.

Each pad conductor 12ac is electrically connected to a pad conductor 3 formed on the package substrate 2 by a bonding wire 4, respectively. Each pad conductor 3 is electrically connected to a lead conductor for receiving power from the outside of the package after sealing the entire semiconductor device and for inputting and outputting signals. Alternatively, each pad conductor 12ac may be directly connected to lead conductors formed on the package substrate 2 by bonding wires 4 . Further alternatively, each pad conductor 12ac may be electrically connected to each pad conductor 3 using flip-chip mounting instead of bonding wires 4 . In this case, the surface of the circuit board 1 on which the pad conductors 12ac are formed faces the package substrate 2, and the pad conductors 3 are formed at positions facing the pad conductors 12ac. are electrically connected to the respective pad conductors 3 through the terminals.

FIG. 2 is a cross-sectional view taken along line AA of FIG.

As shown in FIG. 2 , the circuit board 1 includes a semiconductor substrate 11 , multilayer wiring 12 , wiring conductors 13 a , a plurality of via conductors 14 and an electronic circuit 15 . A semiconductor substrate 11 has multilayer wiring 12 including a plurality of wiring layers 12a and a plurality of dielectric layers 12b on its upper surface, and wiring conductors 13a on its lower surface. In the example of FIG. 2, the multilayer wiring 12 includes six wiring layers 12a. Each wiring layer 12a includes wiring conductors 12aa and insulating dielectrics 12ab patterned by any semiconductor process technology. As a result, the electronic circuit 15 is formed on the multilayer wiring 12 . The electronic circuit 15 includes a plurality of circuit elements 15a such as transistors, diodes, capacitors, resistors and inductors. The electronic circuit 15 may be formed by CMOS process technology or other process technology. A part of the uppermost wiring layer 12a is formed as a pad conductor 12ac. The wiring conductor 13 a is formed on the lower surface of the semiconductor substrate 11 as another wiring layer of the circuit board 1 . Each via conductor 14 is formed through the semiconductor substrate 11 in the Z direction (thickness direction). At least one via conductor 14 is electrically connected to the multilayer wiring 12 . At least one via conductor 14 is electrically connected to wiring conductor 13a.

The package board 2 may further include a wiring layer at a position facing the circuit board 1 . The wiring layer of the package substrate 2 may be electrically connected to the wiring conductors 13a of the circuit board 1 or other portions (for example, part of the electronic circuit 15).

FIG. 3 is a diagram showing the bottom surface of the circuit board 1 of FIG. The wiring conductor 13a includes, for example, a plurality of linear strip conductors connected to each other, and is formed in a meandering shape from the node N1 to the node N2 so as to substantially cover the entire lower surface of the circuit board 1. FIG. Nodes N1 and N2 are connected to a protection circuit in electronic circuit 15 through via conductor 14 in FIG. In the meandering wiring conductor 13a, when at least one strip conductor breaks, the whole wiring conductor 13a also breaks. The semiconductor device can detect a cutting attack by detecting disconnection of the wiring conductor 13a by a protection circuit in the electronic circuit 15. FIG.

FIG. 4 is a diagram showing the bottom surface of a circuit board 1A according to a modification of the first embodiment. The circuit board 1A includes two wiring conductors 13aA instead of the one wiring conductor 13a shown in FIG. One wiring conductor 13aA is formed in a meandering shape from node N11 to node N12 so as to substantially cover half of the lower surface of circuit board 1. FIG. The other wiring conductor 13aA is formed in a meandering shape from node N13 to node N14 so as to substantially cover the other half of the lower surface of circuit board 1. FIG. Nodes N11 to N14 are connected to a protection circuit in electronic circuit 15 via via conductors 14 in FIG. By detecting disconnection of each wiring conductor 13aA by a protection circuit in the electronic circuit 15, the semiconductor device can detect a cutting attack with higher spatial resolution than in the case of FIG.

The circuit board may comprise three or more wiring conductors each formed to cover a predetermined portion of the bottom surface of the circuit board. This allows the semiconductor device to detect the cutting attack with a desired spatial resolution.

The wiring conductor on the lower surface of the circuit board may be formed as a region of any shape other than the meandering shape as long as it can substantially cover the entire lower surface of the circuit board. The wiring conductor does not include a section in which a plurality of strip conductors are connected in parallel, and is formed in such a shape that the nodes at both ends thereof are easily electrically disconnected due to damage to a very small portion of the section. The wiring conductor may be formed, for example, as a stripe-shaped or mesh-shaped region including a plurality of linear strip conductors arranged at predetermined intervals without being connected to each other. The spacing of the strip conductors conforms to the wiring layer design standard in the semiconductor process technology for forming the electronic circuit 15 . Nodes at both ends of each strip conductor are connected to the protection circuit in the electronic circuit 15 via the via conductors 14 of FIG. The semiconductor device can detect a cutting attack by detecting disconnection of each strip conductor by a protection circuit in the electronic circuit 15 .

FIG. 5 is a circuit diagram showing the configuration of the protection circuit for the semiconductor device according to the first embodiment. The protection circuit has switching elements 21 to 23 and a latch circuit 24 . The protection circuit is provided inside the electronic circuit 15 and is connected to the nodes N1 and N2 of FIG. 3 via the via conductors 14 (not shown in FIG. 5) of FIG. A reset signal and a constant voltage are applied to the protection circuit from other parts of the electronic circuit 15 to generate a detection signal.

FIG. 6 is a timing chart showing the operation of the protection circuit in FIG. 5, which is normal operation and operation when the semiconductor device is attacked. Normally, the voltage at node N1 is equal to the voltage at node N2 (ground voltage or other reference voltage) and the detection signal remains low. On the other hand, when the semiconductor device is subjected to a cutting attack and the wiring conductor 13a is disconnected, the voltage of the node N1 increases, and accordingly the detection signal transitions from low level to high level.

The electronic circuit 15 may, for example, stop its operation when the detection signal transitions from a low level to a high level. As a result, signals processed inside the semiconductor device can be protected from attackers.

As described above, the semiconductor device according to the first embodiment is provided with the wiring conductor 13a and the protective circuit in the electronic circuit 15, and thus can detect a cutting attack. When the semiconductor device according to the first embodiment detects that it has received a cutting attack, for example, by stopping the operation of the electronic circuit, the confidentiality and/or authenticity of the signal processed inside the semiconductor device can be improved. can be made less likely to be damaged compared to the conventional technology.

In addition, in the semiconductor device according to the first embodiment, the wiring conductor 13a is integrated with the circuit board 1 instead of the package of the semiconductor device. It is difficult to directly access the signal line to be transmitted from the outside. The wiring conductor 13a may be formed to have a sufficient thickness, for example, a thickness of 10 to 100 μm, so as not to be easily scraped off when attacked by cutting or the like.

In addition, in the semiconductor device according to the first embodiment, since the wiring conductor 13a is connected to the ground voltage or another reference voltage, when the electronic circuit 15 processes a signal containing confidential information, the wiring conductor 13a is connected to the lower side of the semiconductor device. , unnecessary radio waves or power supply noise, etc., to prevent the content of the signal from being leaked.

Further, in the semiconductor device according to the first embodiment, wiring conductors 13a, via conductors 14, and the like can be added to the circuit board using normal semiconductor process technology.

Further, in the semiconductor device according to the first embodiment, additional wiring conductors may be formed above the electronic circuit 15 . Moreover, in the semiconductor device according to the first embodiment, the electronic circuit 15 may be formed in an intermediate layer instead of the upper layer of the semiconductor substrate 11 .

Second embodiment.
A non-destructive analysis of the operation of a semiconductor device by irradiating it with a laser, electromagnetic pulse, electron beam, etc., and observing the response of the semiconductor device through the output terminal of the semiconductor device or a magnetic field probe. It has been known. An attack (hereinafter referred to as a "disturbance injection attack") may be attempted to read a signal by performing such non-destructive access to a semiconductor device that processes a signal that requires confidentiality and/or authenticity.

The second embodiment provides a semiconductor device capable of protecting signals processed inside the semiconductor device against disturbance injection attacks.

FIG. 7 is a cross-sectional view showing the configuration of the semiconductor device according to the second embodiment. The circuit board 1B includes a semiconductor substrate 11, a multilayer wiring 12, one or more wiring conductors 13b, a plurality of via conductors 14, an electronic circuit 15, one or more wells 16, and one or more electrodes 17. .

The semiconductor substrate 11, multilayer wiring 12, via conductors 14, and electronic circuit 15 in FIG. 7 are configured in the same manner as the corresponding components in FIG. Electronic circuitry 15 includes one or more protection circuits for protecting signals processing within the semiconductor device against disturbance injection attacks, as described below.

Each wiring conductor 13b is formed on the lower surface of the semiconductor substrate 11 as one wiring layer of the circuit board 1B. Each wiring conductor 13b is electrically connected to a via conductor 14, respectively.

Each well 16 is formed under the electronic circuit 15 for a plurality of circuit elements 15 a of the electronic circuit 15 .

Each electrode 17 is formed in a contact hole for each well 16 provided from the bottom surface of the semiconductor substrate 11 to the bottom surface of each well 16 . For example, each electrode 17 is made of copper. Each electrode 17 is ohmically connected to the well 16 . A region (well contact) where each electrode 17 is connected to the well 16 is hereinafter referred to as "node N21". Each electrode 17 is formed such that the region connected to the well 16 faces one or more circuit elements 15a (eg, at least two circuit elements 15a). Each electrode 17 is electrically connected to the wiring conductor 13b.

Electrodes 17 , wiring conductors 13 b , and via conductors 14 are connected to each other to form well connection lines for wells 16 . One end of the well connection line is connected to the bottom surface of the well 16 and the other end is connected to a protection circuit within the electronic circuit 15 .

FIG. 8 is a diagram showing the bottom surface of the circuit board 1B of FIG. The examples of FIGS. 7 and 8 show the case where the semiconductor device has four well connection lines (including electrodes 17, wiring conductors 13b, and via conductors 14, respectively).

In the semiconductor device of FIG. 7, in order to protect the signal processed inside the semiconductor device against the disturbance injection attack, it is conceivable to stop the operation of the electronic circuit 15, for example, when the semiconductor device receives the disturbance injection attack. be done. In order to realize this operation, it is required to reliably detect that the semiconductor device has been subjected to a disturbance injection attack. When the semiconductor device is subjected to a disturbance injection attack, the voltage of well 16 fluctuates. Thus, protection circuitry within electronic circuit 15 is connected to well 16 via a well connection line and senses the voltage on well 16 .

Alternatively, in order to protect the signal processed inside the semiconductor device against the disturbance injection attack, it is conceivable to suppress observable responses of the semiconductor device when the semiconductor device is subjected to the disturbance injection attack. Accordingly, protection circuitry within electronic circuit 15 may be connected to well 16 via a well connection line to set the voltage of well 16 .

FIG. 9 is a cross-sectional view showing the detailed configuration of the portion where the well 16 and the electrode 17 in FIG. 7 are connected to each other. Wells 16 of FIG. 7 include shallow wells 16a-16c (n-well and p-well) for individual circuit elements 15a and a deep well 16d (n-well) covering the entire circuit, as shown in FIG. It's okay. Electrode 17 is connected to deep well 16d.

FIG. 10 is a cross-sectional view showing a detailed configuration of a portion where wells 16 and electrodes 17 are connected to each other according to the first modification of the second embodiment. As shown in FIG. 9, the well 16 in FIG. 7 includes shallow wells 16a to 16c (n-well and p-well) for individual circuit elements 15a, a pocket 16e covering the entire circuit, and a buried impurity layer 16f (n+ layer) and deep trenches 16g that separate the circuit elements 15a from each other. The electrode 17 is connected to the embedded impurity layer 16f.

FIG. 11 is a schematic diagram illustrating a method of testing well connection lines for well 16 of FIG. With reference to FIG. 11, the operation of the semiconductor device according to the conventional technique and the operation of the semiconductor device according to the second embodiment of the present disclosure will be explained in comparison.

FIG. 11 shows only the shallow wells 16a to 16c, the deep well 16d, the electrode 17, the wiring conductor 13b, and the via conductor 14 of FIG. 9, and omits other components of the semiconductor device (semiconductor substrate 11, etc.). . In FIG. 11, a node N20 is a terminal (well contact) for applying power supply voltage VDD to the n-well in the semiconductor device according to the prior art, and is connected to the upper side of the deep well 16d (that is, the same side as the electronic circuit 15). be provided. Also, in FIG. 11, nodes N21 and N22 indicate both ends of the well connection line in the semiconductor device according to the second embodiment of the present disclosure. The well connection line is connected to the lower side of deep well 16d (ie, the side opposite electronic circuit 15) at node N21, and to the protection circuit within electronic circuit 15 at node N22.

In a mode of operation according to the second embodiment of the present disclosure, protection circuitry within electronic circuit 15 senses or sets the voltage of well 16 via node N22, the well connection line, and node N21. On the other hand, as an operation mode of a comparative example assuming a semiconductor device according to the prior art, let us consider the case of detecting or setting the voltage of the well 16 via the node N20. In the configuration of FIG. 11, a switch SW switches between these two operation modes.

Next, operation of the semiconductor device according to the second embodiment of the present disclosure will be described with reference to FIGS. 12 to 16. FIG.

FIG. 12 is a block diagram showing the configuration of the first protection circuit of the semiconductor device according to the second embodiment. FIG. 12 illustrates the case where the protection circuitry within electronic circuit 15 includes a detection circuit that detects variations in the voltage of well 16 . Reference numeral 31 indicates well connection lines (including electrodes 17, wiring conductors 13b, and via conductors 14). The protection circuit comprises an operational amplifier 32 , a digital-to-analog converter (DAC) 33 and a comparator 34 . Operational amplifier 32 is connected to well 16 via well connection line 31 and receives voltage V(N22) at node N22. Therefore, the output voltage of operational amplifier 32 changes according to the voltage of well 16, that is, the voltage V(N21) of node N21. The DAC 33 generates a threshold voltage Vth according to the input code value. It is assumed that the variation in the voltage of the well 16 that occurs when the semiconductor device is subjected to a disturbance injection attack is greater than that caused by normal noise or the like. is set. Comparator 34 compares the output voltage of operational amplifier 32 with threshold voltage Vth and outputs a detection signal indicating the result.

13 is a timing chart showing the operation of the protection circuit of FIG. 12. FIG. When the voltage V(N22) of the node N22 exceeds the threshold voltage Vth due to the semiconductor device being subjected to a disturbance injection attack, the detection signal transitions from low level to high level. Therefore, when the semiconductor device is subjected to a disturbance injection attack, for example, by stopping the operation of the electronic circuit 15, the signals processed inside the semiconductor device can be protected against the disturbance injection attack.

FIG. 14 is a block diagram showing the configuration of the second protection circuit of the semiconductor device according to the second embodiment. FIG. 14 illustrates the case where the protection circuitry within electronic circuit 15 includes a voltage generation circuit that generates and applies a bias voltage to well 16 . The protection circuit comprises a digital/analog converter (DAC) 41 and an operational amplifier 42 . The DAC 41 generates a bias voltage according to the input code value and outputs it via the operational amplifier 42 . When the well 16 is an n-well as described above, the DAC 41 and operational amplifier 42 generate and output the power supply voltage VDD. Reference numeral 43 denotes a well connection line (including electrodes 17, wiring conductors 13b, and via conductors 14). A bias voltage output from operational amplifier 42 , ie, voltage V(N22) at node N22 is applied to node N21 of well 16 via well connection line 43 .

15 is a timing chart showing the operation of the protection circuit of FIG. 14. FIG. The upper part of FIG. 15 (comparative example) shows fluctuations in the voltage of the well 16 that occur when the semiconductor device is subjected to a disturbance injection attack when no bias voltage is applied to the well 16 via the well connection line 43 . On the other hand, the lower part of FIG. 15 (embodiment) shows fluctuations in the voltage of well 16 suppressed by applying a bias voltage to well 16 via well connection line 43 . According to the lower part of FIG. 15, the voltage of the well 16 is more difficult to fluctuate than in the upper part. Therefore, when a semiconductor device is subjected to a disturbance injection attack, it is possible to protect the signal processed inside the semiconductor device against the disturbance injection attack by suppressing the observable response of the semiconductor device.

FIG. 16 is a diagram showing the configuration of the third protection circuit of the semiconductor device according to the second embodiment. The bias voltage applied to well 16 may be generated by other means than the circuit of FIG. The well 16 may be connected to a predetermined voltage node in the electronic circuit 15 , such as a power supply voltage VDD or VSS node, a ground voltage node, or the like, via a well connection line 43 .

As described above, the semiconductor device according to the second embodiment includes the wiring conductors 13b, the via conductors 14, the electrodes 17, and the protection circuit in the electronic circuit 15, thereby detecting or setting the voltage of the well 16. and protect signals processed inside the semiconductor device against disturbance injection attacks. As a result, confidentiality and/or authenticity of signals processed inside the semiconductor device can be less likely to be compromised than in the prior art.

According to the semiconductor device of FIG. 7, by connecting the well connection line to the bottom side of the well 16, ie to the side opposite to the electronic circuit 15, an electrode 17 having a large cross-sectional area is formed, thus each electrode The area of the region (well contact) where 17 is connected to well 16 can be increased. By increasing the area of the well contact so as to face many circuit elements 15a, it is possible to detect or set the voltage of the well 16 near these circuit elements 15a through one well connection line. For example, in an electronic circuit 15, the voltage of a well 16 in the vicinity of a group of logic circuits (e.g., cryptographic circuits and their associated registers and latches, etc.) having a size of several microns may be applied to a well 16 having a diameter of the order of 5-20 microns. can be detected or set by one electrode 17; It should be noted that providing such a large-area well contact on the same side as the electronic circuit 15 is difficult to allow due to cost in terms of area.

Moreover, according to the semiconductor device according to the second embodiment, by increasing the area of the well contact, the electronic circuit 15 and the well 16 can be connected with low impedance through the well connection line.

Further, according to the semiconductor device according to the second embodiment, by using a plurality of well connection lines connected to a plurality of different positions of the well 16, the voltage of the well 16 can be detected or set with a desired spatial resolution. be able to. By connecting the well connection line to the well 16 from the side opposite to the electronic circuit 15, a voltage distribution that cannot be observed from the same side as the electronic circuit 15 can be detected with high spatial resolution and voltage resolution.

Moreover, according to the semiconductor device according to the second embodiment, due to the complexity of the structure of the well connection lines, it is effective in improving the resistance to reverse engineering.

Further, in the semiconductor device according to the second embodiment, wiring conductors 13b, via conductors 14, electrodes 17, and the like can be added to the circuit board using normal semiconductor process technology.

With reference to FIG. 11, consider an operation mode of a comparative example assuming a conventional semiconductor device. When sensing the well 16 voltage via node N20, only the voltage near the small well contact can be sensed. Similarly, when setting the voltage of the well 16 via the node N20, only a small voltage near the well contact can be set. Thus, if the voltage of well 16 is sensed or set via node N20 on the same side as electronic circuit 15, the ability to protect signals processed inside the semiconductor device against disturbance injection attacks is It is more limited than the semiconductor device according to the second embodiment of the present disclosure.

In addition, when a normal functional test of the electronic circuit 15 is performed in order to select non-defective and defective semiconductor devices, the power supply voltage VDD may be set to the well 16 via the node N20. In particular, when testing the electronic circuit 15 after forming the electronic circuit 15 on the semiconductor substrate 11 and before forming the wiring conductor 13b, the via conductor 14, and the electrode 17, the power supply voltage VDD is applied to the well 16 through the node N20. May be set.

Next, a semiconductor device according to a second modification of the second embodiment will be described with reference to FIGS. 17 to 19. FIG.

FIG. 17 is a cross-sectional view showing the configuration of a semiconductor device according to a second modification of the second embodiment. The circuit board 1C includes a semiconductor substrate 11, a multilayer wiring 12, wiring conductors 13b-1 and 13b-2, via conductors 14-1 and 14-2, an electronic circuit 15, a well 16C, and electrodes 17-1 and 17-2. Prepare. These components of the circuit board 1C are constructed similarly to the corresponding components of FIG. However, the electrodes 17-1 and 17-2 are respectively connected to different first and second positions in one well 16C. Regions (well contacts) where the electrodes 17-1 and 17-2 are connected to the well 16C are hereinafter referred to as "node N31" and "node N32", respectively. The electrode 17-1, the wiring conductor 13b-1, and the via conductor 14-1 are connected together to form a first well connection line for the well 16C. The electrode 17-2, the wiring conductor 13b-2, and the via conductor 14-2 are connected together to form a second well connection line for the well 16C.

FIG. 18 is a block diagram showing the configuration of the fourth protection circuit of the semiconductor device according to the second embodiment. FIG. 18 illustrates that protection circuitry within electronic circuit 15 of FIG. 17 provides a detection circuit that detects well 16C voltage variations at node N31 and a bias voltage that at least partially cancels the detected well 16C voltage variations. and a voltage generating circuit to generate and apply to well 16C at node N32. Reference numeral 51 denotes a well connection line including the electrode 17-1, the wiring conductor 13b-1 and the via conductor 14-1, and reference numeral 52 denotes the electrode 17-2, the wiring conductor 13b-2 and the via conductor 14-2. shows a well connection line containing Well connection line 51 is connected to the lower side of well 16C at node N31 and to a protection circuit within electronic circuit 15 at node N33. Also, the well connection line 55 is connected to the lower side of the well 16C at a node N32 and to a protection circuit within the electronic circuit 15 at a node N34. The protection circuit comprises operational amplifiers 52 , 54 and an inverting gain 53 . Operational amplifier 52 is connected to well 16C through well connection line 51 and receives voltage V(N33) at node N33. Therefore, the output voltage of operational amplifier 52 changes according to the voltage of well 16C, that is, voltage V(N31) of node N31. Inverting gain 53 generates a voltage having the opposite polarity of the output voltage of operational amplifier 52 and outputs it through operational amplifier 42 so as to at least partially cancel the variations in the sensed voltage of well 16C. A bias voltage output from operational amplifier 54, that is, voltage V(N34) at node N34 is applied via well connection line 55 to node N32 of well 16C.

Well 16C also has an internal resistor 56 between nodes N31 and N32.

19 is a timing chart showing the operation of the protection circuit of FIG. 18. FIG. When the voltage V(N31) at node N31 fluctuates due to a disturbance injection attack on the semiconductor device (see the upper part of FIG. 19), the fluctuation in the voltage of well 16C is at least partially offset at node N34. A canceling voltage V(N34) is generated (see middle of FIG. 19). By applying voltage V(N34) to node N32 of well 16C via well connection line 55, variations in the voltage of well 16C are at least partially canceled, and variations in voltage V(N32) of node N32 are , is smaller than the fluctuation of the voltage V(N31) at the node N31 (see the lower part of FIG. 19). In this way, the semiconductor device of FIG. 17 can protect the signal processed inside the semiconductor device against the disturbance injection attack by suppressing the observable response of the semiconductor device when subjected to the disturbance injection attack. can be done.

Third embodiment.
The third embodiment describes a combination of the first and second embodiments.

FIG. 20 is a cross-sectional view showing the configuration of the semiconductor device according to the third embodiment. The circuit board 1D includes a semiconductor substrate 11, a multilayer wiring 12, one or more wiring conductors 13a, one or more wiring conductors 13b, a plurality of via conductors 14, an electronic circuit 15, one or more wells 16, and One or more electrodes 17 are provided. The semiconductor substrate 11, multilayer wiring 12, via conductors 14, and electronic circuit 15 in FIG. 7 are configured in the same manner as the corresponding components in FIGS. The wiring conductors 13a in FIG. 7 are constructed similarly to the corresponding components in FIG. Wells 16 and electrodes 17 are constructed similarly to the corresponding components of FIG. As in the first embodiment, the electronic circuit 15 includes a protection circuit for detecting a cutting attack on the semiconductor device, and a processing circuit inside the semiconductor device against a disturbance injection attack as in the second embodiment. and a protection circuit for protecting signals that

FIG. 21 is a diagram showing the bottom surface of the circuit board 1D of FIG. The circuit board 1D includes two wiring conductors 13aB and four wiring conductors 13b. One wiring conductor 13 aB is formed in a meandering shape so as to substantially cover half of the lower surface of the circuit board 1 . The other wiring conductor 13 aB is formed in a meandering shape so as to substantially cover the other half of the lower surface of the circuit board 1 . The wiring conductor 13b in FIG. 21 is formed in the same manner as the wiring conductor 13b in FIG.

FIG. 22 is a diagram showing the top surface of the circuit board 1D of FIG. The electronic circuit 15 includes protection circuits 61-66. The protection circuits 61 and 62 are configured similarly to the protection circuits in the electronic circuit 15 according to the first embodiment (see FIG. 5, for example). The protection circuit 61 detects the cutting attack by detecting disconnection of the wiring conductor 13aB between the nodes N41 and N43. The protection circuit 62 detects the cutting attack by detecting disconnection of the wiring conductor 13aB between the nodes N46 and N48. The protection circuits 63 to 66 are configured similarly to the protection circuits in the electronic circuit 15 according to the second embodiment (eg, see FIG. 12, FIG. 14, FIG. 16, or FIG. 18). Protection circuits 63-66 are connected to the well connection lines at nodes N42, N45, N65 and N44, respectively, and detect or set the voltage of well 16 via each well connection line.

The semiconductor device according to the third embodiment includes the wiring conductor 13a and the protection circuit in the electronic circuit 15 for detecting the cutting attack, thereby preventing the semiconductor device from being attacked from below. Signals processed inside the semiconductor device can be protected. Further, the semiconductor device according to the third embodiment includes the wiring conductors 13b, the via conductors 14, the electrodes 17, and the protection circuit in the electronic circuit 15 for detecting or setting the voltage of the well 16. Signals processing inside the semiconductor device can be protected against disturbance injection attacks from the top and bottom of the device. Therefore, the semiconductor device according to the third embodiment is effective for both face-up mounting using bonding wires 4 and flip-chip mounting using bumps.

FIG. 23 is a cross-sectional view showing the configuration of a semiconductor device according to a modification of the third embodiment. FIG. 23 shows a case where the circuit board 1D of FIG. 20 is fixed to a package board by flip-chip mounting. The package board 2 has a wiring layer 6 at a position facing the circuit board 1D. The circuit board 1D and the package board 2 are stacked such that the multilayer wiring 12 of the circuit board 1D and the wiring layer 6 of the package board 2 face each other with a plurality of bumps 5 interposed therebetween. The multilayer wiring 12 of the circuit board 1</b>D is electrically connected to the wiring layer 6 of the package substrate 2 via a plurality of bumps 5 . According to the semiconductor device of the third embodiment, the circuit board 1D can be fixed to the package board 2 with a high degree of freedom.

Between the circuit board 1D and the package substrate 2, portions other than the bumps 5 are filled with an adhesive or other sealing material (underfill). Thereby, the circuit board 1D and the package board 2 are mechanically connected to each other. However, in FIG. 23, illustration of the adhesive or other sealing material is omitted.

Fourth embodiment.
The protection circuits of the semiconductor devices according to the first to third embodiments are not limited to being provided as part of the electronic circuit 15, and may be provided at other positions.

FIG. 24 is a cross-sectional view showing the configuration of the semiconductor device according to the fourth embodiment. The semiconductor device of FIG. 24 includes circuit boards 1E and 100 stacked together.

The circuit board 1E includes a semiconductor substrate 11, a multilayer wiring 12, one or more wiring conductors 13a, one or more wiring conductors 13b, a plurality of via conductors 14, an electronic circuit 15, one or more wells 16, and One or more electrodes 17 are provided. The semiconductor substrate 11, multilayer wiring 12, wiring conductors 13a and 13b, via conductors 14, electronic circuit 15, wells 16, and electrodes 17 in FIG. 24 are configured in the same manner as the corresponding components in FIG. However, the electronic circuit 15 does not include a protection circuit.

The circuit board 100 includes a semiconductor substrate 101 , one or more protection circuits 102 a and 102 b , multiple pad conductors 103 and multiple via conductors 104 . The semiconductor substrate 101, pad conductors 103, and via conductors 104 are configured in the same manner as the semiconductor substrate 11, pad conductors 12ac, and via conductors 14 of the circuit board 1 in FIG. The protection circuit 102a detects a cutting attack on the semiconductor device, as in the first embodiment. The protection circuit 102b protects signals processed inside the semiconductor device against disturbance injection attacks, as in the second embodiment.

The circuit boards 1E and 100 are stacked such that the bottom surface of the circuit board 1E and the top surface of the circuit board 100 face each other, and are electrically and mechanically connected to each other. The circuit boards 1E and 100 are stacked such that the bottom surface of the circuit board 1E and the top surface of the circuit board 100 face each other with a plurality of bumps 5 interposed therebetween. The wiring conductor 13a is electrically connected to the protection circuit 102a through the bump 5. As shown in FIG. The wiring conductor 13b is electrically connected to the protection circuit 102b via the bump 5. As shown in FIG.

Between the circuit boards 1E and 100, the portions other than the bumps 5 are filled with an adhesive or other sealing material (underfill). Thereby, the circuit boards 1E and 100 are mechanically connected to each other. However, in FIG. 24, illustration of the adhesive or other sealing material is omitted.

In the semiconductor device of FIG. 24, the electronic circuit 15 and the well 16 are formed on the circuit board 1E, and the protection circuit 102b is formed on the circuit board 100. As shown in FIG. A well connection line is formed from the well 16 and the wiring conductor 13b on the circuit board 1E to the protection circuit 102b on the circuit board 100. FIG.

In FIG. 24, the bottom surface of the circuit board 100 may be electrically connected to the wiring layer 6 of the package board 2 configured in the same manner as in FIG. Alternatively, the bottom surface of the circuit board 100 may be directly fixed to the package substrate 2 as in FIG.

According to the semiconductor device according to the fourth embodiment, by providing the protection circuits 102a and 102b on the circuit board 100 different from the circuit board 1E provided with the electronic circuit 15 for processing the signal to be protected, the first - The degree of freedom in the configuration of the semiconductor device can be improved as compared with the semiconductor device according to the third embodiment.

The fourth embodiment is applicable not only to the third embodiment but also to the first or second embodiment.

Fifth Embodiment In the first embodiment, as shown in FIG. 2, a semiconductor substrate 11 has multilayer wiring 12 including a plurality of wiring layers 12a and a plurality of dielectric layers 12b and electronic circuits 15 on its upper surface. , and the wiring conductor 13a on its lower surface, the present invention is not limited to this. Therefore, in the fifth embodiment, a case where one semiconductor substrate 11 shown in FIG. 2 has a two-layer structure will be described.

FIG. 25 is a cross-sectional view showing the configuration of the semiconductor device according to the fifth embodiment. The semiconductor device of FIG. 25 has a structure in which the circuit board 1F and the circuit board 1G are laminated and bonded together by an adhesive or the like. The circuit board 1F has a multilayer wiring 12 and an electronic circuit 15, and the circuit board 1G has wiring conductors 13a. The wiring conductor 13 a is formed on the surface that contacts the package substrate 2 . Note that the multilayer wiring 12, the electronic circuit 15 and the wiring conductor 13a are the same as those shown in FIG.

The via conductor 14a is formed to penetrate the semiconductor substrate 11a in the Z direction (thickness direction), and the via conductor 14b is formed to penetrate the semiconductor substrate 11b in the Z direction (thickness direction). 14a and via conductors 14b are connected to each other. Also, the via conductor 14a is electrically connected to the multilayer wiring 12, and the via conductor 14b is electrically connected to the wiring conductor 13a. The wiring conductor 13a is as shown in FIG. 3 or FIG.

Thus, the semiconductor device according to the fifth embodiment is formed as a two-layer structure in which the circuit board 1G having the wiring conductors 13a is bonded to the circuit board 1F having the multilayer wiring 12 and the electronic circuit 15. FIG. As a result, since the manufacturing processes for the circuit board 1F and the circuit board 1G can be separated, the semiconductor device can be manufactured easily and the manufacturing cost can be reduced. In particular, the circuit board 1G having the wiring conductors 13a can be manufactured without adversely affecting the multilayer wiring 12 and the electronic circuit 15. FIG.

Sixth Embodiment By the way, in the fifth embodiment, the wiring conductor 13a is formed on the surface in contact with the package substrate 2, but the present invention is not limited to this. Therefore, in the sixth embodiment, the wiring conductor 13a is provided on the surface side contacting the circuit board 1F.

FIG. 26 is a cross-sectional view showing the configuration of a semiconductor device according to the sixth embodiment. The semiconductor device shown in FIG. 26 has a configuration in which the circuit board 1F and the circuit board 1G are laminated and bonded together by, for example, an adhesive. The circuit board 1F has the multilayer wiring 2 and the electronic circuit 15, and the circuit board 1G has the wiring conductors 13a. Here, the wiring conductor 13a of the circuit board 1G is formed not on the surface in contact with the package substrate 2 but in the surface in contact with the circuit board 1F. This facilitates manufacture of the circuit board 1G having the wiring conductors 13a.

The via conductors 14a are formed to penetrate the semiconductor substrate 11a in the Z direction (thickness direction), one of which is electrically connected to the multilayer wiring 12, and the other of which is electrically connected to the wiring conductor 13a of the circuit board 1G. be done. The via conductors 14 b are formed to penetrate the semiconductor substrate 11 b in the Z direction (thickness direction).

Thus, the semiconductor device according to the sixth embodiment is formed as a two-layer structure in which the circuit board 1G having the wiring conductor 13a is bonded to the circuit board 1F having the multilayer wiring 2 and the electronic circuit 15, and the circuit The wiring conductor 13a of the substrate 1G is provided on the surface side in contact with the circuit substrate 1F. This facilitates the manufacture of the circuit board 1G, making it possible to reduce the manufacturing cost.

Sixth Embodiment By the way, in the fifth embodiment, the case where the wiring conductors 13a are formed on the surface in contact with the package substrate 2 is shown, and in the sixth embodiment, the wiring conductors 13a of the circuit board 1G Although the case where it is provided on the surface side in contact with 1F has been shown, the present invention is not limited to this. Therefore, in the seventh embodiment, the wiring conductor 13a is provided inside the circuit board 1G.

FIG. 27 is a cross-sectional view showing the configuration of a semiconductor device according to the seventh embodiment. The semiconductor device shown in FIG. 27 has a configuration in which the circuit board 1F and the circuit board 1G are laminated and bonded together by, for example, an adhesive. The circuit board 1F has the multilayer wiring 2 and the electronic circuit 15, and the circuit board 1G has the wiring conductors 13a. Here, the wiring conductor 13a of the circuit board 1G is formed inside the circuit board 1G.

The via conductors 14a are formed to penetrate the semiconductor substrate 11a in the Z direction (thickness direction), one of which is electrically connected to the multilayer wiring 12, and the other of which is electrically connected to the via conductor 14b of the circuit board 1G. be done. The via conductors 14b are formed in the Z direction (thickness direction) of the semiconductor substrate 11b, one of which is electrically connected to the via conductor 14a and the other of which is electrically connected to the wiring conductor 13a. The via conductors 14 c are formed in the Z direction (thickness direction) of the semiconductor substrate 11 b , one of which is electrically connected to the wiring conductor 13 a and the other of which is electrically connected to the package substrate 2 .

Thus, the semiconductor device according to the seventh embodiment is formed as a two-layer structure in which the circuit board 1G having the wiring conductor 13a is bonded to the circuit board 1F having the multilayer wiring 2 and the electronic circuit 15, and the circuit A wiring conductor 13a is provided inside the substrate 1G.

A semiconductor device according to each aspect of the present invention is effective as a countermeasure against a disturbance injection attack or a hardware trojan insertion attack when processing a signal that requires confidentiality and/or authenticity.

1, 1A to 1G, 100... circuit board,
2 ... package substrate,
3... Pad conductor,
4 bonding wire,
5 Bump,
6... Wiring layer,
11, 11a, 11b ... semiconductor substrates,
12... multilayer wiring,
12a... Wiring layer,
12aa... Wiring conductor,
12ab... insulating dielectric,
12b... dielectric layer,
12ac... pad conductor,
13a, 13aA, 13aB, 13b... wiring conductors,
14, 14a, 14b, 14c... via conductors,
15... electronic circuit,
15a ... circuit element,
16, 16C... wells,
16a-16c ... shallow wells,
16d... deep well,
16e... pocket,
16f... Buried impurity layer,
16g... trench,
17... electrode,
21 to 23 ... switching elements,
24... Latch circuit,
31 ... well connection line,
32 ... operational amplifier,
33 Digital/analog converter (DAC),
34 Comparator,
41 Digital/analog converter (DAC),
42 ... operational amplifier,
43 ... well connection line,
51, 55 ... well connection lines,
52, 54 ... operational amplifiers,
53... Inverting gain device,
56... Well internal resistance,
61 to 66 protection circuits,
101... Semiconductor substrate,
102a, 102b... protection circuits,
103... Pad conductor,
104... Via conductor,
N1 to N48... nodes,
SW... switch.

Claims (9)

A semiconductor device comprising at least one circuit board having first and second surfaces parallel to each other,
The circuit board is
an electronic circuit including a plurality of circuit elements;
at least one well for the plurality of circuit elements, the well being formed on the second surface side of the circuit board when viewed from the electronic circuit;
at least one well connection line connected to the well on the side of the second surface of the circuit board viewed from the well;
at least one protection circuit connected to the well via the well connection line and detecting or setting the voltage of the well;
the circuit board comprises first and second well connection lines respectively connected to different first and second positions in one well;
The protection circuit is
a first detection circuit for detecting variations in the voltage of the well at the first position;
a voltage generation circuit for generating a bias voltage to apply to the well at the second position that at least partially cancels detected variations in the voltage of the well;
semiconductor device. a region where the well connection line is connected to the well faces at least two of the plurality of circuit elements;
A semiconductor device according to claim 1 . the protection circuit is part of the electronic circuit;
3. The semiconductor device according to claim 1 or 2. the circuit board further comprising at least one wiring conductor formed on a second surface of the circuit board and including a plurality of strip conductors;
The protection circuit includes a second detection circuit that detects disconnection of the wiring conductor,
4. The semiconductor device according to claim 1. The semiconductor device comprises first and second circuit boards stacked together,
the electronic circuit and the well are formed on the first circuit board;
the protection circuit is formed on the second circuit board;
the well connection line is formed from the well in the first circuit board to the protection circuit in the second circuit board;
3. The semiconductor device according to claim 1 or 2. the first circuit board further comprising at least one wiring conductor formed on a second surface of the first circuit board and including a plurality of strip conductors;
The protection circuit includes a second detection circuit that detects disconnection of the wiring conductor,
6. The semiconductor device according to claim 5. A semiconductor device comprising at least one circuit board having first and second surfaces parallel to each other,
The circuit board is
an electronic circuit formed on the first surface of the circuit board;
at least one wiring conductor formed on the second surface of the circuit board and including a plurality of strip conductors;
A protection circuit that detects disconnection of the wiring conductor,
The wiring conductor is embedded in a surface of the circuit board that is in contact with a predetermined package substrate,
semiconductor device. The wiring conductor is formed in a meander shape, a stripe shape, or a mesh shape,
8. The semiconductor device according to claim 7. a first circuit board on which multilayer wiring and an electronic circuit are formed;
a second circuit board having wiring conductors including a plurality of strip conductors;
and
A protection circuit provided in the electronic circuit detects disconnection of the wiring conductor,
electrically connecting the multilayer wiring and the wiring conductor through predetermined via conductors provided on the first circuit board and/or the second circuit board;
The wiring conductor is
A first via conductor formed on the first circuit board and a second via conductor formed on the second circuit board are formed on a surface of the second circuit board in contact with a predetermined package board. The multilayer wiring and the wiring conductor are electrically connected through
semiconductor device .

Images