KR102593608B1 - Method and security circuit for detecting focused ion beam(fib) attack - Google Patents

Abstract

The present disclosure solves the problem of vulnerability to attacks that analyze and determine the operation and characteristics of the chip by simultaneously connecting to multiple chips performing the same operation by providing a security circuit that takes into account the unique encryption characteristics of the chip, It relates to a focused ion beam attack detection method that provides high security and security cost savings and a security circuit for the same.

Description

Method for detecting focused ion beam attack and security circuit therefor {METHOD AND SECURITY CIRCUIT FOR DETECTING FOCUSED ION BEAM(FIB) ATTACK}

This disclosure relates to an apparatus and method for detecting intrusion attacks on semiconductor devices. More specifically, the present disclosure relates to a method for detecting a focused ion beam attack and a security circuit therefor.

Embedded or mobile computing devices are comprised of integrated circuits containing information that requires security. As the number of IP (Intellectual Property blocks) required for general integrated circuit design increases, Design For Security (DFS) methodology is becoming increasingly important.

There are various types of physical attacks on integrated circuits, and depending on the degree of penetration, they can be classified into penetration attacks, semi-penetration attacks, and non-penetration attacks. Among them, infiltration attacks refer to methods that directly observe integrated circuits or analyze the internal structure of a chip through physical access. Penetration attacks require expensive equipment and specialized skills, but are considered the most powerful attacks because they allow direct access to each element. Representative penetration attacks include depackaging, which involves removing the material covering the circuit and then accessing the inside of the chip, microprobing, which uses a probe to contact wires inside the chip, and ion beams using FIB equipment. FIB (also called 'FIB Chip Editing'), which can neutralize security circuits or easily access and control confidential data inside a chip by arbitrarily shorting or connecting metal lines and modifying or destroying some circuits of the chip. There is reverse engineering, which involves disassembling a semiconductor device in reverse to infer its internal structure, constituent materials, electrical characteristics, and manufacturing process. Among these, research on intrusion attack detection circuits based on Secure Shield to prevent FIB attacks is actively underway.

However, in the case of the existing intrusion attack detection circuit, since it uses random bits generated by the block chipper, it has the disadvantage of being able to neutralize security circuits using replication and multiple chips by transmitting the same encrypted data to the chip. exist. Therefore, there is a need for a security circuit that can detect focused ion beam (FIB) penetration attacks using the unique information of the chip.

Public Patent Publication No. 10-2020-0141783, 2020.12.21

The embodiment disclosed in the present disclosure provides a security circuit that takes into account the unique encryption characteristics of the chip, making it vulnerable to attacks that simultaneously connect to multiple chips performing the same operation and analyze and determine the operation and characteristics of the chip. The purpose is to solve this problem and provide high security and security cost reduction effects.

The problems to be solved by the present disclosure are not limited to the problems mentioned above, and other problems not mentioned can be clearly understood by those skilled in the art from the description below.

A security circuit according to an aspect of the present disclosure for achieving the above-described technical problem includes N metal lines extending in a first direction and arranged to be spaced apart from each other in a second direction perpendicular to the first direction, where N is A protective shield, which is a natural number greater than 2, is arranged to be spaced apart from the protective shield in a third direction perpendicular to the first and second directions, and is electrically connected to at least some of the N metal lines to perform a penetration attack using a focused ion beam. It includes a detection circuit that detects, wherein the detection circuit includes a control unit that generates a control signal, a block encryption unit that includes block encryption logic that performs block encryption according to the first control signal received from the control unit, and a control unit that generates a control signal. A copy protection unit that generates bits that cannot be physically copied according to a second control signal, a path activation unit that activates at least some of the metal lines of the protective shield according to a third control signal received from the control unit, and output data of the block cipher unit. and a data conversion unit that operates and stores the output bits of the copy prevention unit, a data comparison unit that generates comparison data based on the output data of the data conversion unit and data received from the metal lines activated by the path activation unit, and a data comparison unit that generates comparison data. and an attack detection unit that detects an infiltration attack using a focused ion beam.

According to one aspect of the present disclosure for achieving the above-described technical problem, a protective shield including a plurality of metal lines and a detection circuit electrically connected to the metal lines to detect an infiltration attack using a focused ion beam. The intrusion attack detection method using a security circuit includes initializing the settings of the storage unit, generating a first control signal, a second control signal, and a third control signal in the control unit, and based on the first control signal in the block encryption unit. Outputting encrypted data, generating PUF bits that cannot be physically copied based on the second control signal in the copy protection unit, and generating at least some of the plurality of metal lines based on the third control signal in the path activation unit. Activating, receiving the encrypted data and PUF bits from the data conversion unit, calculating the encrypted data and PUF bits and outputting the converted encrypted data, receiving the converted encrypted data from the data comparison unit through a plurality of metal lines. It includes a step of comparing data and outputting comparative data, and a step of detecting an intrusion attack using a focused ion beam based on the comparison data in an attack detection unit.

In addition to this, a computer program stored in a computer-readable recording medium for execution to implement the present disclosure may be further provided.

In addition, a computer-readable recording medium recording a computer program for executing a method for implementing the present disclosure may be further provided.

According to the means for solving the above-described problem of the present disclosure, the size of the built-in hardware can be reduced while providing higher security, thereby providing the effect of reducing the cost used for security.

The effects of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned may be clearly understood by those skilled in the art from the description below.

1 is a block diagram for explaining a security circuit according to an embodiment of the present disclosure.
Figure 2 is a block diagram for explaining a detection circuit according to an embodiment of the present disclosure.
3 is a circuit diagram of a security circuit according to an embodiment of the present disclosure.
4 is a timing diagram of a security circuit according to an embodiment of the present disclosure.
5 is a flowchart of a method for detecting an intrusion attack according to an embodiment of the present disclosure.

Like reference numerals refer to like elements throughout this disclosure. The present disclosure does not describe all elements of the embodiments, and general content or overlapping content between the embodiments in the technical field to which the present disclosure pertains is omitted. The term 'unit, module, member, block' used in the specification may be implemented as software or hardware, and depending on the embodiment, a plurality of 'unit, module, member, block' may be implemented as a single component, or It is also possible for one 'part, module, member, or block' to include multiple components.

Throughout the specification, when a part is said to be “connected” to another part, this includes not only direct connection but also indirect connection, and indirect connection includes connection through a wireless communication network. do.

Additionally, when a part "includes" a certain component, this means that it may further include other components rather than excluding other components, unless specifically stated to the contrary.

Throughout the specification, when a member is said to be located “on” another member, this includes not only cases where a member is in contact with another member, but also cases where another member exists between the two members.

Terms such as first and second are used to distinguish one component from another component, and the components are not limited by the above-mentioned terms.

Singular expressions include plural expressions unless the context clearly makes an exception.

The identification code for each step is used for convenience of explanation. The identification code does not explain the order of each step, and each step may be performed differently from the specified order unless a specific order is clearly stated in the context. there is.

Hereinafter, the operating principle and embodiments of the present disclosure will be described with reference to the attached drawings.

In this specification, the 'method of detecting an intrusion attack using a security circuit capable of detecting a focused ion beam attack' can be performed through various devices that can perform computational processing and provide results to the user. For example, the intrusion attack detection method according to the present disclosure may be performed through a computer, a server device, or a portable terminal, or may be performed through any one.

Here, the computer may include, for example, a laptop, desktop, laptop, tablet PC, slate PC, etc. equipped with a web browser.

The server device is a server that processes information by communicating with external devices, and may include an application server, computing server, database server, file server, game server, mail server, proxy server, and web server.

The portable terminal is, for example, a wireless communication device that guarantees portability and mobility, such as PCS (Personal Communication System), GSM (Global System for Mobile communications), PDC (Personal Digital Cellular), PHS (Personal Handyphone System), and PDA. (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code Division Multiple Access)-2000, W-CDMA (W-Code Division Multiple Access), WiBro (Wireless Broadband Internet) terminal, smart phone ), all types of handheld wireless communication devices, and wearable devices such as watches, rings, bracelets, anklets, necklaces, glasses, contact lenses, or head-mounted-device (HMD). may include.

Various physical and software attacks on semiconductor chips can pose a threat to the security or stability of semiconductor chips. For example, attacks on semiconductor chips can cause practical problems such as enabling hacking of important data or unlocking access security.

1 is a block diagram for explaining a security circuit according to an embodiment of the present disclosure.

Referring to FIG. 1, the security circuit 100 may include a protective shield 110 and a detection circuit 120.

The protective shield 110 may include a plurality of metal lines. The protective shield 110 may be placed on top of the semiconductor chip. The protection shield 110 may be placed on top of the processor to protect the processor. The protective shield 110 may be implemented in the form of an active shield including a plurality of metal lines. The protective shield 110 may include N metal lines. N can be a natural number greater than 2. The protective shield 110 may be placed on top of the semiconductor chip.

The detection circuit 120 may be electrically connected to at least some of the N metal lines included in the protective shield 110. The detection circuit 120 is electrically connected to at least some of the N metal lines of the protective shield 110 and can detect an intrusion attack using a focused ion beam. The detection circuit 120 can set a data path by changing the connection state of the N metal lines arranged in the protection shield 110. The detection circuit 120 can detect an external attack by analyzing a test signal according to a set data path. Below, the detection circuit 120 will be described in more detail with reference to FIGS. 2 to 4 .

Figure 2 is a block diagram for explaining a detection circuit according to an embodiment of the present disclosure.

Referring to FIG. 2, the detection circuit 120 includes a control unit 121, a block encryption unit 122, a copy protection unit 123, a path activation unit 124, a data conversion unit 125, and a data comparison unit 128. ) and an attack detection unit 129.

The control unit 121 may generate a control signal. The control unit may transmit the generated control signal to at least some of the block encryption unit 122, the copy prevention unit 123, and the path activation unit 124. The control unit may transmit a first control signal to the block encryption unit 122, a second control signal to the copy protection unit 123, and a third control signal to the path activation unit 124. For example, the control unit 121 may transmit the plain text and the encryption key to the block encryption unit 122. The plaintext transmitted from the control unit 121 to the block cipher unit 122 may be 128 bits. For example, the control unit 121 may transmit a rising pulse to the copy protection unit 123. For example, the control unit 121 may transmit a pulse signal to the path activation unit 124 to activate at least some of the metal lines of the protective shield (110 in FIG. 1).

The control unit 121 may be implemented as a finite state machine (FSM). The control unit 121 may generate an intrusion alarm based on the output signal of the attack detection unit 129. For example, the control unit 121 may generate an intrusion alarm when the output signal of the attack detection unit 129 is logic high (eg, '1').

The block cipher unit 122 may include block encryption logic capable of performing block cipher. For example, the block encryption logic may be a block cipher engine or a block cipher module. Block ciphers can be deterministic encryption algorithms that operate on groups of fixed-length bits, called blocks, with an unvarying transformation using a symmetric key used to encrypt and decrypt data.

For example, the block encryption logic may include Advanced Encryption Standard (AES) logic (e.g., an AES engine or module). AES may be a U.S. National Institute of Standards and Technology (NIST) approved encryption algorithm further described in the U.S. Federal Information Processing Standards (FIPS) PUB 197, published on November 26, 2001. Alternatively, other block encryption on-die logic implementation algorithms (e.g., other algorithms approved by NIST or FIPS) may optionally be used in place of AES.

The block cipher unit 122 is regardless of type and may have a size of 128 bits. For example, the block cipher 122 may be implemented as a Block Cipher. The block encryption unit 122 can output encrypted data.

The copy protection unit 123 may generate physically unclonable function (PUF) bits. The copy protection unit 123 may be an integrated circuit (IC) that has characteristics that cannot be physically copied, and even if an attacker copies the copy protection unit 123, the original copy protection unit 123 retains the Even physical characteristics may not be replicable. Therefore, even if an attacker copies the copy protection unit 123, it may be impossible to generate the same output value of the copy protection unit 123 due to the random physical characteristics of the copy protection unit 123.

In one embodiment, the copy protection unit 123 is a copy protection element (hereinafter, referred to as, (referred to as 'mismatch based PUF').

In one embodiment, the copy protection unit 123 may be composed of a copy protection element (hereinafter referred to as 'physical based PUF') that determines the output based on the physical connection state between one or two conductive wires. You can.

The copy protection unit 123 may include 128 1-bit cells. The copy protection unit 123 may include 128 PUF cells. The copy protection unit can generate bits that are physically impossible to copy. The bits that cannot be physically copied may be referred to as 'PUF bits'.

The path activation unit 124 may activate at least some of the metal lines of the protection shield (110 in FIG. 1) according to the control signal received from the control unit 121. The path activation unit 124 may activate at least one group of metal lines of the protective shield (110 in FIG. 1), and one group may include 128 metal lines arranged adjacent to each other.

The path activation unit 124 may be configured as a three-phase inverter. When the security circuit (100 in FIG. 1) includes N metal lines, the path active unit 124 may include N three-phase inverters.

The data conversion unit 125 may calculate and store the output data of the block encryption unit 122 and the output data of the copy prevention unit 123. Accordingly, the data conversion unit 125 can generate and store the converted encrypted data. The data conversion unit 125 may include a calculation unit 126 and a storage unit 127.

The calculation unit 126 can calculate the output data of the block encryption unit 122 and the output data of the copy prevention unit 123. The calculation unit 126 may perform an XOR operation on the encrypted data output from the block cipher unit 122 and the PUF bit output from the copy prevention unit 123. The operation unit 126 may include a plurality of XOR gates. For example, the operation unit 126 may include 128 XOR gates.

The storage unit 127 may store output data of the calculation unit 126. The storage unit 127 may store converted encrypted data. The storage unit 127 may include a plurality of flip-flops. For example, the storage unit 127 may include a plurality of D-Q flip-flops. For example, the storage unit 127 may include 128 D-Q flip-flops.

The storage unit 127 can simultaneously output the data stored in the storage unit 127 to metal lines activated by the path activation unit 124. For example, the storage unit 127 can simultaneously output each data stored in 128 flip-flops.

The data comparison unit 128 may generate comparison data based on the output data of the data conversion unit 125 and data received from metal lines activated by the path activation unit 124. The data comparison unit 128 may calculate the output data of the data comparison unit 128 and the data received through the metal line. The data comparison unit 128 may perform an XOR operation on the output data of the data comparison unit 128 and the data received through the metal line. The data comparison unit 128 may include a plurality of XOR gates. For example, the data comparison unit 128 may include 128 XOR gates. The data comparison unit 128 may output comparison data based on the calculation result.

The attack detection unit 129 may detect an intrusion attack using a focused ion beam based on the comparison data output from the data comparison unit 128. The attack detection unit 129 may include an OR gate. For example, the attack detection unit 129 may output '0' when an intrusion attack using a focused ion beam is detected, and may output '1' when an intrusion attack using a focused ion beam is not detected.

3 is a circuit diagram of a security circuit according to an embodiment of the present disclosure. The first direction (X) and the second direction (Y) are perpendicular to each other on the plane, and the third direction (Z) is perpendicular to both the first direction (X) and the second direction (Y). FIG. 3 is explained with reference to FIGS. 1 and 2 , like components are indicated by the same reference numerals, and overlapping descriptions are omitted.

Referring to FIG. 3, the protective shield 110 may be disposed on top of the detection circuit 120. The protective shield 110 may be arranged to be spaced apart from the detection circuit 120 in the third direction (Z).

The protective shield 110 may include a plurality of metal lines 111 . The plurality of metal lines 111 may extend in the first direction (X) and may be arranged to be spaced apart from each other in the second direction (Y). The plurality of metal lines 111 may include N metal lines. N may be a natural number greater than 2. N metal lines may be composed of M groups of 128 each. M may be a natural number greater than or equal to 1. The metal lines 111 may be connected to the path active portion 124 of the detection circuit 120.

The detection circuit 120 may be electrically connected to at least some of the metal lines of the protective shield 110. Accordingly, the detection circuit 120 can detect an intrusion attack using a focused ion beam. The detection circuit 120 includes a control unit 121, a block encryption unit 122, a copy protection unit 123, a path activation unit 124, a data conversion unit 125, a data comparison unit 128, and an attack detection unit 129. ) may include.

The control unit 121 may generate a control signal. The control unit may transmit the generated control signal to at least some of the block encryption unit 122, the copy prevention unit 123, and the path activation unit 124. The control unit may transmit a first control signal to the block encryption unit 122, a second control signal to the copy protection unit 123, and a third control signal to the path activation unit 124. For example, the control unit 121 may transmit the plain text and the encryption key to the block encryption unit 122. The plaintext transmitted from the control unit 121 to the block cipher unit 122 may be 128 bits. For example, the control unit 121 may transmit a rising pulse to the copy protection unit 123. For example, the control unit 121 may transmit a pulse signal to the path activation unit 124 to activate at least some of the metal lines of the protective shield (110 in FIG. 1). The control unit 121 may be implemented as a finite state machine (FSM). The control unit 121 may generate an intrusion alarm based on the output signal of the attack detection unit 129. For example, the control unit 121 may generate an intrusion alarm when the output signal of the attack detection unit 129 is logic high (eg, '1').

The block cipher unit 122 may include block encryption logic capable of performing block cipher. For example, the block encryption logic may be a block cipher engine or a block cipher module. Block ciphers can be deterministic encryption algorithms that operate on groups of fixed-length bits, called blocks, with an unvarying transformation using a symmetric key used to encrypt and decrypt data. For example, the block encryption logic may include Advanced Encryption Standard (AES) logic (e.g., an AES engine or module). AES may be a U.S. National Institute of Standards and Technology (NIST) approved encryption algorithm further described in the U.S. Federal Information Processing Standards (FIPS) PUB 197, published on November 26, 2001. Alternatively, other block encryption on-die logic implementation algorithms (e.g., other algorithms approved by NIST or FIPS) may optionally be used in place of AES. The block cipher unit 122 is regardless of type and may have a size of 128 bits. For example, the block cipher 122 may be implemented as a Block Cipher. The block encryption unit 122 can output encrypted data.

The copy protection unit 123 may generate physically unclonable function (PUF) bits. The copy protection unit 123 may be an integrated circuit (IC) that has characteristics that cannot be physically copied, and even if an attacker copies the copy protection unit 123, the original copy protection unit 123 retains the Even physical characteristics may not be replicable. Therefore, even if an attacker copies the copy protection unit 123, it may be impossible to generate the same output value of the copy protection unit 123 due to the random physical characteristics of the copy protection unit 123. The copy protection unit 123 may include 128 1-bit cells. The copy protection unit 123 may include 128 PUF cells. The copy protection unit can generate ‘PUF bits’ that are physically impossible to copy. In one embodiment, the copy protection unit 123 is configured as a 'mismatch based PUF' that determines the output after measuring the delay time caused by process deviations that occur in devices or circuits depending on the implementation method during the semiconductor manufacturing process. It can be. In one embodiment, the copy protection unit 123 may be configured as a 'physical based PUF' that determines the output based on the physical connection state between one or two conductive wires.

The path activation unit 124 may activate at least some of the metal lines 111 according to a control signal received from the control unit 121. The path activation unit 124 may activate at least one group among the M groups included in the metal lines 111, and the group consists of 128 metal groups arranged adjacent to each other but spaced apart from each other in the second direction (Y). Can contain lines. The path activation unit 124 may be configured as a three-phase inverter. When the protective shield 110 includes N metal lines, the path active section 124 may include N three-phase inverters.

The data conversion unit 125 may calculate and store the output data of the block encryption unit 122 and the output data of the copy prevention unit 123. For example, the data conversion unit 125 may calculate the encrypted data output from the block encryption unit 122 and the PUF bit output from the copy prevention unit 123. Accordingly, the data conversion unit 125 can generate and store the converted encrypted data.

The data conversion unit 125 may include a calculation unit 126 and a storage unit 127. The calculation unit 126 can calculate the output data of the block encryption unit 122 and the output data of the copy prevention unit 123. The calculation unit 126 may perform an XOR operation on the encrypted data output from the block cipher unit 122 and the PUF bit output from the copy prevention unit 123. The operation unit 126 may include a plurality of XOR gates. For example, the operation unit 126 may include 128 XOR gates.

The storage unit 127 may store output data of the calculation unit 126. For example, the storage unit 127 may store the converted encrypted data output from the calculation unit 126. The storage unit 127 may include a plurality of flip-flops. For example, the storage unit 127 may include a plurality of D-Q flip-flops. For example, the storage unit 127 may include 128 D-Q flip-flops. The storage unit 127 can simultaneously output the data stored in the storage unit 127 to metal lines activated by the path activation unit 124. For example, the storage unit 127 can simultaneously output each data stored in 128 flip-flops to activated metal lines.

The data comparison unit 128 may generate comparison data based on the output data of the data conversion unit 125 and data received from metal lines activated by the path activation unit 124. The data comparison unit 128 may calculate the output data of the data comparison unit 128 and the data received through the metal line. The data comparison unit 128 may perform an XOR operation on the output data of the data comparison unit 128 and the data received through the metal line. The data comparison unit 128 may include a plurality of XOR gates. For example, the data comparison unit 128 may include 128 XOR gates. The data comparison unit 128 may output comparison data based on the calculation result.

The attack detection unit 129 may detect an intrusion attack using a focused ion beam based on the comparison data output from the data comparison unit 128. The attack detection unit 129 may include an OR gate. For example, the attack detection unit 129 may output '0' when an intrusion attack using a focused ion beam is detected, and may output '1' when an intrusion attack using a focused ion beam is not detected.

4 is a timing diagram of a security circuit according to an embodiment of the present disclosure. More specifically, FIG. 4 shows 128 bits generated in the same cycle for transmission to the protection shield 110 from the two chips (A, B) to which the security circuit 100 described above with reference to FIGS. 1 to 3 is applied. This is an example of a timing diagram.

Referring to FIG. 4, when the security circuit is implemented with a CSS structure or an RSS structure, the control unit (121 in FIG. 2) transmits the same plaintext and encryption key to both chips (A and B), so that the first cycle of FIG. Likewise, the block ciphers of the two chips (A, B) are output as the same value (for example, 0x8AE012CF), but the two chips (A, B) to which the security circuit 100 described above with reference to FIGS. 1 to 3 are applied. Since each can perform operations using unique PUF information, the block cipher values transmitted in the same cycle to the two chips (A, B) may be different.

For example, the PUF information of the first chip (A) may be 0xA9E39441, and the PUF information of the second chip (B) may be 0x8A2648E9. As a result of the calculation using the PUF information, the block cipher values transmitted in the same cycle to each of the first chip (A) and the second chip (B) may be different from 0x2303868E and 0x00C65A26.

The security circuit 100 described above with reference to FIGS. 1 to 3 can provide a security circuit capable of responding to security circuit neutralization attacks through duplication or connection of multiple chips performing the same operation. The security circuit 100 described above with reference to FIGS. 1 to 3 can implement unclonable block encryption of data transmitted to the protection shield by utilizing unique information for each chip. Accordingly, security can be improved.

5 shows an intrusion attack using a security circuit including a protection shield including a plurality of metal lines and a detection circuit electrically connected to the metal lines to detect an intrusion attack using a focused ion beam according to an embodiment of the present disclosure. This is a flowchart of the detection method. The security circuit of FIG. 5 may be the security circuit 100 described above with reference to FIGS. 1 to 3, and redundant description will be omitted.

Referring to FIG. 5, the intrusion attack detection method (S10) may include steps (S11 to S18).

In step S11, the storage unit (127 in FIG. 3) may initialize settings. For example, the storage unit (127 in FIG. 3) can reset all stored data.

In step S12, the controller (121 in FIG. 3) may generate a first control signal, a second control signal, and a third control signal. The first control signal may be at least one of plain text and an encryption key. The plaintext may be 128 bits. The second control signal may be a rising pulse. The third control signal may be a pulse signal. The control unit (121 in FIG. 3) transmits the first control signal to the block cipher (122 in FIG. 3), transmits the second control signal to the copy protection unit (123 in FIG. 3), and sends the third control signal to the path. It can be transmitted to the active unit (124 in FIG. 3).

In step S13, the block encryption unit (122 in FIG. 3) may output encrypted data based on the first control signal. The block cipher unit (122 in FIG. 3) may include block encryption logic capable of performing block cipher. The block cipher unit (122 in FIG. 3) may output encrypted data by performing block cipher based on the first control signal. Block ciphers can be deterministic encryption algorithms that operate on groups of fixed-length bits, called blocks, with an unvarying transformation using a symmetric key used to encrypt and decrypt data. The block cipher unit 122 is regardless of type and may have a size of 128 bits. For example, the block cipher 122 may be implemented as a Block Cipher. The block encryption unit 122 can output encrypted data.

In step S14, the copy protection unit (123 in FIG. 3) may generate PUF bits that cannot be physically copied based on the second control signal. The copy protection unit (123 in FIG. 3) may include 128 1-bit cells. The copy protection unit 123 may include 128 PUF cells.

In one embodiment, the copy protection unit (123 in FIG. 3) is a copy protection element (123 in FIG. 3) that determines the output after measuring the delay time caused by the process deviation that occurs in the device or circuit depending on the method of implementation during the semiconductor manufacturing process. Hereinafter, it may be configured as 'mismatch based PUF').

In one embodiment, the copy protection unit (123 in FIG. 3) is a copy protection element that determines the output based on the physical connection state between one or two conductive wires (hereinafter referred to as 'physical based PUF'). It can be composed of:

In step S15, the path activation unit (124 in FIG. 3) may activate at least some of the plurality of metal lines (111 in FIG. 3) based on the third control signal. The third control signal may be a pulse signal.

In step S16, the data conversion unit (125 in FIG. 3) may receive the encrypted data output from the block encryption unit (122 in FIG. 3) and the PUF bits output from the copy prevention unit (123 in FIG. 3). . The data conversion unit (124 in FIG. 3) may calculate the encrypted data and the PUF bits and output the converted encrypted data.

The data conversion unit 125 may include a calculation unit 126 and a storage unit 127. The calculation unit 126 can calculate the output data of the block encryption unit 122 and the output data of the copy prevention unit 123. The calculation unit 126 may perform an XOR operation on the encrypted data output from the block cipher unit 122 and the PUF bit output from the copy prevention unit 123.

The storage unit 127 may store output data of the calculation unit 126. The storage unit 127 may store the converted encrypted data output from the calculation unit 126. The storage unit 127 may include a plurality of flip-flops. For example, the storage unit 127 may include a plurality of D-Q flip-flops. For example, the storage unit 127 may include 128 D-Q flip-flops.

The storage unit 127 can simultaneously output the data stored in the storage unit 127 to metal lines activated by the path activation unit 124. For example, the storage unit 127 can simultaneously output each data stored in 128 flip-flops.

In step S17, the data comparison unit (128 in FIG. 3) compares the converted encrypted data output from the storage unit (127 in FIG. 3) with the data received through a plurality of metal lines (111 in FIG. 3). You can output comparative data. The data comparison unit 128 may calculate the output data of the data comparison unit 128 and the data received through the metal line. The data comparison unit 128 may perform an XOR operation on the output data of the data comparison unit 128 and the data received through the metal line. The data comparison unit 128 may include a plurality of XOR gates. For example, the data comparison unit 128 may include 128 XOR gates. The data comparison unit 128 may output comparison data based on the calculation result.

In step S18, the attack detection unit (129 in FIG. 3) may detect an intrusion attack using a focused ion beam based on the comparison data. The attack detection unit (129 in FIG. 3) may generate an output signal as it detects an intrusion attack. The attack detection unit (129 in FIG. 3) outputs '0' as the output signal when an infiltration attack using a focused ion beam is detected, and '1' as the output signal when an intrusion attack using a focused ion beam is not detected. can be output.

The control unit (121 in FIG. 3) may generate an intrusion alarm based on the output signal of the attack detection unit (129 in FIG. 3).

Meanwhile, the disclosed embodiments may be implemented in the form of a recording medium that stores instructions executable by a computer. Instructions may be stored in the form of program code, and when executed by a processor, may create program modules to perform operations of the disclosed embodiments. The recording medium may be implemented as a computer-readable recording medium.

Computer-readable recording media include all types of recording media storing instructions that can be decoded by a computer. For example, there may be Read Only Memory (ROM), Random Access Memory (RAM), magnetic tape, magnetic disk, flash memory, optical data storage device, etc.

As described above, the disclosed embodiments have been described with reference to the attached drawings. A person skilled in the art to which this disclosure pertains will understand that the present disclosure may be practiced in forms different from the disclosed embodiments without changing the technical idea or essential features of the present disclosure. The disclosed embodiments are illustrative and should not be construed as limiting.

Claims (22)

Regarding security circuits,
a protective shield disposed above the detection circuit and including N metal lines extending in a first direction and spaced apart from each other in a second direction perpendicular to the first direction, where N is a natural number greater than 2; and
Detector is disposed to be spaced apart from the protective shield in a third direction perpendicular to the first and second directions, and is electrically connected to at least some of the N metal lines to detect an intrusion attack using a focused ion beam. Contains a circuit,
The detection circuit is,
A control unit that generates a first control signal that is one of plain text and an encryption key, a second control signal that is a rising pulse, and a third control signal that is a pulse signal;
a block encryption unit including block encryption logic that performs block encryption according to a first control signal received from the control unit, and outputting encrypted data;
It is a copy prevention element (Physically Based PUF) that generates PUF bits that cannot be physically copied according to the second control signal received from the control unit and determines the output based on the physical connection state between one or two conductive wires. A copy prevention unit configured;
a path activation unit configured as a three-phase inverter and activating at least some of the metal lines of the protective shield according to a third control signal received from the control unit;
a data conversion unit that calculates and stores the output data of the block encryption unit and the output bits of the copy prevention unit;
a data comparison unit that generates comparison data based on the output data of the data conversion unit and data received from metal lines activated by the path activation unit; and
An attack detection unit that detects an infiltration attack using a focused ion beam based on the comparison data,
The data conversion unit includes an operation unit that performs an XOR operation on the encryption data and the PUF bits and outputs converted encryption data; and a storage unit that stores data output from the calculation unit and includes a plurality of flip-flops,
The security circuit simultaneously outputs the stored data to metal lines activated by the path activation unit,
The attack detection unit includes an OR gate, and outputs '0' as an output signal when an infiltration attack using the focused ion beam is detected, and outputs '0' as an output signal when an intrusion attack using the focused ion beam is not detected. A security circuit characterized by outputting 1'. According to paragraph 1,
The block cipher unit,
A security circuit implemented with a block cipher. According to paragraph 2,
The copy protection unit,
A security circuit characterized by consisting of a copy prevention element (mismatch based PUF) that determines the output after measuring the delay time caused by process deviation. According to paragraph 3,
The block cipher unit,
Encrypted data is output by performing block encryption according to the first control signal received from the control unit, and the block encryption is a fixed transformation called a block using a symmetric key used to encrypt and decrypt the data. A security circuit, a deterministic encryption algorithm that operates on groups of bits of length. According to paragraph 4,
The block cipher unit,
A security circuit that is independent of type and has a size of 128 bits. According to clause 5,
The copy protection unit,
A security circuit comprising 128 1-bit cells. delete delete delete According to paragraph 1,
The control unit,
A security circuit characterized in that it generates an intrusion alarm based on the output signal of the attack detection unit. A method for detecting an intrusion attack using a security circuit including a protective shield including a plurality of metal lines and a detection circuit electrically connected to the metal lines to detect an intrusion attack using a focused ion beam, comprising:
Initializing the settings of the storage unit;
Generating, in a control unit, a first control signal that is one of plain text and an encryption key, a second control signal that is a rising pulse, and a third control signal that is a pulse signal;
A block encryption unit including block encryption logic that performs block encryption outputs encrypted data according to the first control signal;
A copy protection unit consisting of a copy protection element (Physically Based PUF) that determines the output based on the physical connection state between one or two conductive wires generates PUF bits that cannot be physically copied according to the second control signal. step;
activating at least some of the plurality of metal lines according to the third control signal by a path activation unit composed of a three-phase inverter;
A data conversion unit receiving the encrypted data and the PUF bits, performing an XOR operation on the encrypted data and the PUF bits, and outputting converted encrypted data;
A data comparison unit comparing the converted encrypted data with data received through the plurality of metal lines and outputting comparison data; and
An attack detection unit detecting an intrusion attack using a focused ion beam based on the comparison data,
Storing the output converted encrypted data in a storage unit including a plurality of flip-flops,
Simultaneously output the stored data to metal lines activated by the path activation unit,
The attack detection unit includes an OR gate, and outputs '0' as an output signal when an infiltration attack using the focused ion beam is detected, and outputs '1' as an output signal when an intrusion attack using the focused ion beam is not detected. An intrusion attack detection method characterized by outputting '. According to clause 11,
The block cipher unit,
An intrusion attack detection method characterized by being implemented with a block cipher. According to clause 12,
The copy protection unit,
An intrusion attack detection method characterized by consisting of a copy prevention element (mismatch based PUF) that determines the output after measuring the delay time caused by process deviation. According to clause 13,
The block cipher unit,
Encrypted data is output by performing block encryption according to the first control signal received from the control unit, and the block encryption is a fixed transformation called a block using a symmetric key used to encrypt and decrypt the data. A method for detecting intrusion attacks, a deterministic encryption algorithm that operates on groups of bits of length. According to clause 14,
The block cipher unit,
An intrusion attack detection method that is independent of type and has a size of 128 bits. According to clause 15,
The copy protection unit,
An intrusion attack detection method comprising 128 1-bit cells. delete delete delete According to clause 11,
The control unit further includes the step of generating an intrusion alarm based on the output signal of the attack detection unit. A program coupled to a computer and stored in a computer-readable recording medium to execute the intrusion attack detection method of any one of claims 11 to 16 and 20. A computer-readable recording medium coupled to a computer and storing a program for executing the intrusion attack detection method of any one of claims 11 to 16 and 20.

Images