WO2005059999A1

WO2005059999A1 - Integrated circuit protected by an active shielding

Info

Publication number: WO2005059999A1
Application number: PCT/FR2004/003180
Authority: WO
Inventors: Frank Lhermet
Original assignee: Innova Card
Priority date: 2003-12-10
Filing date: 2004-12-10
Publication date: 2005-06-30
Also published as: FR2863746A1; EP1733428A1; FR2863746B1

Abstract

The invention relates to an integrated circuit provided with a protective shielding (BOU) which comprises a first pattern (MOT1) connected to a mass and a second pattern connected to a protective electric generator (GEP). In addition, said shielding (BOU) comprises jamming means for emitting electromagnetic noise.

Description

The present invention relates to an integrated circuit protected by an active shield. The field of the invention is that of programmable integrated circuits, in particular that of the circuits used to carry out confidential transactions. The physical protection of integrated circuits is more and more necessary, because these circuits are intended for applications which must be made safe. In fact, it is easy to physically attack an integrated circuit devoid of specific protections, for example by positioning a probe on one of the tracks in order to spy on or force a signal borrowing it from a value. For the purpose of protection, a metallic shield is deposited on this integrated circuit. In the manufacture of integrated circuits, several levels of metal are used to "route" the signals, that is to say to connect the functions of the circuit, to each other. These different levels of metal are stacked on top of each other, an insulating layer being inserted between two successive layers of metal. The last level of metal, located on the upper surface of the multilayer sandwich structure thus produced, can be reserved for the protective shield. This will inter alia inhibit the installation of a probe on one of the tracks of the circuit, the latter being no longer visible. Shield presence detectors are used to block the circuit, or even erase certain memory areas, if the latter has been damaged or destroyed. In particular, the shield can undergo a chemical attack aimed at dissolving the last level of metal. Another more recent type of attack, of the electromagnetic type, consists in positioning a probe close to the surface of the circuit, in locally measuring the magnetic field, and in deducing therefrom the signals circulating in the vicinity of this probe. Currently three main types of attacks are used for the purpose of identifying data. Firstly, analyzes of the “SPA” type, or Power analysis alone (from the English term “Single Power Analysis”), called “by the band” (from the English term “Side Channel”), consist in observing the variations in the overall consumption in electrical power of the circuit and then to identify the data. This type of analysis gives its best results if the hardware architecture is known. Note, for example, that an increase in circuit consumption may indicate that a modular exponentiation operation is in progress. Secondly, analyzes of the “DPA” or “Differential Power Analysis” type (also known as “Differential Power Analysis”), also known as “by the band”, are more sophisticated than the preceding ones. They are based on a statistical analysis. Several executions of the same algorithm allow the statistical extraction of the desired information. Thirdly, attacks of the “DEMA” or “Differential Electromagnetic Analysis” type (for the English term “Differential Electromagnetic Analysis”), are based on the same techniques as the previous ones, but the physical quantities measured are different. In the case of DEMA attacks, it is the electromagnetic radiation emitted by the tracks of the circuit which are targeted. The current flowing in a conductor induces electromagnetic radiation, it is therefore natural that the same phenomenon occurs in the vicinity of a semiconductor. As the consumption of a circuit varies while the data is being processed, the electromagnetic analysis of this circuit may allow the extraction of secret or at least confidential data. In certain cases, the “DPA” analysis does not allow information to be obtained, for example when the power does not vary or varies little. It is therefore not possible to isolate the different functions of a circuit during such an analysis. On the other hand, it is possible to measure the electromagnetic radiation locally on the surface of a circuit, which will make it possible to isolate the functions. The big advantage of DEMA analysis is its ability to use local information. This geometric degree of freedom will make it possible to point directly to the area of the circuit where the information of interest flows. Currently, the solutions implemented on certain circuits use a shield comprising several patterns, at least one of which is connected to an electrical protection generator. For example, the documents US 6,496,119, US 6,246,970 and US 5,389,738 each propose a circuit which is provided for detecting a cut in the pattern to which the protection generator is connected. Document US 5 998 858 provides for its part a detection block which is able to detect a variation of the electromagnetic radiation by means of a sensor arranged outside the circuit comprising the shield. It appears that the protection measures implemented so far are simply to try to detect an intrusion into the circuit. Nothing is done to combat an electromagnetic attack that has gone undetected. The invention proposes to overcome these drawbacks by strengthening the protection provided by a shield, to combat any type of attack: mechanical, chemical, and in particular electromagnetic attacks. According to the invention, the circuit is provided with a protective shield, this shield comprising a first pattern connected to ground and a second pattern connected to an electrical protection generator; moreover, this shield comprises scrambling means for emitting electromagnetic noise. Interference is therefore achieved in the face of external attacks by superposition of the electromagnetic radiation emitted by the integrated circuit and the noise emitted by the shield. Advantageously, these scrambling means comprise a random current generator connected to the second pattern of the shield. Preferably, the circuit comprises a comparator producing at output the maximum value of a random value and a set value, and a digital analog converter supplying this maximum value to the generator. According to an additional characteristic of the invention, this electrical protection generator is a source of variable intensity. In addition, a current sensor disposed at one end of the second pattern, opposite to that where the generator is located, detects an attack on the shield when the current it receives is zero. For example, this current sensor receives a current setpoint value from the output of the electrical protection generator in order to ensure that the circuit is supplied correctly, when there is no variation between the current measurement and the current setpoint. Optionally, this current sensor detects a zero current. Advantageously, this random current is sufficiently low so as not to disturb the operation of the circuit and not to significantly increase its consumption. Furthermore, the first pattern is equipped with mass detectors placed on its conductors, measuring voltage drops, and thus verifying that this pattern has not been damaged. In addition, a short circuit detector connected to the second pattern makes it possible to generate an alert interrupt. The present invention will now appear in more detail in the context of the following description of embodiments given by way of illustration with reference to the accompanying drawings, among which: - Figure 1 is a general block diagram of a static shield according to a first embodiment of the invention, - FIG. 2 represents a general block diagram of a dynamic shield according to a second embodiment of the invention, and - FIG. 3 represents a detector for damage to the conductors of the first pattern according to the invention. The elements present in several figures are assigned a single reference. With reference to FIG. 1, the BOU shield, according to a first embodiment in accordance with the invention, corresponds to the upper metallic layer of the previously described multilayer sandwich, and the surface of which obscures the lower layers. The BOU shield is qualified as static. The BOU shield has a first pattern MOT1 connected to earth, and a second pattern MOT2 connected to an electrical protection generator GEP, in this case a voltage source. As shown in FIG. 1, the patterns MOT1 and MOT2 consist of metallic conductors, these conductors covering, apart from the connection pads, the entire surface of the circuit. The metal used to generate this protection is the last metal in the process, or upper metal in the circuit: the patterns MOT1, MOT2 are obtained from the metallic upper layer of the metal / insulator multilayer during the manufacturing process. The BOU metal shield protects the circuit against possible physical attack and hides the lower layers of the component. It is a protection which prevents the electrical analysis of the surface of the circuit, by placing a probe, which would make it possible to obtain information. The second pattern MOT2 is nested without contact in the first pattern MOT1. The two patterns MOT1, MOT2 have neighboring comb configurations, which are relatively easy to produce, but may have other geometries, such as spirals, or fractals, or slots, among others, as long as one element of a pattern is between two elements of another. The first pattern MOT1 can be equipped with GND-DETi, GND-DETj mass detectors placed on its conductors, which verify that the pattern has not been damaged. With reference to FIG. 3, such a mass detector consists of a NAND logic operator called NAND, connected at input to ground and to the conductors of the first pattern MOT1, and at output at the general reset of the circuit RES.

This reset is activated via a PDOWN discharge resistor, connected between the operator output and ground. When the conductor of the first MOT1 pattern is correctly connected to ground, the output of the NAND cell is 1. Otherwise, the conductor of the first MOT1 pattern is floating, the operator's output is also floating, and the PDOWN discharge resistor will force this output to ground. Note that the operators' outputs are connected to the general reset of the circuit in order to force the RES reset if the connector of the MOT1 pattern is damaged. The GEP electrical protection generator can be a constant voltage source, used to generate the voltage of the VBOU shield. Returning to FIG. 1, a detection block BLD disposed at the end of the conductor of the second pattern MOT2 makes it possible to generate an alert interruption WAR when the continuity of the conductors is interrupted, or when there is a short circuit between the GEP electrical protection generator and the earth. For this purpose, the BLD detection block can be in the form of a voltage comparator, placed at one end of the conductor of the second pattern MOT2, opposite to that connected to the generator GEN, and used to compare the voltage of the shield VBOU and a reference voltage VREF. When the shield is damaged, the detection unit will detect this anomaly and will inform the rest of the system by the WAR alert interrupt message. Referring to Figure 2, the BOU shield, according to a second embodiment of the invention, is qualified as dynamic. This BOU shield comprises all the elements previously listed relative to FIG. 1. The BOU shield emits an electromagnetic noise over all or part of the surface of the integrated circuit C1, except for the connection pads. We thus realize a interference in the face of external attacks by superimposing the electromagnetic noise of the integrated circuit and that of the BOU shield. This electromagnetic noise is generated by a random current CA flowing through the shield BOU using the second pattern MOT2, the random current CA being emitted by the electrical protection generator GEP. As shown in FIG. 2, a digital analog converter DAC receives as input a random value VA emitted by a random digital register RNR, formats it and delivers it at output to the generator GEP, which emits a current AC in the circuit constituted by the second motif MOT2. Therefore, the GEP generator is a source of variable intensity, emitting a random AC current. The random current AC is relatively low so as not to disturb the operation of the circuit and not to significantly increase its consumption. However, it will be sufficiently large, and if possible never zero, so as to create a significant electromagnetic noise which interferes with that generated by the integrated circuit Cl. In order to prevent the AC current from being zero, a threshold value comparator COMP receives the outgoing current from the digital analog converter DAC and a threshold value VALMIN, and transmits as output the major of the two inputs to the generator GEP, this in order to offset the emissions of the number zero by the random number register RNR. A current sensor CS makes it possible, according to a first variant, to detect an attack on the shield if the current which it receives is different from the random current AC. To this end, the sensor CS receives a current setpoint value CGNCS corresponding to the current at the output of the electrical protection generator GEP, in order to ensure that the circuit is well supplied and that the incident is indeed from the BOU shield. According to a second variant, the random current CA injected into the second pattern of the BOU shield, more precisely into the second pattern

MOT2, never being zero, even when the input voltage of the generator GEP is zero volts, this allows the current sensor CS to certify that a measurement of zero current means damage to the BOU shield. It is possible to implement the first embodiment of the invention alone, with reference to FIG. 1 corresponding to an active shield said in static mode; or also the second embodiment of the invention alone, with reference to FIG. 2 corresponding to an active shield known as in dynamic mode. It is also possible to jointly implement these two modes, and in order to make the DC voltage of the static mode and the variable intensity of the dynamic mode coexist within two GEP electrical protection generators, it is possible to provide switching means for select one of the two modes, for example in the form of a flip-flop or switch receiving a clock signal. This of course assumes that this generator is designed dual mode. Similarly, in order to make the BLD detection block responsible for detecting voltage variations, used in static mode, coexist with the current sensor CS responsible for detecting current variations, used in dynamic mode, it is possible to provide means for switching to select one of the two modes, for example also in the form of a flip-flop or switch receiving a synchronous clock signal from that relating to the electrical protection generator GEP. For reasons of simplification, these rockers do not appear in the attached figures. Such a cohabitation device dispenses with having to use filters. The embodiments of the invention presented above have been chosen with regard to the concrete character which they have in common. However, it would not be possible to exhaustively list all the embodiments covered by this invention. In particular, any means described can be replaced by equivalent means without departing from the scope of the present invention.

Claims

1) Circuit provided with a BOU protection shield, said BOU shield comprising a first MOT1 pattern connected to ground and a second MOT2 pattern connected to an electrical protection generator GEP, characterized in that said BOU shield comprises jamming means to emit electromagnetic noise.

2) Circuit according to claim 1, characterized in that said scrambling means comprise a random current generator CA connected to the second pattern MOT2 of said BOU shield.

3) Circuit according to claim 2, characterized in that it comprises a comparator COMP producing at output the maximum value of a random value and of a set value, and a digital analog converter providing this maximum value to said electric generator of protection.

4) Circuit according to claim 3, characterized in that said GEP electrical protection generator is a source of variable intensity.

5) Circuit according to any one of claims 1 to 4, characterized in that a current sensor CS disposed at one end of the second pattern MOT2 opposite to that where the generator GEP detects an attack on the BOU shield when the current that it receives is zero.

6) A circuit according to claim 5, characterized in that said current sensor CS receives a current setpoint value CGNCS coming from the output of the electrical protection generator GEP in order to ensure that the circuit is well supplied, when it there is no difference between the current measurement and said CGNCS setpoint.

7) Circuit according to claim 5, characterized in that said current sensor CS can detect a zero current. 8) Circuit according to any one of claims 2 to 7, characterized in that said random current AC is sufficiently low so as not to disturb the operation of said circuit and not to significantly increase its consumption.

9) Circuit according to any one of the preceding claims, characterized in that the first pattern MOT1 is equipped with GNDDETi, GNDDETj ground detectors arranged on its conductors, measuring voltage drops and thus verifying that said pattern MOT1 has not been damaged.

10) Circuit according to any one of claims 1 to 8, characterized in that a short circuit detector BLD connected to the second pattern MOT2 makes it possible to generate a WAR alert interrupt.