WO2007048701A1

WO2007048701A1 - Detection of an attempt for intrusion into a chip through the support structure thereof

Info

Publication number: WO2007048701A1
Application number: PCT/EP2006/067230
Authority: WO
Inventors: Philippe Loubet Moundi
Original assignee: Gemplus
Priority date: 2005-10-25
Filing date: 2006-10-10
Publication date: 2007-05-03
Also published as: FR2892544B1; FR2892544A1

Abstract

The invention relates to detecting an intrusion or the attempt thereof on an electronic chip (3) and/or through a support structure (1) to which said chip is connected by the location (30) thereof. Means (5) for displaying the intrusion is jointed to said support structure in front of the location by integration or application thereof, wherein at least one physical parameter of said means varies according to a first reference state corresponding to the unaltered state of the intrusion displaying means or to a second intrusion or intrusion-attempt state corresponding to the altered state of said intrusion displaying means.

Description

Detection of attempted break-in on a chip through its support structure

The object of the invention is to protect electronic components against fraudulent reading of data they contain and / or their circuit structure.

In other words, it is to protect semi-conductor chips.

The term "electronic chip" used generically below includes all the electronic components that can be read fraudulently as indicated below, in particular by the rear face of the support structure of this chip.

For all intents and purposes, it is specified here that an electronic chip is a small plate based on semiconductor material, typically silicon, on which are made and / or arranged elements, or components, typically serving to form an integrated circuit .

There exists in particular a solution for protecting such a chip which uses an electrical circuit deposited by conductive cords on the mechanical protective coating of a chip disposed on a support.

In FR-A-2 864 667 or DE-A-102 51 317 is disclosed a support structure adapted to receive, in at least one location having a predetermined surface, at least one electronic chip.

It was found that today a problem remains vis-à-vis the protection of these electronic chips against a fraudulent reading as indicated above, particularly in the context of protection against attacks by physical disruption , such as electromagnetic beam, laser, or the like. An objective here is specifically to provide protection against an attack by the rear face of the chip, the side where it is related to its support structure (flexible film, more rigid structure ...).

It is known that such attacks take place in particular by making a cut, or a small hole, through the location zone of the chip on the support structure. In DE-A-102 51 317, a protective structure of an integrated circuit on a substrate incorporates, on the outer faces of the chip: electrical conductors on the front and rear faces and interconnection elements between these conductors, on the slices. The integrated circuit detects any changes in the conductors or their properties.

One objective here is to at least disturb the attacks by the rear face, at least by delaying and / or complicating them, this at a reduced cost and without complicating neither the manufacture of the chips, nor their assembly to the substrate, nor the reception on them of additional electric components provided.

In this context, are in particular proposed a solution as expressed in appended claim 1 or an assembly comprising:

a support structure,

at least one electronic chip received at a location of a first face of the support structure having a predetermined surface,

- and at least one burglar-proofing means arranged at least opposite a substantial part of said surface occupied by the chip on the support structure and which:

* is integrated into the support structure,

* and / or is interposed between said chip and this support structure,

* and / or is bonded to said support structure on the side of its second face opposite to the first,

* and which has at least one physical parameter which varies according to whether one is in a first reference state corresponding to an unaltered state of the burglar-proofing means or in a second state of burglary or attempted burglary, corresponding to an impaired state of this burglar-proofing means.

This in particular avoids a disadvantage of DE-A-102 51 317 where the complete encapsulation of the integrated circuit makes it necessary to carry out this encapsulation before fixing on the support and requires an operational connection between the front and rear faces of the chip, via the electrical interconnections. lateral (markings 5 fig.2 of DE-A-102 51 317). In addition, in the invention, it will detect an attempted break-in chip while it is assembled, and therefore remains fixed to the support structure. It is not a question of comparing, or even taking into account, variations between the characteristics of the front and rear faces. Foresee side connectors is complicated, expensive and not useful. Favorably, in the invention: a) if it is placed at the interface between the support structure and the chip, the developer means will extend exclusively there, without overflowing elsewhere on other face of the chip, b) - and / or this revealing means will be independent of the shield (s) protector (s) which otherwise protects the chip at least on the side of its front face, c) - and / or the, or each, means of revealing the burglary (or the attempted break-in) will be electrically conductive and electrically connected to the chip and / or conductor tracks whose support structure is provided, and (d) - and / or the physical parameter that varies will be a electrical parameter of this burglar-proof element, such as resistance.

This will facilitate the realization of the aforementioned assembly (particularly in the case of a burglar-proofing means to be integrated into the support structure), will limit the cost and simplify the overall solution.

Characteristics a) and b) will favor a solution limiting manufacturing and assembly operations (no encapsulation), will allow both a solution of integrated developer and reported (including under the support structure, the opposite of the chip as fig.2 below) and will adapt to already existing solutions for protecting the front of chips

(shield).

The or each burst-deterrent means, if it is an electrically conductive means, will also be favorably made from a deposit of electrically conductive material, an electrically conductive ink, a resistive element, an electrically conductive adhesive. In a favorable embodiment in particular in terms of manufacturing process, it has in particular been provided that the conductive conducting means break-in defines a portion of the conductive tracks of the support structure.

In particular in this case, a favorable embodiment provides that the burglar-proofing means considered comprises at least one track having meanders.

Alternatively, or in addition if several burglar-proofing means are provided, for example one on each side of the support structure, provision has been made to produce the burglar-proofing means, or at least one of these means. burglar deterrents, so that it includes an electrically conductive network.

This solution is considered to be favorable to deterrence given the then meshed nature of the electrical circuit constituted by this network and therefore the more random nature of the disturbances or alterations caused by the attack. Moreover, it can be provided to use different burglar-proofing means for the same batch of support structure. As indicated before, it is possible that the aforementioned assembly comprises several electronic chips.

In this case, it is advised that these chips are, at least for some, interconnected by means of control adapted so that the control means of one of the chips control the altered state or not of the burglar-proofing means. the other, or at least one other, chip to which the previous one is connected.

In addition to the foregoing, one aspect of the present invention relates to a method for detecting a burglary on at least one electronic chip and / or through a support structure of this chip to which the chip is linked, or to bind, in a location, characterized in that in view of the location of the chip on the structure, is added to this support structure, incorporating or relating thereto, a means burglar-proofing device connected to, or connected to, said conductive tracks and / or the chip and at least one physical parameter of which varies according to whether one is in a first reference state corresponding to an unaltered state of the developer means, burglary or in a second state of burglary or attempted burglary, corresponding to an altered state of this burglar proof means.

For all intents and purposes, it will be noted here that the term "burglary" refers to a real break-in or attempted break-up of the chip, on the side of its rear face directed towards its support structure.

Regarding the revelation of this break-in, two preferred approaches are in particular envisaged: either to detect said variation of the physical parameter of the burial-deterrent means between said unaltered and altered states, or to detect a variation of said physical parameter between two altered states, one being more than the other.

In order to optimize the security of the secure data in the chip to be protected, it is furthermore recommended to electrically connect the burglar-proofing means and the operating components of the chip concerned, so that an alteration of said developer means of burglary causes a malfunction of this chip. Regarding now the approach for taking into account the variation of the physical parameter of said burglar-proofing means which occurs if it is altered, it is advisable: to detect this variation,

- And trigger, from this detection, a change in operation of the chip.

In particular, the chip may stop working, or transmit, or have transmitted, a warning signal, or be altered in whole or part, or even destroy. It can also be provided that the microcontroller of the chip no longer receives a clock signal and / or power supply.

In connection with such detection, it is advisable: a) to conduct a succession of steps of detection of this physical parameter: to detect said variation of the physical parameter of the burglar-proofing means which occurs if it is altered, and that this detection triggers a modification of operation of the chip, b) - or to lead a preliminary step (to the initial operation of the chip) to record the value of this parameter:

and subsequently, performing at least one detection of said physical parameter of this burglar-proofing means while the latter is in said altered state. For autonomy of operation, it is further advised that the detection of the variation of the physical parameter is driven by at least one component of the chip.

In addition to the above, another object of the invention relates to a data storage unit, such as a smart card, a SIM card or an MMC memory, provided with an electronic chip support structure. (s) as presented above and / or an assembly between a support structure and at least one such chip, so that such a unit comprises a burglar-proofing means having all or part of the characteristics set out above and in general terms of the present description. For the sake of even more detailed information, we will now provide additional details of embodiment, by way of non-limiting examples and in relation to drawings provided for illustrative purposes only and in which: FIGS. 1 and 2 show two perspectives in exploded two secured embodiments according to the invention,

FIG. 3 schematizes the solution of FIG. 1, in the assembled and connected state of the elements shown in FIG. 1,

FIGS. 4 and 5 schematize two front views, respectively from the rear and from the front, of a chip support structure as can be found with, in addition, an illustration of a possible embodiment of a burst-detecting means as here taught, FIG. 6 corresponds to FIG. 5 with a chip in place on its support structure, FIG. 7 shows a solution with two chips side by side, and FIG. 8 schematizes a memory unit capable of receiving one of the assemblies of FIG. 3 or 6.

FIG. 1 therefore shows, in exploded and very schematically, a structure 1 support of a chip 3, the term, generic, "chip" must therefore be understood as any electronic component likely to be attacked because it contains or gives access to data to which limited, selective access has been previously defined.

In this embodiment, a burglar-proofing means (or thus an attempted burglar) 5 is interposed between the support structure 1 and the chip 3. It extends exclusively to the interface between the support structure and the chip 3, without spilling elsewhere on any other face of the chip. This means 5 is independent of the protective shield 100, burglar proofing or burglar-proofing, which protects the chip particularly on the side of its front face 3a, or even the coating, according to existing known solutions.

2, the reported burglar-proof indicator means, or witness, always marked 5, is intended to be disposed under the support structure 1, on the side of the rear face Ib of this structure opposite that, the, on the side of which the chip 3 is received on the structure 1.

As shown in FIG. 4, it is also possible, alternatively or additionally, to provide that said burglar-proofing means, again marked 5, is integrated into the support structure 1 itself.

In connection with the above, it is therefore understood that an important characteristic here is to place a physical means revealing burglary under the chip 3, assuming a vertical orientation, as in particular in Figures 1 and 2, with respect to attacks that can be conducted towards the chip 3, from the underside, or back , Ib of the support structure 1.

Figures 3 and 6, the chip 3 is in place on the support structure 1, on the side of "the upper face or front, the, of it.It is the face opposite to the face (la, fig.4 for example) visible from the outside on a smart card, such as a credit card or a phone card, so it is through this face that communication with a device or a reading system and / or external writing The chip 3 has therefore been set up at a location, here central and schematized by the outline 1 and 2, and it is at least a substantial part of this surface. covered by the chip (see FIG. 3), or even more than this surface, that will / will occupy or cover the means (s) developer (s) burglar (s), so that is interposed between the means of attack (Light ray for example, targeting the rear face Ib of the structure 1) and the chip at least one said means 5 witness of this attempted break-in.

Favorably, any means of connection, attachment or known coating between the chip 3 and the structure 1, on the side of its front face (AVT), will ensure the close connection between them, as in Figures 3 and 6, by example by means of an adhesive.

In the figures, it can be seen that the structure 1 is made from an insulating substrate or dielectric 10 and electrically conductive tracks schematized in their entirety 11 and a more realistic illustration appears in Figures 4 to 6 in particular. The substrate 10 may be a multilayer sandwich structure with a dielectric or an insulator (glass, epoxy resin, etc.) on which the electrically conductive areas or tracks 11, typically metallized, which are present on both faces Ia, Ib of the structure, will be deposited. 1, a priori in different places; see AVT and ARR faces, figs.4 to 6.

Figure 1, the bulk of the or at least one means (s) developer (s) burglar (s) 5

(materialized by the contour 50) could be greater than the total dimension of the location 30 covered by the chip 3. But this developer means 5 extends exclusively to the interface between the support structure 1 and the chip 3 (rear face 3b), without overflowing elsewhere on other face (s) of the chip. As indicated before, it is therefore by the variation of at least one physical parameter of this burglar-proofing means 5 that the break-in, or its attempt, will be revealed, this physical parameter thus varying between a first state of reference corresponding to an unaltered state and at least one second burglary state corresponding to an altered state of this burglar proof means.

Traditionally, "altered" is to be understood as a state in which the control means is structurally and / or functionally disrupted, modified or transformed. In particular, it can be imagined that a notch, an at least local break or a hole will have occurred at the location, particularly through this burglar-proofing means. As schematically shown in FIG. 3 in particular, the chip is typically electrically connected to the conductive tracks 11 of the support structure 1 by conductive elements 13.

FIG. 3, between the rear face 3b of the chip and the front face 1a of the support structure 1, there is found the burglar-proofing means 5, which is connected to the chip by the connection means schematized at 15, 16 which are generally adapted so that one can, in particular via components of this chip, detect the alteration of its chosen physical parameter and, preferably, trigger an alert and / or parry, all for the purpose of at least delay access to the secure data that are typically stored or stored in the chip 3. It is through the conductive elements 15 and its pads 16 that the burglar-proofing means 5 is connected here electrically to the conductive tracks 11 of the structure 1.

It is therefore on its upper face, or before, 3a that the chip 3 receives the electrical components provided.

Assembly with the support structure 1, the chip 3 is usually protected on the side of this front face 3a by different protective shields, both in a mechanical aspect and vis-à-vis the attempts of intrusion or break-in (Shield 100 mentioned above by example).

For the rear protection here referred to, the means (s) developer (s) burglar (s) 5 may in Particularly consist of an electrically conductive filamentary network, as in Figures 1 and 2, and / or at least one electrical circuit having meanders, as shown in Figures 4 and 5. The shape of the network may be random.

In these FIGS. 4 and 5, it has even been envisaged that the burst-detecting means 5 define a part of the conductive tracks 11 of the support structure, thus being integrated in this structure, preferably during the manufacture of the structure, whether on one side and / or on the other la, Ib of this structure.

These solutions make it possible to largely cover the sub-adjacent zone 30 opposite the rear face 3b of the chip, with however free spaces, so that a physical (or even chemical) alteration of a relatively small area of the developer means 5 will result in passing at least one of its physical parameters from the first reference state corresponding to an unaltered state to said second burglar state corresponding to an altered state of this developer means 5.

We could take into account for example a mechanical parameter (stress, pressure) or optical

(reflectivity via layers more or less opto-conductive) that a mechanical attack (cutting, drilling ....) or optical (laser beam, other selected light rays ...) disturb.

One can also think of a piezoelectric control means.

However, it is the detectable variation of at least one electrical parameter (in particular the resistance of an electrically conductive circuit or network) which is however here preferred, for the sake of reduced cost, of ease of implementation and taking into account the disturbed signal generated, for preference of a complementary action at the chip.

Indeed, as already indicated, it is preferably provided that beyond the materialization of the burglary or attempted burglary by the noticeable (irreversible) change in the physical parameter considered said tamper evidence 5 , or even of the material visualization of the attack (cut zone, mark), the alteration of this witness will lead, at the moment of the attack, not only to the detection of the induced variation of its physical parameter considered, but also at the triggering of a modification of the operation of the chip, or more generally of the carrier means which is equipped with it and which is here called "data storage unit", such as a smart card, a card SIM (subscriber identification module) or MMC (multimedia card, multimedia card).

A link, such as the two aforementioned conductive elements 15, will then connect a component or a set of electrical components 17 of the chip, or arranged on it, and the developer means 5, so that an alteration of this means Burglar revealing 5 causes a malfunction of the chip. For example, a known circuit detector of a variation of resistance may be suitable.

By the connecting means / conductive elements 15, 16 will preferably circulate both the electrical power supply of the chip and the control and / or control signals thereof. Detection of the The variation of the physical parameter of the burglar-proof means 5 may be conducted by any component or series of components 17 and / or 18 appropriate to the chip or disposed on this chip. 3, it is via these conductive electrical connection elements 15 that the detection component 17, sensitive to the variation of the electrical resistance of the developer means 5, will detect the alteration thereof, due to an attack. back, and will change the operation of the chip.

One can then predict the launch of protection instructions for certain data secured in memory, a modification of some codes, the removal of a vital signal to the operation of the chip, or even a destruction of this chip .... as effect (s) generated by the transmission to the chip of the burglary detection.

As already indicated, the detection will be favorably, either by periodic comparison between two dynamic states of the developer means 5, during operation of the chip, at different times, or between such a dynamic state and a corresponding reference state, of safely, to an unaltered state of the developer means 5 and therefore to a normal value of the physical parameter concerned. The two states can correspond to two more or less altered states, with a threshold of alteration triggering the "parry".

In each case, it is nevertheless the variation of the value detected, and / or recorded on the chip, of the parameter which will reveal the attack.

As already indicated and as shown schematically in FIG. 7, several electronic chips, such as 31, 32 may be at least some of them are provided for by means of control means 33 adapted so that the control means (35 or 37) of one of these chips control the tampered state or otherwise of the burglar-proof means 5 on the other, or at least another, chip to which it is connected.

In this case the chips are favorably located side by side on the support structure. There are therefore two chip receiving locations on the structure 1. These chips will need to communicate with each other to ensure the functionality of the system. The inter-chip communication will be done either by smart chip wiring or by connection through support tracks to which the chips will be wired. Regarding the means (s) 5 burglar-proofing, assuming that this is an electrically conductive means with electrical parameter: either a single chip (master) will ensure the integrity of the whole of the system having a single means of revealing tamper evidence comprising tracks that will cover the surfaces included under all chips (master + slaves), the slave chips may themselves be elements / parameters of the detection circuit, - or each chip will possess are own means of breaking and entering. In this case, each detection circuit will be independent and may extend, for example snake, under the chip (rear face 5b) where will not find its mechanism (its components 21) associated detection to detect any physical separation of chips between them and / or support structure 1. Regarding the embodiment of the or each burst-deterrent means, preferably at least one of the following preferred choices will be selected: a conductive paste, a conductive layer, a conductive network, a resistive element, a conductive ink , a deposit of conductive material, a conductive adhesive.

FIG. 8 shows a SIM card diagram 38 carrying chip 3 on its support structure 10.

Claims

1. Support structure adapted to receive, in at least one location (30) having a predetermined surface, at least one electronic chip (3, 31, 32), characterized in that at least opposite a substantial portion of said surface occupied by, or occupied by, the chip on the support structure (1), the latter comprises at least one means (5) burglar-proof integrated, or bonded, to this support structure and at least a physical parameter varies according to whether one is in a first reference state corresponding to an unaltered state of the burglar-proofing means or in a second state of burglary or attempted burglary, corresponding to an altered state of this revealing means of burglary.

2. Support structure according to claim 1, characterized in that the means (5) burglar-proof is electrically conductive and electrically connected to the chip (3,31,32) and / or conductive tracks (11) of which the support structure is provided.

3. Support structure according to claim 2, characterized in that said variable physical parameter is an electrical parameter of the burglar-proofing means (5), such as resistance.

4. Support structure according to claim 1, characterized in that it comprises, attached to it, on a first face (la) where the chip is received, and / or on a second opposite face (Ib), said means ( 5) burglar proof.

5. support structure according to claim 2 or one of claims 3, 4 attached to this claim 2, characterized in that the means (5) burglar-proofing: - comprises an electrically conductive network,

and / or defines a portion of the conductive tracks (11) of the support structure, and / or comprises at least one electrical circuit having meanders.

6. Assembly comprising a support structure (1) according to any one of the preceding claims, with:

at least one said electronic chip (3,31,32) disposed, by its rear face (3b) and vis-a-vis this support structure, at said predetermined surface location,

- and said means (5) burglar-proofing.

7. Assembly comprising:

a support structure (1),

at least one electronic chip (3,31,32) received, by its rear face (3b), at a location (30) of a first face of the support structure having a predetermined surface, and at least one means ( 5) burglar-proof disposed at least opposite a substantial portion of said surface occupied by the chip on the support structure and which:

* is integrated into the support structure,

* and / or is bonded to said support structure on the side of its second face (Ib) opposite to the first, * and which has at least one physical parameter which varies depending on whether one is in a first reference state corresponding to an unaltered state of the medium burglar-proofing or in a second state of burglary or attempted burglary, corresponding to an impaired state of this burglar-proofing means.

8. Assembly comprising: - a support structure (1),

at least one electronic chip (3,31,32) received, by its rear face (3b), at a location (30) of a first face of the support structure having a predetermined surface, and at least one means (5) burglar-proofing device arranged at least opposite a substantial part of said surface occupied by the chip on the support structure and which is interposed between said chip and this support structure and has at least one physical parameter which varies according to whether one is in a first reference state corresponding to an unaltered state of the burglar-proofing means or in a second state of burglary or attempted burglary, corresponding to an altered state of this revealing means of 'breaking in.

9. Assembly according to claim 6 or 8, characterized in that, placed at the interface between the support structure and the chip, the developer means (5) extends exclusively there, without overflowing elsewhere on other faces of the chip.

10. Assembly according to one of claims 6 to 9, characterized in that said developer means (5) is independent of the burglar-proof shield (s) (100) which protects (s) the chip at least on the side from its front face (3a).

11. Assembly according to one of claims 7 to 10, characterized in that it comprises several said chips (31,32) interconnected, at least for some, by control means (33) adapted so that the control means (35,37) of one of these chips control the altered state or not the medium revealing burglary of the other, or at least another, chip to which it is connected.

12. Assembly according to one of claims 7 to

11, characterized in that the burglar-proofing means (5) is electrically conductive and electrically connected to the chip (3,31,32) and / or conductive tracks (11) whose support structure is provided.

13. Assembly according to one of claims 7 to

12, characterized in that said physical parameter of the varying burglar-indicating means (5) is an electrical parameter, such as resistance.

14. Assembly according to one of claims 7 to

13, characterized in that the tamper-indicating means (5) comprises an electrically conductive network and / or defines a portion of the conductive tracks (11) whose support structure is provided.

15. Assembly according to one of claims 7 to

Characterized in that the burst-detecting means (5) is formed as at least one of a conductive paste, a conductive layer, a conductive network, a resistive element, a conductive ink, a deposit of conductive material, a conductive glue.

16. Method for detecting a break-in on at least one electronic chip (3,31,32) and / or through a structure (1) supporting this chip to which the chip is linked, or to link, at a location (30) ), characterized in that in relation to the location of the chip on the structure, is added to this support structure, in there integrating or relating thereto, tamper-indicating means (5), wherein at least one physical parameter varies depending on whether one is in a first reference state corresponding to an unaltered state of the burglar-proofing means or in a second state of burglary or attempted burglary, corresponding to an impaired state of this burglar-proofing means.

Method according to claim 16, characterized in that: - one selects:

* as a burglar-proofing means, an electrically conductive means,

* and, as a physical parameter of this burglar-proof means (5), at least one electrical parameter, such as resistance, and electrically connecting said burglar-proofing means to the chip and / or leads conductive

(11) which is provided the support structure and to which the chip is connected, or to connect.

18. The method of claim 16 or 17, characterized in that it is considered as revealing the burglary:

either said variation of the physical parameter of the means (5) revealing burglary between said unaltered and altered states,

or a variation of the physical parameter of this burst-detecting means between two altered states, one being more than the other.

19. Method according to one of claims 16 to 18, characterized in that electrically connects the means

(5) burglar proof, which is therefore electrically conductive, and operating components (17) of the chip, or disposed on it, such that tampering with said burglar-proofing means causes a malfunction of the chip.

20. Method according to one of claims 16 to 19, characterized in that: it detects said variation of the physical parameter of the means (5) burglar-proof that occurs if it is altered,

- And this detection triggers a change in operation of the chip.

21. The method of claim 20, characterized in that the step of detecting possible variation of the physical parameter of the means (5) burglar proof comprises: a succession of steps of detection of this physical parameter, staggered in the time,

and a comparison between at least two of these staggered detections.

22. Method according to claim 20, characterized in that said detection of possible variation of the physical parameter of the burglar-proof means (5) comprises: a preliminary step of recording the value of this physical parameter while the means ( 5) burglar-proof is in its unaltered state, then, at a later time, at least one detection of said physical parameter of this burglar-proofing means while the latter is in said altered state.

23. Method according to one of the claims

20 to 22, characterized in that the detection of the variation of the physical parameter of the means (5) developer tampering is conducted by at least one component (17,18) of the chip, or disposed on it.

24. Method according to any one of claims 16 to 23, characterized in that the means (5) burglar-proofing is: realized with the electrically conductive tracks (11) of the support structure in which it is integrated,

and / or attached to said structure, on the face (la) which receives the electronic chip, so that the burglar-proofing means is then interposed between the chip and the support structure, and / or on the opposite face (Ib ).

25. Data memory storage unit, such as smart card, SIM card or MMC memory, on which, according to the method according to any one of claims 16 to 24, it is possible to detect a break-in or an attempted break-in. on at least one electronic chip and / or through a structure (1) supporting this chip, the memory unit of which is provided, and / or comprising a said support structure according to any one of claims 1 to 5, and / or an assembly according to one of claims 6 to 15.