WO2021253254A1 - 芯片、芯片封装结构以及电子设备 - Google Patents

芯片、芯片封装结构以及电子设备 Download PDF

Info

Publication number
WO2021253254A1
WO2021253254A1 PCT/CN2020/096462 CN2020096462W WO2021253254A1 WO 2021253254 A1 WO2021253254 A1 WO 2021253254A1 CN 2020096462 W CN2020096462 W CN 2020096462W WO 2021253254 A1 WO2021253254 A1 WO 2021253254A1
Authority
WO
WIPO (PCT)
Prior art keywords
module
chip
detection module
security
data
Prior art date
Application number
PCT/CN2020/096462
Other languages
English (en)
French (fr)
Inventor
郭子亮
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to CN202080099575.7A priority Critical patent/CN115413339A/zh
Priority to PCT/CN2020/096462 priority patent/WO2021253254A1/zh
Publication of WO2021253254A1 publication Critical patent/WO2021253254A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/16—Protection against loss of memory contents
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G—PHYSICS
    • G11—INFORMATION STORAGE
    • G11C—STATIC STORES
    • G11C16/00—Erasable programmable read-only memories
    • G11C16/02—Erasable programmable read-only memories electrically programmable

Definitions

  • This application relates to the field of chip technology, and more specifically, to a chip, a chip packaging structure, and an electronic device.
  • this application proposes a chip, a chip packaging structure and an electronic device to solve the above-mentioned problems.
  • an embodiment of the present application provides a chip that constructs a secure area and a non-secure area, the secure area is connected to the non-secure area, and the secure area includes a storage module, a storage protection module, and a secure area.
  • Detection module the storage protection module is respectively connected with the storage module and the security detection module, the storage module stores chip data to be protected, and the storage protection module is used to perform the When the access data meets the specified authority, the chip data to be protected is transmitted to the non-secure area and output through the non-secure area, and the security detection module is used to detect power-off attacks on the chip.
  • the safe area further includes an environment detection module, the environment detection module is connected to the safety detection module, the environment detection module is used to detect environmental information of the safe area, and the safety detection module is used for When the environmental information satisfies a specified condition, the chip clock is cut off or a central processing unit interrupt is generated.
  • the security zone further includes a data destruction module, the security detection module is connected to the data destruction module, and the security detection module is further configured to control the data destruction when the environmental information meets specified conditions
  • the module eliminates the chip data to be protected.
  • the environment detection module includes a Glitch detection module
  • the security detection module is respectively connected to the Glitch detection module and the data destruction module
  • the Glitch detection module is used to detect superimposed on the power or clock signal Voltage jitter
  • the security detection module is used to control the data destruction module to eliminate the chip data to be protected when the voltage jitter superimposed on the power supply or clock signal is greater than a specified jitter.
  • the environment detection module includes a temperature detection module
  • the safety detection module is respectively connected to the temperature detection module and the data destruction module
  • the temperature detection module is used to detect the temperature of the safe zone
  • the security detection module is used to control the data destruction module to eliminate the chip data to be protected when the temperature is greater than a first specified temperature or less than a second specified temperature.
  • the environment detection module includes a frequency detection module
  • the security detection module is respectively connected to the frequency detection module and the data destruction module
  • the frequency detection module is configured to detect the clock frequency of the safe zone
  • the security detection module is configured to control the data destruction module to eliminate the chip data to be protected when the clock frequency is greater than a first designated frequency or less than a second designated frequency.
  • the environment detection module includes a photosensitive detection module
  • the security detection module is respectively connected to the photosensitive detection module and the data destruction module
  • the photosensitive detection module is configured to detect the light intensity of the safe zone
  • the security detection module is used to control the data destruction module to eliminate the chip data to be protected when the light intensity is greater than a specified light intensity.
  • the safety zone further includes a battery and a real-time clock
  • the safety detection module is respectively connected to the battery and the real-time clock
  • the battery is connected to the real-time clock
  • the battery is the real-time clock Uninterrupted power supply.
  • the safety zone further includes a plurality of communication serial ports, and the plurality of communication serial ports are respectively connected to the safety detection module.
  • the storage module includes multiple storage units, and the multiple storage units are used to store the chip data to be protected in different ways.
  • the multiple storage units include at least one of a static random access memory ARAM, an extensible firmware interface EFI, and a read-only memory ROM.
  • the security zone further includes a true random generator, the true random generator is connected to the storage protection module, and the true random generator is used to generate a true random number.
  • the security zone further includes a key encryption storage module, the key encryption storage module is connected to the security detection module, the key encryption storage module stores algorithm keys, and the security detection module also uses After encrypting the chip data to be protected by the algorithm key, the data is transmitted to the non-secure area.
  • the safe area further includes a power consumption resistance analysis security module, and the power consumption resistance analysis security module is configured to add a random number to the power consumption of the safe area in plaintext.
  • the power consumption resistance analysis security module is connected to the true random generator, and the power consumption resistance analysis security module is configured to add the random power generated by the true random generator to the power consumption of the safe area. number.
  • the security zone further includes a key anti-analysis security module, and the key anti-analysis security module is configured to add a random number to the plaintext of the algorithm key.
  • the key anti-analysis security module is connected to the true random generator, and the key anti-analysis security module is configured to add a random number generated by the true random generator to the plaintext of the algorithm key.
  • the safe area and the non-safe area are connected by a system bus.
  • an embodiment of the present application provides a chip packaging structure, including a package and the above-mentioned chip, and the chip is packaged in the package.
  • an embodiment of the present application provides an electronic device, including a device body and the aforementioned chip packaging structure, the chip packaging structure being disposed in the device body.
  • the chip constructs a secure area and a non-secure area, and the secure area and the non-secure area are connected.
  • the secure area includes a storage module, a storage protection module, and a safety detection module.
  • the storage protection modules are respectively Connected with the storage module and the security detection module, the storage module stores the chip data to be protected, and the storage protection module is used to transmit the chip data to be protected to the non-secure area when the received access data from the non-secure area meets the specified authority , And output through the non-secure area.
  • the security detection module is used to detect power-off attacks on the chip, so that the security area and the non-secure area are divided into the chip, and the chip data to be protected stored in the secure area is secured to improve The security of the chip.
  • Figure 1 shows a module block diagram of a chip provided by an embodiment of the present application
  • Fig. 2 shows a block diagram of a chip provided by another embodiment of the present application
  • FIG. 3 shows a block diagram of a chip provided by another embodiment of the present application.
  • FIG. 4 shows a block diagram of modules of a chip provided by another embodiment of the present application.
  • FIG. 5 shows a module block diagram of a chip provided by yet another embodiment of the present application.
  • FIG. 6 shows a schematic structural diagram of a chip packaging structure provided by an embodiment of the present application.
  • FIG. 7 shows a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • non-invasive attacks there are three main types of physical attacks against security chips: non-invasive attacks, invasive attacks, and semi-invasive attacks.
  • Non-intrusive attacks do not need to initialize the components or unpack the chip. During the attack, the chip can be placed in the test circuit for analysis, or the chip can be connected separately. Therefore, non-intrusive attacks are non-destructive, and there is a high probability that the chip after being attacked can continue to work normally. When attacking the chip, there is no need to pre-process the chip, even when the chip is working normally.
  • Non-intrusive attack methods include power supply voltage or clock signal jitter, that is, voltage attack, current analysis, voltage jitter Glitch attack superimposed on the power supply or clock signal, thermal attack, and power analysis methods. This kind of attack is easy to spread, and re-attack does not require a lot of overhead. In addition, the use of this attack leaves no trace. Therefore, this is considered to be the biggest threat to the hardware security of any component. At the same time, it usually takes a lot of time and energy to find non-invasive methods of attacking specific components.
  • Intrusive attacks refer to the attack methods of violently opening the chip package, dissecting the chip, and using probes to detect and modify it, mainly including micro-probe attack technology and FIB (Focused Ion Beam) attacks.
  • This attack method requires opening the package first and removing the passivation layer with a focused ion beam or laser to contact the internal wiring buried deep under the passivation layer of the chip.
  • This attack requires good equipment and experienced crackers.
  • the overhead of intrusive attacks has become more and more expensive.
  • semi-invasive attacks Compared with intrusive attacks, semi-invasive attacks also need to open the chip package, relying on the collected image signals, optical signals and other information to reversely analyze the data and operating status in the chip, but it does not need to peel off the passivation layer or create internal Interconnection, etc., does not require technical means such as micro-probes, FIB, etc. It mainly includes ultraviolet attack, backside imaging technology, laser scanning technology, and defect injection attack. Compared with intrusive attacks, semi-invasive attacks do not require expensive tools and can get results in a shorter period of time, making them more and more attractive. At the same time, a semi-invasive attack is performed on all transistors or transistors in some areas, which is more suitable for modern chips with small feature sizes.
  • TPM/TCM trusted computing platform module
  • the inventor found through research and proposed the chip, chip packaging structure, and electronic device provided by the embodiments of the present application.
  • the data is secured to enhance the security of the chip.
  • the specific chip structure and implementation process are described in detail in the subsequent embodiments.
  • FIG. 1 shows a block diagram of a chip provided by an embodiment of the present application.
  • this embodiment provides a chip 10, which constructs a secure area 100 and a non-secure area 200, and the secure area 100 and the non-secure area 200 are connected, that is, based on the secure area 100 and the non-secure area 200
  • the secure area 100 can transmit data to the non-secure area 200, and the non-secure area 200 can also transmit data to the secure area 100.
  • the secure area 100 and the non-secure area 200 may be connected by wires.
  • the secure area 100 and the non-secure area 200 may be connected by a system bus.
  • the secure area 100 may store chip data to be protected, where the chip data to be protected may include the core data of the chip (that is, the data to be obtained by the attacking chip), for example, the chip data to be protected may be Including key algorithms, algorithm keys, etc.
  • the non-secure area 200 may include chip data other than the chip data to be protected, for example, may include a communication module, etc., which is not limited herein.
  • the safe area 100 may include a storage module 101, a storage protection module 102, and a safety detection module 103, and the storage protection module 102 is connected to the storage module 101 and the safety detection module 103, respectively.
  • the storage protection module 102 may be connected to the storage module 101 through a wired connection, and the storage protection module 102 may also be connected to the security detection module 103 through a wired connection.
  • the storage protection module 102 and the security detection module 103 may be connected through a security control bus.
  • the storage module 101 can store chip data to be protected.
  • the storage module 101 may store a key algorithm
  • the key algorithm stored in the storage module may include a symmetric key algorithm and an asymmetric key algorithm.
  • the stored symmetric key algorithm may include, for example, an AES key algorithm, a DES key algorithm. Key algorithm, national secret algorithm, etc.
  • the stored asymmetric key algorithm may include, for example, SM2 key algorithm, RSA key algorithm, etc., which are not limited here.
  • the storage module 101 may include multiple storage units, and the multiple storage units are used for different storage of chip data to be protected.
  • the multiple storage units may include static random access memory ARAM, extensible firmware interface EFI, read-only memory ROM, etc., which are not limited here.
  • the multiple storage units may be respectively connected to the storage protection module 102, so as to protect the chip data to be protected stored in the multiple storage units through the storage protection module 102, respectively.
  • the multiple storage units include ARAM, EFI, and ROM
  • the ARAM, EFI, and ROM may be connected to the storage protection module 102 respectively.
  • the storage protection module 102 may be a software module or a hardware module, which is not limited herein.
  • the storage protection module 102 is configured to transmit the chip data to be protected to the non-secure area 200 and output it through the non-secure area 200 when the received access data from the non-secure area 200 meets the specified authority.
  • the chip 10 may receive access data through the non-secure area 200, and transmit the received access data through the non-secure area 200 to the secure area 100.
  • the storage protection module 102 of the secure area 100 receives the non-secure area.
  • the access number is analyzed to determine whether the received access data meets the specified authority. When the analysis result indicates that the access data meets the specified authority, it can be considered that the access data is credible.
  • the chip data to be protected requested by the access data stored in the storage module 101 is transmitted to the non-secure area 200 and output through the non-secure area 200.
  • the communication module of the non-secure area 200 receives the number of accesses and outputs the chip data to be protected. .
  • the storage protection module 102 analyzes the access data to determine whether the access data meets the specified authority may include: the storage protection module 102 analyzes the access data (such as firmware, algorithms, etc.) to obtain the data source corresponding to the access data, And judge whether the data source is a designated data source. When the judgment result indicates that the data source corresponding to the accessed data is the designated data source, it can be determined that the access data meets the specified authority. When the judgment result indicates that the data source corresponding to the accessed data is not the designated data source At the time, it can be determined that the access data does not meet the specified permissions.
  • the access data such as firmware, algorithms, etc.
  • the data source corresponding to the access data when the data source corresponding to the access data is a system application, it can be determined that the access data meets the specified permissions, and when the data source corresponding to the access data is an unauthorized third-party application, it can be determined that the access data does not meet the specified permissions.
  • the security detection module 103 may be a software module or a hardware module, which is not limited here. Wherein, the security detection module 103 can be used to detect power-off attacks on the chip, that is, the security detection module 103 can be set in the high-voltage area in the chip 10, and prevent damage to the chip 10 by detecting the power supply of the clock of the chip 10. Attack when power is off.
  • a secure area 100 and a non-secure area 200 are constructed by the chip 10, and the secure area 100 and the non-secure area 200 are connected.
  • the secure area 100 includes a storage module 101, a storage protection module 102, and a security detection module 103.
  • the module 102 is respectively connected to the storage module 101 and the security detection module 103, so that the chip 100 is divided into the secure area 100 and the non-secure area 200, and the chip data to be protected stored in the secure area 100 is securely protected to improve the chip 10 safety.
  • the secure area 100 may further include a true random generator 104, which is connected to the storage protection module 102, wherein the true random generator 104 is connected to the storage protection module 102. It can be connected via a wired connection.
  • the true random generator 104 can be used to generate true random numbers to add true random number processing to the plaintext of the protected chip data in the chip 10 to improve the chip to be protected. Data security.
  • the true random generator 104 may be TANG.
  • the safety zone 100 may also include a battery 105 and a real-time clock 106, the battery 105 is connected to the real-time clock 106, the battery 105 is connected to the safety detection module 103, and the real-time clock 106 is connected to the safety detection module 103, where the battery 105 and the real-time clock 106 can be connected by wires, the battery 105 and the safety detection module 103 can be connected by wires, and the real-time clock 106 and the safety detection module 103 can be connected by wires.
  • the battery 105 is used to provide uninterrupted power supply for the real-time clock 106 to prevent unpowered attacks on the chip 10.
  • the battery 105 can also be used to power the safety detection module 103, which is used to supply power to the battery 105 whether to detect the uninterrupted power supply of the real-time clock 106 and whether the real-time clock 106 is working normally, so as to prevent physical attacks on the chip 10.
  • the security zone 100 may also include multiple communication serial ports 107, and the multiple communication serial ports 107 are respectively connected to the security detection module 103, so as to perform security detection on the multiple communication serial ports 107 through the security detection module 103 to ensure multiple communication ports 107.
  • the communication of each communication serial port 107 achieves certain security defense measures.
  • multiple communication serial ports 107 can be connected to the security detection module 103 through wires.
  • the security zone 100 may further include a key encryption storage module 108, which is connected to the security detection module 103, the key encryption storage module 108 stores algorithm keys, and the security detection module 103 It is also used to encrypt the chip data to be protected by the algorithm key stored in the key encryption storage module 108 and transmit it to the non-secure area 200, so as to further improve the security of the chip data to be protected.
  • the chip 10 may receive access data through the non-secure area 200, and transmit the received access data through the non-secure area 200 to the secure area 100.
  • the storage protection module 102 of the secure area 100 receives the non-secure area. After the access data is transmitted in the area 200, the access number is analyzed to determine whether the received access data meets the specified authority.
  • the chip data to be protected requested by the access data stored in the storage module 101 is transmitted to the security detection module 103, and the security detection module 103 encrypts the chip data to be protected with the algorithm key stored in the storage module 108 and transmits it to the non-
  • the security area 200 is used to improve the security of chip data to be protected.
  • the security zone 100 may further include a power consumption resistance analysis security module 109.
  • the power consumption resistance analysis security module 109 is configured to add a random number to the power consumption of the security zone 100 in order to Resist power analysis side channel attacks by power consumption and adding random numbers.
  • the power consumption resistance analysis security module 109 may be connected to the true random generator 104, and further, the power consumption resistance analysis security module 109 may add the power consumption of the security zone 100 to the power consumption of the security zone 100. True random number.
  • the random process for the power consumption plaintext can include Mask XOR, S-Box processing, left half data processing, etc., for the power consumption plaintext, the correlation between the power consumption plaintext and the power consumption can be concealed randomly. Get up and play a role in defending against side-channel attacks.
  • the side-channel attack may also perform a power consumption attack on the key. If it is not enough to randomize the power consumption plaintext, the key also needs to be randomized in the plaintext. Therefore, in this embodiment, the security zone 100 may also include a key anti-analysis security module 110, which is used to add a random number to the plaintext of the algorithm key, so as to add a random number to the algorithm key. The way to analyze side channel attacks is lower than power consumption.
  • the key anti-analysis security module 110 can be connected to the true random generator 104, and further, the key anti-analysis security module 110 can add a true random number generated by the true random generator 104 to the algorithm key.
  • the key generation algorithm of Mask technology can be used to XOR the algorithm key, and the signal of the key in the entire algorithm project is also masked.
  • two 64-bit random numbers can be designed to use two 64-bit random numbers in the entire random process of the power anti-analysis security module 109 and the key anti-analysis security module 110, both of which can be generated by the true random generator 104, and each clock generates a random bit.
  • the true random number generated by the true random generator 104 is stored and remains unchanged during the entire encryption process.
  • the safety zone 100 may also include an environment detection module 111, which is connected to the safety detection module 103, wherein the environment detection module 111 and the safety detection module 103 can be connected through a wired or The wireless connection is not limited here.
  • the environment detection module 111 can be arranged on the periphery of the safe area 100 to detect the environment information of the environment in which the safe area 100 is located.
  • the safety detection module 103 is used for detecting the environment detected by the environment detection module 111. When the information meets the specified conditions, the chip clock is switched or the central processing unit interrupt is generated to improve the security of the chip 10.
  • the security zone 100 further includes a data destruction module 112, which is connected to the security detection module 103, wherein the data destruction module 112 and the security detection module 103 can be connected via wired or wireless Connection is not limited here.
  • the security detection module 103 may also be used to control the data destruction module 112 to eliminate the chip data to be protected when the environmental information detected by the environment detection module 111 meets specified conditions, so as to improve the security of the chip 10.
  • the environment detection module 111 may include a Glitch detection module 1111, a temperature detection module 1112, a frequency detection module 1113, a photosensitive detection module 1114, and the like.
  • the security detection module 103 can be connected to the Glitch detection module 1111 and the data destruction module 112 respectively, wherein the security detection module 103 and the Glitch detection module 1111 can pass through Wired connection can also be connected wirelessly, which is not limited here.
  • the glitch detection module 1111 can be arranged on the periphery of the safe area 100 to detect the voltage jitter superimposed on the power supply or clock signal. When the voltage jitter on the power supply or the clock signal is greater than the specified jitter, the data destruction module 112 is controlled to eliminate the chip data to be protected.
  • Glitch refers to the jitter of the voltage superimposed on the power supply or clock signal, that is, power Glitch attack and clock Glitch attack, or external short-term electromagnetic transients or electric field pulses.
  • Such short fluctuations in the power supply voltage will cause the threshold voltage of the transistor to drift, so that when some flip-flops are sampling, the time of each input is different, and the flip-flop enters the wrong state and performs misoperation.
  • this large jitter of the power supply voltage will cause some analog circuits to work abnormally, and the chip will output an error warning state.
  • the Glitch signal at the power supply terminal is mainly detected.
  • the structure may include three parts: a modified inverter, a comparator, and an RS latch.
  • a modified inverter When there is no Glitch attack on VCC, Reset is low level, and the above PMOS tube is turned on. Due to the existence of the diode, there is a voltage difference between the two ends of the diode, and the comparator clock outputs a low level.
  • VCC charges the capacitor through the diode and PMOS tube, and the voltage of the capacitor quickly rises to VCC minus the voltage across the diode.
  • the security detection module 103 can be connected to the temperature detection module 1112 and the data destruction module 112 respectively, wherein the security detection module 103 and the temperature detection module 1112 can pass through Wired connection can also be connected wirelessly, which is not limited here.
  • the temperature detection module 1112 may be arranged on the periphery of the safe area 100 to detect the temperature of the safe area 100.
  • the safety detection module 103 is used to detect the temperature by the temperature detection module 1112 being greater than the first specified temperature or When the temperature is less than the second specified temperature, the data destruction module 112 is controlled to eliminate the chip data to be protected.
  • the random access memory RAM is a volatile storage unit.
  • the data stored in the random access memory RAM will disappear after being stored for a short period of time.
  • the random access memory RAM is cooled to minus 50 degrees Celsius with a coolant, the data in the random access memory RAM can be stored for a long period of time like a non-volatile memory.
  • a temperature detection module 1112 is designed inside the chip 10.
  • the working principle of the temperature detection module 1112 is to utilize the characteristics of the oscillator that changes with temperature.
  • the ambient temperature is higher than 110 degrees Celsius or lower than minus 40 degrees Celsius, a high-level signal will be triggered.
  • the security detection module 103 can control the data destruction module 112 to eliminate the chip data to be protected, so as to ensure the security of various information inside the chip 10.
  • the security detection module 103 can be connected to the frequency detection module 1113 and the data destruction module 112 respectively, wherein the security detection module 103 and the frequency detection module 1113 can pass through Wired connection can also be connected wirelessly, which is not limited here.
  • the frequency detection module 1113 may be arranged on the periphery of the safe area 100 to detect the clock frequency of the safe area 100.
  • the safety detection module 103 is used to detect the clock frequency of the frequency detection module 1113 greater than the first specified When the frequency is or less than the second designated frequency, the data destruction module 112 is controlled to eliminate the chip data to be protected.
  • the chip 10 needs to prevent an attacker from maliciously cutting off or reducing the clock frequency of the high-voltage zone during the design process, otherwise the attacker can use this method to disable hardware security modules and units to carry out related attacks on the chip 10.
  • frequency detection if the working frequency of the high-voltage zone is lower or higher than 32KHZ, a high-level signal will be generated, and therefore an interrupt signal will be generated to the safety detection module 103, and the safety detection module 103 controls the data destruction module 112 to eliminate Chip data to be protected.
  • the security detection module 103 when the environment detection module 111 includes the photosensitive detection module 1114, the security detection module 103 can be connected to the photosensitive detection module 1114 and the data destruction module 112 respectively, wherein the security detection module 103 and the photosensitive detection module 1114 can pass through Wired connection can also be connected wirelessly, which is not limited here.
  • the photosensitive detection module 1114 can be arranged on the periphery of the safe area 100 to detect the light intensity of the safe area 100.
  • the safety detection module 103 is used to detect the light intensity of the light sensitive detection module 1114 greater than the specified light intensity.
  • the data destruction module 112 is controlled to eliminate the chip data to be protected.
  • the photosensitive detection module 1114 is a photodetection module designed inside the chip mainly for light attack technology, and monitors the light intensity of the working environment of the chip 10.
  • the light attack technology is to illuminate the surface of the working chip with light. Due to the intrusion of light, voltage and circuits will be generated inside the chip 10 to cause failure behavior.
  • two photoelectric conversion circuits are designed for the photodetection module, which are current comparison type and current integration type (CTIA).
  • the current comparison type does not require an external control signal. When the amplified current value of the photocurrent exceeds the internal current reference, the output signal is reversed.
  • the current integration type can achieve accurate detection of photocurrent by adjusting the area of the capacitor array and the clock frequency. When the light is small, a longer integration time is required.
  • the chip 10 provided by the embodiment of the present application constructs a secure area 100 and a non-secure area 200, and the secure area 100 and the non-secure area 200 are connected.
  • the secure area 100 includes a storage module 101, a storage protection module 102, and a security detection module 113.
  • the protection module 102 is respectively connected to the storage module 101 and the security detection module 103.
  • the storage module 101 stores chip data to be protected.
  • the storage protection module 102 is used to wait when the received access data from the non-secure area 200 meets the specified authority.
  • the protected chip data is transmitted to the non-secure area 200 and output through the non-secure area 200.
  • the security detection module 103 is used to detect power-off attacks on the chip 10, thereby dividing the chip 10 into the secure area 100 and the non-secure area 200, In addition, the chip data to be protected stored in the secure area 100 is secured, and the security of the chip 10 is improved.
  • the embodiment of the application divides the security area of the chip, each area has its own permission configuration, and protects the privacy and integrity of the chip data to be protected from the hardware, so as to ensure that the modules and users Transparency between.
  • hardware protection units such as environmental monitoring and safety monitoring are also set up in the security architecture to ensure that the internal data of the chip has a reliable and private operating environment during transmission and operation.
  • the chip’s external physical environment is monitored in real time, and a variety of sensors are integrated, which can effectively warn the chip of physical attacks and provide three-dimensional protection for the security chip.
  • the chip’s security architecture it can not only cooperate to enhance its hardware protection capabilities, but also It also ensures the security of the chip at the software level.
  • this application provides simple but effective random number protection measures, and at the same time uses the true random number generator in the architecture for fuzzing. Through this fuzzing, the attacker cannot obtain the runtime information of the algorithm. Circuit state, thereby reducing the correlation between sensitive data and circuit power consumption.
  • FIG. 6 shows a schematic diagram of a chip packaging structure provided by an embodiment of the present application.
  • this embodiment provides a chip packaging structure 20.
  • the chip packaging structure 20 includes a chip 10 and a package 21, and the chip 10 is packaged in the package 21.
  • FIG. 7 shows a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • this embodiment provides an electronic device 30 that includes a chip packaging structure 20 and a device body 31, and the chip packaging structure 20 is disposed in the device body 31.
  • the chip constructs a secure area and a non-secure area, and the secure area and the non-secure area are connected.
  • the secure area includes a storage module, a storage protection module, and a security detection module.
  • the storage protection module is respectively connected with the storage module and the security detection module, the storage module stores the chip data to be protected, and the storage protection module is used to transfer the chip data to be protected when the received access data from the non-secure area meets the specified authority Transmitted to the non-secure area, and output through the non-secure area, the security detection module is used to detect power-off attacks on the chip, thereby dividing the chip into the secure area and the non-secure area, and store the chip data to be protected in the secure area Carry out security protection to improve the security of the chip.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种芯片、芯片封装结构以及电子设备，涉及芯片技术领域。该芯片构建安全区和非安全区，安全区和非安全区连接，安全区包括存储模块、存储保护模块以及安全检测模块，存储保护模块分别与存储模块和安全检测模块连接，存储模块存储待保护的芯片数据，存储保护模块用于在接收到的来自非安全区的访问数据满足指定权限时，将待保护的芯片数据传输至非安全区，并通过非安全区输出，安全检测模块用于检测对芯片的断电攻击。本申请实施例提供的芯片、芯片封装结构以及电子设备通过对芯片进行安全区和非安全区划分，并对安全区存储的待保护的芯片数据进行安全防护，提升芯片的安全性。

Description

芯片、芯片封装结构以及电子设备 技术领域
本申请涉及芯片技术领域，更具体地，涉及一种芯片、芯片封装结构以及电子设备。
背景技术
目前，针对芯片的攻击方式有多种，严重影响芯片的安全性。
发明内容
鉴于上述问题，本申请提出了一种芯片、芯片封装结构以及电子设备，以解决上述问题。
第一方面，本申请实施例提供了一种芯片，所述芯片构建安全区和非安全区，所述安全区和所述非安全区连接，所述安全区包括存储模块、存储保护模块以及安全检测模块，所述存储保护模块分别与所述存储模块和所述安全检测模块连接，所述存储模块存储待保护的芯片数据，所述存储保护模块用于在接收到的来自所述非安全区的访问数据满足指定权限时，将所述待保护的芯片数据传输至所述非安全区，并通过所述非安全区输出，所述安全检测模块用于检测对所述芯片的断电攻击。
可选地，所述安全区还包括环境检测模块，所述环境检测模块与所述安全检测模块连接，所述环境检测模块用于检测所述安全区的环境信息，所述安全检测模块用于在所述环境信息满足指定条件时，切断芯片时钟或产生中央处理器中断。
可选地，所述安全区还包括数据销毁模块，所述安全检测模块和所述数据销毁模块连接，所述安全检测模块还用于在所述环境信息满足指定条件时，控制所述数据销毁模块消除所述待保护的芯片数据。
可选地，所述环境检测模块包括Glitch检测模块，所述安全检测模块分别与所述Glitch检测模块和所述数据销毁模块连接，所述Glitch检测模块用于检测叠加在电源或时钟信号上的电压抖动，所述安全检测模块用于在所述叠加在电源或时钟信号上的电压抖动大于指定抖动时，控制所述数据销毁模块消除所述待保护的芯片数据。
可选地，所述环境检测模块包括温度检测模块，所述安全检测模块分别与所述温度检测模块和所述数据销毁模块连接，所述温度检测模块用于检测所述安全区的温度，所述安全检测模块用于在所述温度大于第一指定温度或小于第二指定温度时，控制所述数据销毁模块消除所述待保护的芯片数据。
可选地，所述环境检测模块包括频率检测模块，所述安全检测模块分别与所述频率检测模块和所述数据销毁模块连接，所述频率检测模块用于检测所述安全区的时钟频率，所述安全检测模块用于在所述时钟频率大于第一指定频率或小于第二指定频率时，控制所述数据销毁模块消除所述待保护的芯片数据。
可选地，所述环境检测模块包括光敏检测模块，所述安全检测模块分别与所述光敏检测模块和所述数据销毁模块连接，所述光敏检测模块用于检测所述安全区的光照强度，所述安全检测模块用于在所述光照强度大于指定光照强度时，控制所述数据销毁模块消除所述待保护的芯片数据。
可选地，所述安全区还包括电池和实时时钟，所述安全检测模块分别与所述电池和所述实时时钟连接，所述电池与所述实时时钟连接，所述电池为所述实时时钟不间断供电。
可选地，所述安全区还包括多个通讯串口，所述多个通讯串口分别与所述安全检测模块连接。
可选地，所述存储模块包括多个存储单元，所述多个存储单元用于对所述待保护的芯片数据进行不同的存储。
可选地，所述多个存储单元包括静态随机存取存储器ARAM、可扩展固件接口EFI以及只读存储器ROM中的至少一种。
可选地，所述安全区还包括真随机发生器，所述真随机发生器与所述存储保护模块连接，所述真随机发生器用于产生真随机数。
可选地，所述安全区还包括密钥加密存储模块，所述密钥加密存储模块与所述安全检测模块连接，所述密钥加密存储模块存储算法密钥，所述安全检测模块还用于通过所述算法密钥将所述待保护的芯片数据加密后传输至所述非安全区。
可选地，所述安全区还包括功耗抗分析安全模块，所述功耗抗分析安全模块用于对所述安全区的功耗明文添加随机数。
可选地，所述功耗抗分析安全模块与所述真随机发生器连接，所述功耗抗分析安全模块用于对所述安全区的功耗明文添加所述真随机发生器产生的随机 数。
可选地，所述安全区还包括密钥抗分析安全模块，所述密钥抗分析安全模块用于对所述算法密钥明文添加随机数。
可选地，所述密钥抗分析安全模块与所述真随机发生器连接，所述密钥抗分析安全模块用于对所述算法密钥明文添加所述真随机发生器产生的随机数。
可选地，所述安全区和所述非安全区通过系统总线连接。
第二方面，本申请实施例提供了一种芯片封装结构，包括封装件和上述芯片，所述芯片封装于所述封装件中。
第三方面，本申请实施例提供了一种电子设备，包括设备本体和上述芯片封装结构，所述芯片封装结构设置于所述设备本体内。
本申请实施例提供的芯片、芯片封装结构以及电子设备，芯片构建安全区和非安全区，安全区和非安全区连接，安全区包括存储模块、存储保护模块以及安全检测模块，存储保护模块分别与存储模块和安全检测模块连接，存储模块存储待保护的芯片数据，存储保护模块用于在接收到的来自非安全区的访问数据满足指定权限时，将待保护的芯片数据传输至非安全区，并通过非安全区输出，安全检测模块用于检测对芯片的断电攻击，从而通过对芯片进行安全区和非安全区划分，并对安全区存储的待保护的芯片数据进行安全防护，提升芯片的安全性。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1示出了本申请一个实施例提供的芯片的模块框图；
图2示出了本申请又一个实施例提供的芯片的模块框图；
图3示出了本申请再一个实施例提供的芯片的模块框图；
图4示出了本申请另一个实施例提供的芯片的模块框图；
图5示出了本申请又再一个实施例提供的芯片的模块框图；
图6示出了本申请实施例提供的芯片封装结构的结构示意图；
图7示出了本申请实施例提供的电子设备的结构示意图。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
目前，针对安全芯片的物理攻击方式主要有非侵入式攻击、侵入式攻击、半侵入式攻击三种。
非侵入式攻击不需要对元器件进行初始化或解除芯片的封装。攻击时可以把芯片放在测试电路中分析，也可单独连接芯片。因此非侵入式攻击是非破坏性的，被攻击后的芯片有很大的几率可以继续正常工作。对芯片实施攻击时，无需对芯片做预处理，甚至在芯片正常工作时即可进行。非侵入式攻击方法有电源电压或者时钟信号的抖动，即电压攻击、电流分析、叠加在电源或时钟信号上的电压抖动Glitch攻击、热攻击以及功耗分析方法等。这种攻击很容易普及，并且重新进行攻击不需要很大的开销。另外，使用这种攻击不会留下痕迹。因此，这被认为是对任意元器件的硬件安全最大的威胁。同时，通常需要很多时间和精力来寻找对特定元器件的非侵入式攻击方法。
侵入式攻击是指对芯片进行暴力打开芯片封装、解剖，并使用探针检测并修改的攻击手段，主要包括微探针攻击技术以及FIB(Focused Ion Beam)攻击等。这种攻击方式，首先需要打开封装，并用聚焦离子束或激光除去钝化层，用以接触深埋在芯片钝化层下的内部连线。这种攻击需要良好的装备和经验丰富的破解者。同时，随着特征尺寸的减小和器件复杂度的提高，侵入式攻击的开销越来越昂贵。
半侵入式攻击相比侵入式攻击，也需要打开芯片封装，依靠收集的图像信号、光信号等信息反向分析芯片内数据与运行状态的攻击手段，但并不需要剥离钝化层或者创建内部互联等，不需要微探针、FIB等技术手段，主要包含紫外线攻击、背面成像技术、激光扫描技术、缺陷注入攻击。相比侵入式攻击，半侵入式攻击不需要昂贵的工具，且能在较短的时间内得到结果，使之变得越来越有吸引力。同时，对所有晶体管或部分区域的晶体管进行半侵入式攻击，这对现代小特征尺寸的芯片比较适合。
发明人经过研究发现，目前芯片的常规设置方法包括：安全启动及安全协同处理器-简单的密码学功能实现；基于SoC系统架构设计；可信计算平台模块TPM/TCM。其中，TPM/TCM是高端SoC系统架构最为重要的代表。 传统芯片只是进行信息加密，提供简单的数据私密性防护，然后对芯片中的部分单元提供单一的安全防护功能。然而，随着微电子技术的日新月异，新的攻击技术层出不穷，攻击技术与抗攻击技术处在一个相互制约、动态发展的过程当中，目前芯片采用的防护技术，不能一劳永逸的解决芯片的数据防护问题。
针对上述问题，发明人经过研究发现，并提出了本申请实施例提供的芯片、芯片封装结构以及电子设备，通过对芯片进行安全区和非安全区划分，并对安全区存储的待保护的芯片数据进行安全防护，提升芯片的安全性。其中，具体地芯片结构和实现过程在后续的实施例中进行详细的说明。
请参阅图1，图1示出了本申请一个实施例提供的芯片的模块框图。如图1所示，本实施例提供了一种芯片10，该芯片10构建安全区100和非安全区200，安全区100和非安全区200连接，即，基于安全区100和非安全区200的连接，安全区100可以将数据传输至非安全区200，非安全区200也可以将数据传输至安全区100。
在一些实施方式中，该安全区100和非安全区200可以通过有线连接，例如，安全区100和非安全区200可以通过系统总线连接。
在一些实施方式中，该安全区100可以存储待保护的芯片数据，其中，该待保护的芯片数据可以包括芯片的核心数据(即攻击芯片欲获取的数据)，例如，待保护的芯片数据可以包括密钥算法、算法密钥等。该非安全区200可以包括芯片除待保护的芯片数据之外的其他数据，例如，可以包括通信模块等，在此不做限定。
在一些实施方式中，安全区100可以包括存储模块101、存储保护模块102以及安全检测模块103，存储保护模块102分别与存储模块101和安全检测模块103连接。其中，存储保护模块102可以与存储模块101通过有线连接，存储保护模块102也可以与安全检测模块103通过有线连接，例如，存储保护模块102与安全检测模块103可以通过安全控制总线连接。
在一些实施方式中，该存储模块101可以存储待保护的芯片数据。例如，存储模块101可以存储密钥算法，且存储模块存储的密钥算法可以包括对称密钥算法和非对称密钥算法，其中，存储的对称密钥算法例如可以包括AES密钥算法、DES密钥算法、国密算法等，存储的非对称密钥算法例如可以包括SM2密钥算法、RSA密钥算法等，在此不做限定。
在一些实施方式中，该存储模块101可以包括多个存储单元，且多个存储单元用于对待保护的芯片数据进行不同的存储。例如，该多个存储单元可以包括静态随机存取存储器ARAM、可扩展固件接口EFI、只读存储器ROM等，在此不做限定。其中，该多个存储单元可以分别与存储保护模块102连接，以通过存储保护模块102分别对多个存储单元存储的待保护的芯片数据进行保护。例如，当多个存储单元包括ARAM、EFI、ROM时，则ARAM、EFI、ROM可以分别与存储保护模块102连接。
在一些实施方式中，该存储保护模块102可以是软件模块、也可以是硬件模块，在此不做限定。其中，该存储保护模块102用于在接收到的来自非安全区200的访问数据满足指定权限时，将待保护的芯片数据传输至非安全区200，并通过非安全区200输出。作为一种实施方式，芯片10可以通过非安全区200接收访问数据，并将通过非安全区200将接收到的访问数据传输至安全区100，安全区100的存储保护模块102在接收到非安全区200传输的访问数据后，对访问数进行分析以判断接收到的访问数据是否满足指定权限，其中，当分析结果表征访问数据满足指定权限时，可以认为访问数据是可信的，则可以将存储模块101存储的访问数据所请求的待保护的芯片数据传输至非安全区200，并通过非安全区200输出，例如，通过非安全区200的通信模块接收访问数和输出待保护的芯片数据。
在一些实施方式中，存储保护模块102对访问数据进行分析，判断访问数据是否满足指定权限可以包括：存储保护模块102对访问数据(如固件、算法等)进行分析获取访问数据对应的数据来源，并判断数据来源是否为指定数据来源，其中，当判断结果表征访问数据对应的数据来源是指定数据来源时，可以确定访问数据满足指定权限，当判断结果表征访问数据对应的数据来源不是指定数据来源时，可以确定访问数据不满足指定权限。例如，当访问数据对应的数据来源是系统应用时，可以确定访问数据满足指定权限，当访问数据对应的数据来源是未授权的第三方应用时，可以确定访问数据不满足指定权限。
在一些实施方式中，该安全检测模块103可以是软件模块、也可以是硬件模块，在此不做限定。其中，该安全检测模块103可以用于检测对芯片的断电攻击，即，该安全检测模块103可以设置于芯片10内的高压区域，通过对芯片10的时钟进行供电检测的方式预防对芯片10进行不通电时的攻击。
因此，本申请实施例通过将芯片10构建安全区100和非安全区200，安全区100和非安全区200连接，安全区100包括存储模块101、存储保护模块102以及安全检测模块103，存储保护模块102分别与存储模块101和安全检测模块103连接，从而通过对芯片100进行安全区100和非安全区200划分，并对安全区100存储的待保护的芯片数据进行安全防护，提升芯片10的安全性。
请参阅图2，图2示出了本申请又一个实施例提供的芯片的模块框图。如图2所示，在一些实施方式中，该安全区100还可以包括真随机发生器104，该真随机发生器104与存储保护模块102连接，其中，真随机发生器104与存储保护模块102可以通过有线连接，于本实施例中，该真随机发生器104可以用于产生真随机数，以对芯片10中的带保护的芯片数据的明文添加真随机数处理，以提升待保护的芯片数据的安全性。作为一种可实施的方式，该真随机发生器104可以为TANG。
在一些实施方式中，该安全区100还可以包括电池105和实时时钟106，电池105和实时时钟106连接，电池105和安全检测模块103连接，实时时钟106和安全检测模块103连接，其中，电池105和实时时钟106可以通过有线连接，电池105和安全检测模块103可以通过有线连接，实时时钟106和安全检测模块103可以通过有线连接。于本实施例中，该电池105用于为实时时钟106不间断供电预防对芯片10进行不通电的攻击，电池105也可以用于为安全检测模块103供电，该安全检测模块103用于对电池105是否对实时时钟106进行不间断供电进行检测，以及对实时时钟106是否正常工作进行检测，以防止对芯片10进行的物理攻击。
在一些实施方式中，该安全区100还可以包括多个通讯串口107，多个通讯串口107分别与安全检测模块103连接，以通过安全检测模块103对多个通讯串口107进行安全检测，确保多个通讯串口107的通信达到一定的安全防御措施。其中，多个通讯串口107可以通过有线与安全检测模块103连接。
在一些实施方式中，该安全区100还可以包括密钥加密存储模块108，密钥加密存储模块108与安全检测模块103连接，该密钥加密存储模块108存储算法密钥，该安全检测模块103还用于通过密钥加密存储模块108存储的算法密钥将待保护的芯片数据进行加密后传输至非安全区200，以进一步 提升待保护的芯片数据的安全性。作为一种实施方式，芯片10可以通过非安全区200接收访问数据，并将通过非安全区200将接收到的访问数据传输至安全区100，安全区100的存储保护模块102在接收到非安全区200传输的访问数据后，对访问数进行分析以判断接收到的访问数据是否满足指定权限，其中，当分析结果表征访问数据满足指定权限时，可以认为访问数据是可信的，则可以将存储模块101存储的访问数据所请求的待保护的芯片数据传输至安全检测模块103，安全检测模块103通过密钥加密存储模块108存储的算法密钥将待保护的芯片数据进行加密后传输至非安全区200，以提升待保护的芯片数据的安全性。
请参阅图3，图3示出了本申请再一个实施例提供的芯片的模块框图。如图3所示，在一些实施方式中，该安全区100还可以包括功耗抗分析安全模块109，该功耗抗分析安全模块109用于对安全区100的功耗明文添加随机数，以通过功耗及添加随机数的方式来抵御功耗分析侧信道攻击。在一些实施方式中，该功耗抗分析安全模块109可以与真随机发生器104连接，进而，该功耗抗分析安全模块109可以对安全区100的功耗明文添加真随机发生器104产生的真随机数。作为一种可实施的方式，对功耗明文的随机过程可以包括Mask异或、S-Box处理、左半部分数据处理等，对功耗明文随机能把功耗明文与功耗的相关性掩盖起来，起到防御侧信道攻击的作用。
其中，侧信道攻击还可能对密钥进行功耗攻击，如果仅对功耗明文随机是不够的，还需要对密钥也进行明文随机处理。因此，在本实施例中，安全区100还可以包括密钥抗分析安全模块110，该密钥抗分析安全模块110用于对算法密钥明文添加随机数，以通过对算法密钥添加随机数的方式来低于功耗分析侧信道攻击。在一些实施方式中，该密钥抗分析安全模块110可以与真随机发生器104连接，进而，该密钥抗分析安全模块110可以对算法密钥添加真随机发生器104产生的真随机数。作为一种可实施的方式，可以采用Mask技术的密钥生成算法对算法密钥进行异或，整个算法工程中密钥的信号也被掩盖了。
其中，对于功耗抗分析安全模块109和密钥抗分析安全模块110的整个随机过程中可以设计使用两个64位随机数，均可以有真随机发生器104生成，每个时钟产生一位随机数，当每次加密开始时，将真随机发生器104产生的真随机数存储起来，在整个加密过程中保持不变。
请参阅图4，图4示出了本申请另一个实施例提供的芯片的模块框图。如图4所示，该安全区100还可以包括环境检测模块111，该环境检测模块111与安全检测模块103连接，其中，该环境检测模块111与安全检测模块103可以通过有线连接，也可以通过无线连接，在此不做限定。在一些实施方式中，该环境检测模块111可以布设于安全区100的外围，以对安全区100所处环境的环境信息进行检测，该安全检测模块103用于在环境检测模块111检测到的环境信息满足指定条件时，切换芯片时钟或者产生中央处理器中断，以提升芯片10的安全性。
在一些实施方式中，该安全区100还包括数据销毁模块112，该数据销毁模块112与安全检测模块103连接，其中，该数据销毁模块112与安全检测模块103可以通过有线连接，也可以通过无线连接，在此不做限定。在本实施例中，该安全检测模块103还可以用于在环境检测模块111检测到的环境信息满足指定条件时，控制数据销毁模块112消除待保护的芯片数据，以提升芯片10的安全性。
请参阅图5，图5示出了本申请又再一个实施例提供的芯片的模块框图。如图5所示，该环境检测模块111可以包括Glitch检测模块1111、温度检测模块1112、频率检测模块1113以及光敏检测模块1114等。
在一些实施方式中，当环境检测模块111包括Glitch检测模块1111时，该安全检测模块103可以分别与Glitch检测模块1111和数据销毁模块112连接，其中，安全检测模块103与Glitch检测模块1111可以通过有线连接，也可以通过无线连接，在此不做限定。在一些实施方式中，Glitch检测模块1111可以布设于安全区100的外围，以对叠加在电源或时钟信号上的电压抖动进行检测，该安全检测模块103用于在Glitch检测模块1111检测到的叠加在电源或时钟信号上的电压抖动大于指定抖动时，控制数据销毁模块112消除待保护的芯片数据。
其中，Glitch是指叠加在电源或者时钟信号上的电压的抖动，即电源Glitch攻击和时钟Glitch攻击，或者是外接的短暂电磁瞬变或电场脉冲等。电源电压上这种短暂的波动会导致晶体管的阂值电压的漂移，使得一些触发器在采样的时候，各个输入的时间不同，触发器进入错误的状态，进行误操作。对于抗物理攻击安全芯片本身来说，这种电源电压的较大抖动，会使得部分模拟电路工作异常，芯片输出错误的预警状态。
于本实施例中，主要检测电源端的Glitch信号，该结构可以包括3个部分：修改的反相器、比较器和RS锁存器。当VCC没有Glitch攻击时，Reset为低电平，上面PMOS管导通，由于二极管的存在，二极管的两端存在电压差，比较器时钟输出低电平。当VCC出现高电平的Glitch时，在Glitch的电平上升期间，VCC通过二极管和PMOS管给电容充电，电容的电压很快上升至VCC减去二极管两端的电压，当Glitch的电平下降期间，由于电容放电时间较慢，比较器正端电压会高于VCC的情况，比较器输出高电平，经过后面的RS锁存器输出到ALARM，从而检测出Glitch的攻击。这种方法控制时序简单，兼容CMOS工艺且对工艺的变化不敏感，检测快速变化的Glitch正脉冲、负脉冲，抗干扰能力强。
在一些实施方式中，当环境检测模块111包括温度检测模块1112时，该安全检测模块103可以分别与温度检测模块1112和数据销毁模块112连接，其中，安全检测模块103与温度检测模块1112可以通过有线连接，也可以通过无线连接，在此不做限定。在一些实施方式中，温度检测模块1112可以布设于安全区100的外围，对安全区100的温度进行检测，该安全检测模块103用于在温度检测模块1112检测到的温度大于第一指定温度或小于第二指定温度时，控制数据销毁模块112消除待保护的芯片数据。
其中，随机存储器RAM是一个易失性的存储单元，当硬件电路断电之后，随机存储器RAM中保存的数据会在保存很短的一段时间后消失。但如果用冷却剂将随机存储器RAM冷却至零下50摄氏度时，随机存储器RAM中的数据就可以像非易失性存储器一样保存很长一段时间。那么如果芯片10在运行过程中有部分敏感信息暂存在随机存储器RAM中的时候，攻击者就可以利用该物理特性对芯片实施攻击。为了防止攻击者利用这种低温手段得到芯片10内部的敏感信息，在芯片10内部设计了温度检测模块1112，该温度检测模块1112的工作原理是利用振荡器会随着温度变化而变化的特性。当环境温度高于110摄氏度或低于零下40摄氏度时，会触发一个高电平信号。当该信号为高时，安全检测模块103可以控制数据销毁模块112消除待保护的芯片数据，从而保证芯片10内部各信息的安全。
在一些实施方式中，当环境检测模块111包括频率检测模块1113时，该安全检测模块103可以分别与频率检测模块1113和数据销毁模块112连接，其中，安全检测模块103与频率检测模块1113可以通过有线连接，也可 以通过无线连接，在此不做限定。在一些实施方式中，频率检测模块1113可以布设于安全区100的外围，对安全区100的时钟频率进行检测，该安全检测模块103用于在频率检测模块1113检测到的时钟频率大于第一指定频率或小于第二指定频率时，控制数据销毁模块112消除待保护的芯片数据。
其中，芯片10在设计过程中需要防止有攻击者恶意切断或降低高压区的时钟频率的行为，否则攻击者就可以利用该手段使硬件安全模块和单元失效从而对芯片10实施相关攻击。当使用频率检测时，如果高压区的工作频率低于或高于32KHZ，就会产生一个高电平信号，并因此产生一个中断信号给安全检测模块103，安全检测模块103控制数据销毁模块112消除待保护的芯片数据。
在一些实施方式中，当环境检测模块111包括光敏检测模块1114时，该安全检测模块103可以分别与光敏检测模块1114和数据销毁模块112连接，其中，安全检测模块103与光敏检测模块1114可以通过有线连接，也可以通过无线连接，在此不做限定。在一些实施方式中，光敏检测模块1114可以布设于安全区100的外围，对安全区100的光照强度进行检测，该安全检测模块103用于在光敏检测模块1114测到的光照强度大于指定光照强度时，控制数据销毁模块112消除待保护的芯片数据。
其中，光敏检测模块1114为主要针对光攻击技术在芯片内部设计光电探测模块，对芯片10工作环境的光照强度进行监控。当芯片10遭遇光攻击时，可以迅速测得光照改变并把信息发送至安全检测模块103，发出警报。光攻击技术是用光照射正在工作的芯片表面，由于光的入侵，芯片10的内部会产生电压和电路从而导致失效行为。在本实施例中，针对光电探测模块设计了两种光电转换电路，分别是电流比较型、电流积分型(CTIA)。电流比较型不需要外加控制信号，当光电流经过放大之后的电流值超过内部电流基准，发生输出信号的翻转。电流积分型可以通过调节电容阵列的面积和时钟频率实现光电流的精确检测，当光照较小时，需要更长的积分时间。
本申请实施例提供的芯片10，芯片10构建安全区100和非安全区200，安全区100和非安全区200连接，安全区100包括存储模块101、存储保护模块102以及安全检测模块113，存储保护模块102分别与存储模块101和安全检测模块103连接，存储模块101存储待保护的芯片数据，存储保护模块102用于在接收到的来自非安全区200的访问数据满足指定权限时，将待 保护的芯片数据传输至非安全区200，并通过非安全区200输出，安全检测模块103用于检测对芯片10的断电攻击，从而通过对芯片10进行安全区100和非安全区200划分，并对安全区100存储的待保护的芯片数据进行安全防护，提升芯片10的安全性。
即，本申请实施例对芯片进行了安全区划分，每个区域都有各自的权限配置，从硬件上保护待保护的芯片数据的私密性和完整性，做到各模块之间以及模块与用户之间的透明化。另外在安全架构中还设置了环境监测及安全监测等硬件防护单元，保证芯片内部数据在传输和运行过程有一个可靠私密的运行环境。对芯片的外部物理环境进行了实时监测，集合了多种传感器，可以有效地预警芯片遭受的物理攻击，为安全芯片提供立体防护，同时配合芯片的安全架构，不仅可以协作提升其硬件防护能力，也保证了芯片在软件层面的安全。针对功耗分析攻击的相关安全问题，本申请提供了简单但有效的随机数防护措施，同时利用架构中的真随机数发生器进行模糊处理，通过该模糊处理，攻击者不能获取算法运行时的电路状态，从而降低敏感数据与电路功耗之间的相关性。
请参阅图6，图6示出了本申请实施例提供的芯片封装结构的示意图。如图6所示，本实施例提供了一种芯片封装结构20，该芯片封装结构20包括芯片10和封装件21，该芯片10封装于该封装件21中。
请参阅图7，图7示出了本申请实施例提供的电子设备的结构示意图。如图7所示，本实施例提供了一种电子设备30，该电子设备30包括芯片封装结构20和设备本体31，该芯片封装结构20设置于设备本体31内。
综上所述，本申请实施例提供的芯片、芯片封装结构以及电子设备，芯片构建安全区和非安全区，安全区和非安全区连接，安全区包括存储模块、存储保护模块以及安全检测模块，存储保护模块分别与存储模块和安全检测模块连接，存储模块存储待保护的芯片数据，存储保护模块用于在接收到的来自非安全区的访问数据满足指定权限时，将待保护的芯片数据传输至非安全区，并通过非安全区输出，安全检测模块用于检测对芯片的断电攻击，从而通过对芯片进行安全区和非安全区划分，并对安全区存储的待保护的芯片数据进行安全防护，提升芯片的安全性。
最后应说明的是：以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术 人员当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不驱使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (20)

  1. 一种芯片，其特征在于，所述芯片构建安全区和非安全区，所述安全区和所述非安全区连接，所述安全区包括存储模块、存储保护模块以及安全检测模块，所述存储保护模块分别与所述存储模块和所述安全检测模块连接，所述存储模块存储待保护的芯片数据，所述存储保护模块用于在接收到的来自所述非安全区的访问数据满足指定权限时，将所述待保护的芯片数据传输至所述非安全区，并通过所述非安全区输出，所述安全检测模块用于检测对所述芯片的断电攻击。
  2. 根据权利要求1所述的芯片，其特征在于，所述安全区还包括环境检测模块，所述环境检测模块与所述安全检测模块连接，所述环境检测模块用于检测所述安全区的环境信息，所述安全检测模块用于在所述环境信息满足指定条件时，切断芯片时钟或产生中央处理器中断。
  3. 根据权利要求2所述的芯片，其特征在于，所述安全区还包括数据销毁模块，所述安全检测模块和所述数据销毁模块连接，所述安全检测模块还用于在所述环境信息满足指定条件时，控制所述数据销毁模块消除所述待保护的芯片数据。
  4. 根据权利要求3所述的芯片，其特征在于，所述环境检测模块包括Glitch检测模块，所述安全检测模块分别与所述Glitch检测模块和所述数据销毁模块连接，所述Glitch检测模块用于检测叠加在电源或时钟信号上的电压抖动，所述安全检测模块用于在所述叠加在电源或时钟信号上的电压抖动大于指定抖动时，控制所述数据销毁模块消除所述待保护的芯片数据。
  5. 根据权利要求3或4所述的芯片，其特征在于，所述环境检测模块包括温度检测模块，所述安全检测模块分别与所述温度检测模块和所述数据销毁模块连接，所述温度检测模块用于检测所述安全区的温度，所述安全检测模块用于在所述温度大于第一指定温度或小于第二指定温度时，控制所述数据销毁模块消除所述待保护的芯片数据。
  6. 根据权利要求3-5任一项所述的芯片，其特征在于，所述环境检测模块包括频率检测模块，所述安全检测模块分别与所述频率检测模块和所述数据销毁模块连接，所述频率检测模块用于检测所述安全区的时钟频率，所述安全检测模块用于在所述时钟频率大于第一指定频率或小于第二指定频率时，控制所 述数据销毁模块消除所述待保护的芯片数据。
  7. 根据权利要求3-6任一项所述的芯片，其特征在于，所述环境检测模块包括光敏检测模块，所述安全检测模块分别与所述光敏检测模块和所述数据销毁模块连接，所述光敏检测模块用于检测所述安全区的光照强度，所述安全检测模块用于在所述光照强度大于指定光照强度时，控制所述数据销毁模块消除所述待保护的芯片数据。
  8. 根据权利要求1-7任一项所述的芯片，其特征在于，所述安全区还包括电池和实时时钟，所述安全检测模块分别与所述电池和所述实时时钟连接，所述电池与所述实时时钟连接，所述电池为所述实时时钟不间断供电。
  9. 根据权利要求1-8任一项所述的芯片，其特征在于，所述安全区还包括多个通讯串口，所述多个通讯串口分别与所述安全检测模块连接。
  10. 根据权利要求1-9任一项所述的芯片，其特征在于，所述存储模块包括多个存储单元，所述多个存储单元用于对所述待保护的芯片数据进行不同的存储。
  11. 根据权利要求10所述的芯片，其特征在于，所述多个存储单元包括静态随机存取存储器ARAM、可扩展固件接口EFI以及只读存储器ROM中的至少一种。
  12. 根据权利要求1-11任一项所述的芯片，其特征在于，所述安全区还包括真随机发生器，所述真随机发生器与所述存储保护模块连接，所述真随机发生器用于产生真随机数。
  13. 根据权利要求12所述的芯片，其特征在于，所述安全区还包括密钥加密存储模块，所述密钥加密存储模块与所述安全检测模块连接，所述密钥加密存储模块存储算法密钥，所述安全检测模块还用于通过所述算法密钥将所述待保护的芯片数据加密后传输至所述非安全区。
  14. 根据权利要求13所述的芯片，其特征在于，所述安全区还包括功耗抗分析安全模块，所述功耗抗分析安全模块用于对所述安全区的功耗明文添加随机数。
  15. 根据权利要求14所述的芯片，其特征在于，所述功耗抗分析安全模块与所述真随机发生器连接，所述功耗抗分析安全模块用于对所述安全区的功耗明文添加所述真随机发生器产生的随机数。
  16. 根据权利要求13-15任一项所述的芯片，其特征在于，所述安全区还包括密钥抗分析安全模块，所述密钥抗分析安全模块用于对所述算法密钥明文添加随机数。
  17. 根据权利要求16所述的芯片，其特征在于，所述密钥抗分析安全模块与所述真随机发生器连接，所述密钥抗分析安全模块用于对所述算法密钥明文添加所述真随机发生器产生的随机数。
  18. 根据权利要求1-17任一项所述的芯片，其特征在于，所述安全区和所述非安全区通过系统总线连接。
  19. 一种芯片封装结构，其特征在于，包括封装件和权利要求1-18任一项所述的芯片，所述芯片封装于所述封装件中。
  20. 一种电子设备，其特征在于，包括设备本体和权利要求19所述的芯片封装结构，所述芯片封装结构设置于所述设备本体内。
PCT/CN2020/096462 2020-06-17 2020-06-17 芯片、芯片封装结构以及电子设备 WO2021253254A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080099575.7A CN115413339A (zh) 2020-06-17 2020-06-17 芯片、芯片封装结构以及电子设备
PCT/CN2020/096462 WO2021253254A1 (zh) 2020-06-17 2020-06-17 芯片、芯片封装结构以及电子设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/096462 WO2021253254A1 (zh) 2020-06-17 2020-06-17 芯片、芯片封装结构以及电子设备

Publications (1)

Publication Number Publication Date
WO2021253254A1 true WO2021253254A1 (zh) 2021-12-23

Family

ID=79268835

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/096462 WO2021253254A1 (zh) 2020-06-17 2020-06-17 芯片、芯片封装结构以及电子设备

Country Status (2)

Country Link
CN (1) CN115413339A (zh)
WO (1) WO2021253254A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115694813A (zh) * 2022-12-30 2023-02-03 三未信安科技股份有限公司 一种多芯片密钥管理系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101281563A (zh) * 2007-04-04 2008-10-08 李代甫 一种带使用计数器的数字签名装置
US20130268740A1 (en) * 2012-04-04 2013-10-10 Rackspace Us, Inc. Self-Destructing Files in an Object Storage System
CN103679011A (zh) * 2012-09-20 2014-03-26 瑞萨电子株式会社 半导体集成电路
CN103778959A (zh) * 2012-10-23 2014-05-07 三星电子株式会社 数据存储设备、控制器以及数据存储设备的操作方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101281563A (zh) * 2007-04-04 2008-10-08 李代甫 一种带使用计数器的数字签名装置
US20130268740A1 (en) * 2012-04-04 2013-10-10 Rackspace Us, Inc. Self-Destructing Files in an Object Storage System
CN103679011A (zh) * 2012-09-20 2014-03-26 瑞萨电子株式会社 半导体集成电路
CN103778959A (zh) * 2012-10-23 2014-05-07 三星电子株式会社 数据存储设备、控制器以及数据存储设备的操作方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115694813A (zh) * 2022-12-30 2023-02-03 三未信安科技股份有限公司 一种多芯片密钥管理系统
CN115694813B (zh) * 2022-12-30 2023-03-17 三未信安科技股份有限公司 一种多芯片密钥管理系统

Also Published As

Publication number Publication date
CN115413339A (zh) 2022-11-29

Similar Documents

Publication Publication Date Title
US11385278B2 (en) Security circuitry for bonded structures
Krautter et al. FPGAhammer: Remote voltage fault attacks on shared FPGAs, suitable for DFA on AES
Gnad et al. Voltage drop-based fault attacks on FPGAs using valid bitstreams
US8892903B1 (en) Detection of power analysis attacks
Shahrjerdi et al. Shielding and securing integrated circuits with sensors
TWI681281B (zh) 主動式特定用途積體電路入侵防護罩
Venugopalan et al. Surveying the hardware trojan threat landscape for the internet-of-things
Shila et al. Design, implementation and security analysis of hardware Trojan threats in FPGA
CN102799819A (zh) 一种嵌入式软件安全保护系统
Koley et al. Addressing hardware security challenges in internet of things: Recent trends and possible solutions
US11486911B2 (en) Voltage-variation detection under clock fluctuations
WO2021253254A1 (zh) 芯片、芯片封装结构以及电子设备
Reece et al. Stealth assessment of hardware Trojans in a microcontroller
Al-Anwar et al. Hardware trojan protection for third party IPs
Rahimi et al. Trends and challenges in ensuring security for low-power and high-performance embedded SoCs
US9536078B2 (en) Integrated circuit for cyber security processing
CN109190407B (zh) 一种高性能加解密运算能力扩展方法及系统
Shila et al. FIDES: Enhancing trust in reconfigurable based hardware systems
Monjur et al. ADobf: Obfuscated Detection Method against Analog Trojans on I 2 C Master-Slave Interface
US20230129830A1 (en) System and methods for fault injection attack protection
Shila et al. Unraveling the security puzzle: A distributed framework to build trust in FPGAs
Farag et al. Smart employment of circuit redundancy to effectively counter trojans (SECRET) in third-party IP cores
CN112583795B (zh) 安全防护方法及安全防护装置
Sugawara et al. Exploiting bitflip detector for non-invasive probing and its application to ineffective fault analysis
Fournaris et al. Trusted hardware sensors for anomaly detection in critical infrastructure systems

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20941334

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 28.04.2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20941334

Country of ref document: EP

Kind code of ref document: A1