Communications: electrical – Condition responsive indicating system – Specific condition
Reexamination Certificate
2000-09-20
2002-12-17
Wu, Daniel J. (Department: 2632)
Communications: electrical
Condition responsive indicating system
Specific condition
C340S635000, C361S045000
Reexamination Certificate
active
06496119
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The invention is directed to a protective circuit for an integrated circuit.
2. Description of the Related Art
Certain forms of electronic circuits, particularly integrated circuits for use in chip cards, require a high degree of secrecy of circuit information or of internal chip data. This security-relevant information must be protected both against foreign analysis as well as against manipulation.
Various approaches have been used to achieve this protection. For example, integrated circuits have been provided with a metallic sleeve of, for example, silver or titanium which can prevent a readout of the integrated circuits with X-rays. A further approach has been to arrange an interconnect in the highest circuit level of an integrated circuit as shield line and to monitor the physical properties such as the resistance, the capacitance, etc., thereof. When a change is detected, for example, due to short-circuiting, grounding or parting during undesired observation or manipulation, an alarm signal is then triggered. Such a protective circuit is disclosed by U.S. Pat. No. 5,389,738. These types of protective circuits, however, are inadequate since the anticipated physical properties can be simulated with suitable external measures and the protective circuit can consequently not detect an outside attack by observation or manipulation and, thus, no suitable counter-measures can be taken.
SUMMARY OF THE INVENTION
The invention is based on the object of specifying a protective circuit for integrated circuits that provides greater protection against unwanted observation or manipulation.
This object is achieved by a protective circuit for an integrated circuit, wherein the protective circuit is arranged in a circuit level at a location under or above the integrated circuit, the protective circuit comprising a plurality of interconnects that are charged with different signals of a signal generator, a detector that evaluates the different signals transmitted via the plurality of interconnects for faulty behavior, the detector having an output at which, when the faulty behavior is found, a control signal is provided for switching the integrated circuit into a security mode.
The inventive protective circuit is arranged in at least one circuit level above or below the integrated circuit as well. This protective circuit thereby exhibits one or more interconnects that are charged with signals that change over time or with different signals as well. These signals are transmitted via the interconnects and are subsequently investigated by the detector or detectors in that the received signal to be investigated is respectively compared to a reference signal, i.e., the anticipated signal. When one or more detectors find a significant deviation, then this triggers an alarm signal that switches the integrated circuit into a security mode. In this mode, for example, the content of the memory cells can be erased, so that the control programs and the stored data can no longer be read out and interpreted.
By employing a plurality of different signals that are conducted over a plurality of interconnects and subsequently analyzed by the various detectors, it is nearly impossible to supply all alarm-triggering signals in the correct way from the outside during an attempted readout or manipulation and to simulate the presence of these signals for the detectors. When, for example, the integrated circuit is planarly mechanically eroded from above such that it is possible to view the circuit levels of the integrated circuit lying therebelow, then the interconnects of the protective circuit lying above are affected first, which leads to a modification or, to an interruption of the signal transmission that is detected by one or by several detectors. This is also true when individual interconnects are tapped with miniature needles, resulting in modifications of, for example, the signal shape, the signal attenuation or the like. All of these modifications then regularly cause an error recognition by various detectors.
Inventively, thus, it is not only a single signal but a plurality of different signals that must be simulated. Precisely in view of the extremely limited spatial conditions of an integrated circuit, it is nearly impossible to specifically supply this plurality of simulated signals to the various detectors. A nearly all-embracing protection of the integrated circuit by the protective circuit arranged above is thus established.
Preferably, the integrated circuit is surrounded in a sandwich-like manner by a protective circuit above and a protective circuit below the integrated circuit, so that an observation or manipulation from both above as well as below is precluded by the protective circuits.
It has proven successful to fashion the detectors such that, in the evaluation of the transmitted signals, these signals are investigated for integrity, which can especially ensue with a CRC check, with a checksum comparison, with a parity check or with other signature comparisons. As a result of this integrity comparison between the transmitted signal and the integrity value of the anticipated signal, also referred to as reference signal, it is possible to prevent a manipulation of the protective circuit in which the detector is quasi-shorted, whereby one and the same signal is forwarded both as reference signal and as transmitted signal to the detector with a mere identity comparison for detecting improper behavior.
The different signals that are supplied to the different interconnects can be realized with a common signal generator or can also be realized by a plurality of individual signal generators. Preferably, the generator or generators is/are in communication with the detectors resulting in the respective detector receiving information about the type and nature of the anticipated signal, (the reference signal,) from the generator allocated to it. It is thus possible that the generators dynamically modify their output signals and inform the detectors of this modification, which makes the simulation of the signals even more difficult in an attack since the time curve of the signals is also taken into consideration,
It has proven especially advantageous to extend the interconnects over a plurality of circuit levels, resulting in a significantly better coverage of the integrated circuit to be protected. Similar to the view into the structure of the integrated circuit over a plurality of circuit levels (and, thus, a view into the type and nature of the generation, of the signal guidance and of the detection of the various signals) is also significantly more difficult and is thereby not easy to simulate externally. Consequently, each modification of the protective circuit by an intervention from the outside leads to a detection of the faulty behavior, since a simulation is extremely difficult or nearly impossible due to the extremely difficult, three-dimensional structure of the fashioning of the interconnect or, the guidance therefor. It is thus clear that the one circuit level of the protective circuit protects the other circuit level of the protective circuit against an analysis. An extremely far-reaching and dependable protective circuit for the integrated circuit is definitely established by this approach.
According to a preferred embodiment of the protective circuit, the interconnects of the protective circuit are fashioned such that, ideally, they largely completely planarly cover the integrated circuit to be protected. This is done in a manner such that, when looking through the protective circuit onto the integrated circuit, there is no longer any possibility of directly reaching the protective circuit, for example, through bores or the like, i.e. without damaging the interconnects of the protective circuit. This far-reaching or complete coverage is enabled in a simple and sure way by precisely fashioning the interconnects over a plurality of circuit levels or in a plurality of circuit levels, since the interconnects can be arranged in a plane wi
Eisele Martin
Otterstedt Jan
Richter Michael
Smola Michael
LandOfFree
Protection circuit for an integrated circuit does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Protection circuit for an integrated circuit, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Protection circuit for an integrated circuit will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2981307