Integration of security modules on an integrated circuit

Details Integration of security modules on an integrated circuit Integration of security modules on an integrated circuit

1999-02-01

2003-04-22

Hua, Ly V. (Department: 2131)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Protection at a particular protocol layer

C713S152000, C713S300000, C713S323000, C713S340000, C702S064000, C702S190000, C714S010000, C714S047300, C714S055000, C714S022000, C327S018000, C327S039000

Reexamination Certificate

active

06553496

ABSTRACT:

BACKGROUND
The present invention concerns security protection within an integrated circuit design and pertains particularly to integration of security modules on an integrated circuit.
For some processing applications, it is essential to operate in a secure environment so that operations cannot be probed or altered. In the prior art, various methods have been used to provide for a secure processing environment.
For example, a mechanical chassis can be used to house processing equipment. This mechanical chassis can include tamper switches and other elements to detect and protect against tampering and alterations. Unfortunately, such a mechanical chassis can add a significant amount of expense to a product.
Alternatively, in order to restrict access to particular integrated circuits, the integrated circuits can be covered with epoxy or other chemical materials to hinder access. Unfortunately, often this can be easily defeated and so provides only a nominal amount of protection.
Another method to provide for a secure processing environment is to implement the system on a single integrated circuit. A portion of the integrated circuit, for example, can be used to perform secure operations. However, there may still be attempts to defeat this arrangement.
For example, an attacker may attempt to expose information about a security key or information about a security system by applying radiation or alpha particles in the proper location. The excess radiation or alpha particles can result in a single event upset (SEU). The single event upset can affect the data integrity of a secure operation. If the single event upset occurs in an operation related to a security key or data encrypted with the security key, this may weaken the effectiveness of the protection within the integrated circuit and perhaps provide an avenue to break the security system.
Other types of attacks can be perpetrated as well. While there have been various types of circuitry added to protect an integrated circuit, these have usually been added on an ad hoc basis. There has been no integrated effort to protect integrated circuits.
SUMMARY OF THE INVENTION
In accordance with the preferred embodiment of the present invention, an integrated circuit includes secure logic that requires protection. Secure assurance logic protects the secure logic. The secure assurance logic includes a plurality of protection modules that monitor the occurrence of insecure conditions. Each protection module monitors a different type of insecure condition. Each protection module asserts an alarm signal when an associated insecure condition is detected. The alarm signals asserted by the plurality of protection modules are stored.
In the preferred embodiment, once an alarm signal is asserted, the alarm signal is received by a first register. A second register is used for masking the alarm signals. The masking performed by the second register is used to prevent selected alarm signals from being propagated. This allows certain alarms to be blocked during testing of the secure assurance logic. A third register stores the alarm signals that have been asserted but have not been masked by the second register. The integrated circuit can be reset when an alarm signal is detected.
The plurality of protection monitors include, for example one or more of the following: a high frequency monitor that detects when a monitored clock exceeds a predetermined frequency, a low frequency monitor that detects when a monitored clock is less than a predetermined frequency, a single event detector monitor that monitors single event upsets within the integrated circuit, a reset monitor that monitors an amount of times the integrated circuit is reset, and a voltage detector that monitors for invalid voltage levels.
In addition, the secure assurance logic generally includes a power-on-reset circuit for resetting the integrated circuit to a known state upon power-up of the integrated circuit.
The above-described integration of the protection modules into secure assurance logic requires that someone attacking the security features of the integrated circuit must simultaneously defeat more than one security component. This increases the complexity of the attack required to successfully circumvent the security features. The integrated solution described herein can be used to protect integrated circuits that implement firmware that must access two independent address spaces. The programmable features of secure assurance logic also allows register values to be changed separately such that there is no insecure period of overlap in the operation of the integrated circuit.


REFERENCES:
patent: 4849614 (1989-07-01), Watanabe et al.
patent: 5107139 (1992-04-01), Houston et al.
patent: 5502812 (1996-03-01), Leyre et al.
patent: 5606511 (1997-02-01), Yach
patent: 5898711 (1999-04-01), Buer
patent: 6114880 (2000-09-01), Buer et al.
patent: 6188257 (2001-02-01), Buer
patent: WO 94/13080 (1994-06-01), None
patent: WO 96/000953 (1996-01-01), None
patent: WO 98/47060 (1998-10-01), None

Affiliated with

Also associated with

Rating

Integration of security modules on an integrated circuit does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Integration of security modules on an integrated circuit, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Integration of security modules on an integrated circuit will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3090672