Integrated electronic circuit

According to one embodiment, an integrated electronic circuit has a switching network configured to receive binary control states, one or more secret-carrying gates, wherein each secret-carrying gate represents Boolean secrets and is configured to receive binary input states and to output one or more Boolean secrets according to a state sequence of the binary input states, and one or more flip-flops configured to store binary output states output by the switching network and to supply binary input states to the one or more secret-carrying gates based on the stored binary output states. The switching network generates the binary output states by combining the binary control states and Boolean secrets output by the one or more secret-carrying gates. The integrated electronic circuit outputs Boolean secrets from the one or more secret-carrying gates and/or the binary output states from the switching network to another integrated electronic circuit.

RELATED APPLICATION

This application claims priority to German Patent Application No. 102019112583.9, filed on May 14, 2019, entitled “INTEGRIERTE ELEKTRONISCHE SCHALTUNG”, which is incorporated by reference herein in its entirety.

SUMMARY

Exemplary embodiments relate in general to integrated electronic circuits.

The reverse engineering (RE) of integrated circuits (IC) can be considered one of the greatest threats to the semiconductor industry, because it can be misused by an attacker to steal and/or acquire a circuit design. An attacker who successfully reverse engineers an integrated circuit can create and sell a similar, i.e. cloned circuit, and illegally sell and make the design public and, for example, divulge the trade secrets of a competitor.

Designs and techniques that prevent the reverse engineering of integrated circuits, or at least make it more difficult, are therefore desirable.

According to one embodiment, an integrated electronic circuit is provided. The integrated electronic circuit may comprise a switching network configured to receive binary control states. The integrated electronic circuit may comprise one or more secret-carrying gates, wherein each secret-carrying gate of the one or more secret-carrying gates represents Boolean secrets and is configured to receive binary input states and to output one or more Boolean secrets of the Boolean secrets according to a state sequence (e.g., a chronological state sequence) of the binary input states. The integrated electronic circuit may comprise one or more flip-flops configured to store binary output states output by the switching network and to supply binary input states to the one or more secret-carrying gates based on the stored binary output states, wherein the switching network is configured to generate the binary output states by combining the binary control states and Boolean secrets output by the one or more secret-carrying gates. The integrated electronic circuit may comprise an output configured to output Boolean secrets output by the one or more secret-carrying gates and/or binary output states output by the switching network to another integrated electronic circuit.

DETAILED DESCRIPTION

The following detailed description refers to the enclosed figures, which show details and exemplary embodiments. These exemplary embodiments are described in sufficient detail to enable the person skilled in the art to embody the present disclosure. Other embodiments are also possible, and the exemplary embodiments can be modified in terms of their structural, logical and electrical aspects without deviating from the subject matter of the present disclosure. The different exemplary embodiments are not necessarily mutually exclusive, but different embodiments can be combined to create new embodiments. For the purposes of this description, the terms “connected” and “coupled” are used to describe both a direct and indirect connection, and a direct or indirect coupling.

It is desirable to protect a large number of chips from reverse engineering, such as for chips used in security-related contexts such as on a chip card, as shown inFIG. 1.

FIG. 1shows a chip card100according to one embodiment.

The chip card100comprises a carrier101on which a chip card module102is arranged. The chip card module102comprises different data processing components, such as a memory103, a processor104, and/or a cryptoprocessor105(e.g., a dedicated cryptographic processor), for example.

For example, the chip card module102is designed to be protected against reverse engineering. However, this should be considered only as an example and chips in many different application areas can be protected against reverse engineering in accordance with exemplary embodiments, e.g., microcontroller chips, e.g., in control devices such as found in a vehicle, e.g., in an ECU (electronic control unit), for chip cards with an arbitrary form factor, communication chips, control chips of different devices, such as printers, etc.

Typically, in an integrated circuit that is to be protected against reverse engineering, a logic function yj=f (xi) will calculate a result yjsecretly from inputs xi. Circuits for protecting against reverse engineering are often referred to as camouflage circuits. In some implementation techniques, if such a circuit is based on reverse engineering it implements a different logic function than it does in the original circuit this explains the designation “camouflage”.

Different exemplary embodiments are based on a subset of camouflage mechanisms, namely cells (such as gates), which provide one or more Boolean secrets and are referred to in the following as MH cells (for “Magic Hood”). Strictly speaking, these cells are not necessarily camouflage circuits in the above sense (but are nevertheless understood as such in the following), since the cells can typically be identified by reverse engineering. However, the output value of an MH cell cannot be obtained in classical static reverse engineering process (slice-by-slice analysis, combination and reconstruction of the circuit) based on conventional reverse engineering techniques. In some examples, only if the output of the active circuit is measured at the correct time can its secret output be determined.

MH cells have some non-trivial properties that can be used to build circuits that protect secrecy in the event of reverse engineering while providing integrity protectionin the event of an active attack (by needling and/or laser fault injection (LFI)).

According to various exemplary embodiments, finite automata are implemented based on secret-carrying gates (which carry Boolean secrets), such as MU cells.

An MH cell (or MH gate) has a secret state in a given clock cycle. Depending on its state, one or more specific input states transfer the MH cell into a new secret state (corresponding to a Boolean secret that it stores). In some examples, the MH cell therefore demonstrably comprises a memory and depending on its current state (which depends on the past), certain input state transitions (e.g., only the certain input state transitions) are permitted, i.e there are prohibited disallowed) input state transitions.

FIG. 2shows the gate symbol of an MH gate200.

As can be seen from the gate symbol, the MH gate200, which is referred to as MH-X{circumflex over ( )}4 because it represents four Boolean secrets, has the two input states S1(or T) and S0(or S) as well as the two output states Z1(or Y) and Z0(or Z).

The following assignments initially apply between the two pre-charge states <S1,S0> of the input signals and those of the output signals <Z1,Z0>:

The following rules also apply to state transitions based on one of the two pre-charge states:

The state transition (symbolized by an arrow “→”)

the state transition

the state transition

the state transition

The four Boolean secrets independent of each other hidden in MH-X{circumflex over ( )}4are designated here as Xn for n=0,1,2,3 and each Xn can be 0 or 1. The Boolean secrets in the state transitions specified above appear at the outputs Z1and Z0of MH-X{circumflex over ( )}4, where the Boolean inversion NOT(X) of X is designated \X:\X=NOT(X).

Alternatively and/or additionally, the operations J+K and J*K refer to the Boolean OR logic operation and the AND logic operation of J and K, respectively.

The two state transitions of the input signals

<S1,S0>=<0,1>→<1,0> and

may not be permitted because they would result in undefined (meta-stable) behavior of MH-X{circumflex over ( )}4and/or of <Z1,Z0>.

Since the MH gate MH-X{circumflex over ( )}4can represent four independent Boolean secrets, there are 16 permutations of the MH gate MH-X{circumflex over ( )}4, depending on which combination of the four secrets it represents.

An example of an implementation of the MH gate MH-X{circumflex over ( )}4is shown inFIG. 3.

FIG. 3shows a circuit300that implements an MH cell based on self-dual NAND-NOR gates.

The circuit300has two inputs T and S and two outputs Z and Y. For example, inputs T and S correspond to S1and S0fromFIG. 2and outputs Z and Y correspond to Z1and Z0fromFIG. 2.

As in the example ofFIG. 2, the MH cell300represents four Boolean secrets X0, X1, X2, X3. The secrets stored by the MH cell300are determined from the configuration of various field-effect transistors (FETs) of the MH cell300, as will be explained below. Here, Vth(FET name) denotes the threshold voltage of an FET designated by FET-name.

The circuit300comprises a first unified NAND-NOR gate301, a second unified NAND-NOR gate302, a first inverter303and a second inverter304.

The first unified NAND-NOR gate301comprises a first p-channel FET305, the source of which is connected to the high supply potential (VDD) and the gate of which is supplied with the signal S. The first unified NAND-NOR gate301also comprises a second p-channel FET306, the source of which is connected to the high supply potential (VDD). The drains of the first p-channel FET305and the second p-channel FET306are connected to the source of a third p-channel FET307, the gate of which is supplied with the signal T and the drain of which is connected to a first output node (or feedback node)308, the state of which is designated SY.

The first unified NAND-NOR gate301also comprises a fourth p-channel FET309, the source of which is connected to the high supply potential, the gate of which is connected to the gate of the second p-channel FET306and the drain of which is connected to the source of a fifth p-channel FET310, the gate of which is supplied with the signal S and the drain of which is connected to the first output node308.

Alternatively and/or additionally, the first unified NAND-NOR gate301comprises a first n-channel FET311, the source of which is connected to the low supply potential (VSS) and the gate of which is supplied with the signal S. The first unified NAND-NOR gate301also comprises a second n-channel FET312, the source of which is connected to the low supply potential (VSS). The drains of the first n-channel FET311and the second n-channel FET312are connected to the source of a third n-channel FET313, the gate of which is supplied with the signal T and the drain of which is connected to the first output node308.

The first unified NAND-NOR gate301also comprises a fourth n-channel FET314, the source of which is connected to the low supply potential, the gate of which is connected to the gate of the second n-channel FET312and the drain of which is connected to the source of a fifth n-channel FET315, the gate of which is supplied with the signal S and the drain of which is connected to the first output node308.

The first unified NAND-NOR gate302comprises a sixth p-channel FET316, the source of which is connected to the high supply potential (VDD) and the gate of which is supplied with the signal S. The second unified NAND-NOR gate302also comprises a seventh p-channel FET317, the source of which is connected to the high supply potential (VDD). The drains of the sixth p-channel FET316and the seventh p-channel FET317are connected to the source of an eighth p-channel FET318, the gate of which is supplied with the signal T and the drain of which is connected to a second output node (or feedback node)319, the state of which is designated SZ.

The second unified NAND-NOR gate302also comprises a ninth p-channel FET320, the source of which is connected to the high supply potential, the gate of which is connected to the gate of the seventh p-channel FET317and the drain of which is connected to the source of a tenth p-channel FET321, the gate of which is supplied with the signal S and the drain of which is connected to the second output node319. Alternatively and/or additionally, the second unified NAND-NOR gate302comprises a sixth n-channel FET322, the source of which is connected to the low supply potential (VSS) and the gate of which is supplied with the signal S. The second unified NAND-NOR gate302also comprises a seventh n-channel FET323, the source of which is connected to the low supply potential (VSS). The drains of the sixth n-channel FET322and the seventh n-channel FET323are connected to the source of an eighth n-channel FET324, the gate of which is supplied with the signal T and the drain of which is connected to the second output node319.

The second unified NAND-NOR gate302also comprises a ninth n-channel FET325, the source of which is connected to the low supply potential, the gate of which is connected to the gate of the seventh n-channel FET323and the drain of which is connected to the source of a tenth n-channel FET326, the gate of which is supplied with the signal S and the drain of which is connected to the second output node319.

The first output node308is also connected to the input of the first inverter303, the output of which is the output Y. Alternatively and/or additionally, the first output node308is connected to the gates of the ninth p-channel FET320and the ninth n-channel FET325.

The second output node319is also connected to the input of the second inverter304, the output of which is the output Z. Alternatively and/or additionally, the second output node319is connected to the gates of the fourth p-channel FET309and the fourth n-channel FET314.

The inverters303,304are implemented, for example, by a p-channel FET and an n-channel FET, which are connected in series between the high supply potential and the low potential, which the input of the inverters303,304receive at their gates and wherein the node between them is the output node of the respective inverters303,304.

For (T, S)=(0, 0) the circuit300is located in a first pre-charge state:
(T,S)=(0,0)=>(SZ,SY)=(1,1)=>(Z,Y)=(0,0),
and for (T, S)=(1, 1), the circuit is in a second pre-charge state:
(T,S)=(1,1)=>(SZ,SY)=(0,0)=>(Z,Y)=(1,1).

The first state transition that results in the output of a Boolean secret represented by the MH cell300is given by (T, S)=(0, 0)→(0, 1), wherein the two competing pull-down paths, including the serial connections of the tenth n-channel FET326, labeled TNZ4, and the ninth n-channel FET325, labeled TNZ3, for SZ, and the fifth n-channel FET315, labeled TNY4, and the fourth n-channel FET314, labeled TNY3, for SY, are activated.

As a result, the two different threshold voltage configurationsVth(NZ4)<Vth(NY4); Vth(NZ3)<Vth(NY3) andVth(NZ4)>Vth(NY4); Vth(NZ3)>Vth(NY3)
correspond to the two different values X0=1 and X0=0 for the first state transition:
(T,S)=(0,0)→(0,1)=>(Z,Y)=(0,0)→(X0,NOT(X0)).

The second state transition, which results in the output of a Boolean secret represented by the MH cell300, is given by (T, S)=(0, 0)→(1, 0), wherein the two competing pull-down paths, including the serial connections of the eighth n-channel FET324, labeled TNZ2, and the seventh n-channel FET323, labeled TNZ1, for SZ, and the third n-channel FET313, labeled TNY2, and the second n-channel FET312, labeled TNY1, for SY, are activated.

As a result, the two different threshold voltage configurationsVth(NZ2)<Vth(NY2); Vth(NZ1)<Vth(NY1) andVth(NZ2)>Vth(NY2); Vth(NZ1)>Vth(NY1)
correspond to the two different values X1=1 and X1=0 for the second state transition
(T,S)=(0,0)→(1,0)=>(Z,Y)=(0,0)→(X1,NOT(X1)).

The third state transition, which results in the output of a Boolean secret represented by the MH cell300, is given by (T, S)=(1, 1)→(1, 0), wherein the two competing pull-up paths, including the serial connections of the tenth p-channel FET321, labeled TPZ4, and the ninth p-channel FET320, labeled TPZ3, for SZ, and the fifth p-channel FET310, labeled TPY4, and the fourth p-channel FET309, labeled TPY3, for SY, are activated.

As a result, the two different threshold voltage configurationsVth(PZ4)<Vth(PY4); Vth(PZ3)<Vth(PY3) andVth(PZ4)>Vth(PY4); Vth(PZ3)>Vth(PY3)
correspond to the two different values X3=0 and X3=1 for the third transition:
(T,S)=(1,1)→(1,0)=>(Z,Y)=(1,1)→(X3,NOT(X3)).

The fourth state transition, which results in the output of a Boolean secret represented by the MH cell300, is given by (T, S)=(1, 1)→(0, 1), wherein the two competing pull-up paths, including the serial connections of the eighth p-channel FET318, labeled TPZ2, and the seventh p-channel FET317, labeled TPZ1, for SZ, and the third p-channel FET307, labeled TPY2, and the second p-channel FET306, labeled TPY1, for SY, are activated.

As a result, the two different threshold voltage configurationsVth(PZ2)<Vth(PY2); Vth(PZ1)<Vth(PY1) andVth(PZ2)>Vth(PY2); Vth(PZ1)>Vth(PY1)
correspond to the two different values X2=0 and X2=1 for the fourth transition:
(T,S)=(1,1)→(0,1)=>(Z,Y)=(1,1)→(X2,NOT(X2)).

Because all four relevant pull-up and pull-down paths (and/or some of the four relevant pull-up and pull-down paths) differ from each other and can therefore be selected independently of each other, the four MH secrets, i.e. the values X0, X1, X3and X2, can also be selected independently. Accordingly, for the MH which is based on the self-dual gates ofFIG. 3, 24=16 different MH incarnations can be realized, i.e. 16 different MH permutations, which have the same physical layout (i.e. are indistinguishable in terms of their physical design). However, due to their different CMOS (Complementary Metal Oxide Semiconductor) threshold voltage configurations, they exhibit different electronic behaviors. Alternatively and/or additionally, the independence of X0, X1, X3and X2corresponds to a path-dependency of the Boolean secrets, i.e. each secret (X0, X1, X3and X2) depends not only on the input control signal state, but also on the manner in which this state was reached.

The various threshold voltage configurations can be set using suitable types of doping.

According to different embodiments, the MH-X{circumflex over ( )}4gate ofFIG. 2is used as an element of a switching logic, as described below.

FIG. 4shows a state diagram400for a switching logic according to one embodiment.

The states <S1,S0>=<0,0>, <0,1>, <1,0>, <1,1> of the input states of MH-X{circumflex over ( )}4are interpreted as states401,402,403,404of the corresponding switching logic with input state J.

The four possible states of <S1,S0> are represented by oval symbols, each containing one of the four possible values of <S1,S0>, while the conditions necessary on the input state J of the switching logic for the possible state transitions between states401to404are indicated within the dashed circles.

The state diagram also shows that the two disallowed input state transitions

are not realized by the corresponding switching logic.

Impermissible input state transitions can be used to secure state transitions of the MH cell, i.e. to prevent an attacker from reaching an arbitrary state by manipulating input states of an MH cell. For example, impermissible input state transitions can be mapped to a safe state of the MH cell, starting from which the secrets represented by the MH cell can no longer be reached (and the MH cell, for example, constantly outputs only 00 or 11).

FIG. 5shows a circuit (such as a switching logic)500for implementing a switching logic corresponding to the state diagram400.

The circuit comprises an MH gate501(e.g., an MH gate MH-X{circumflex over ( )}4), as shown inFIG. 2. The two outputs of the MH gate501are connected to control inputs M0and M1of a switching network502, in this example a multiplexer MUX. The multiplexer has four data inputs that are assigned to the four possible bit combinations at the control inputs M0and M1.

The circuit receives a control state J. The combinations <\J,J>, <J,J>, <J,\J> and <\J,\J> are fed to the data inputs of the multiplexer502in such a way that:

where N0and N1indicate the output states of the multiplexer502.

The circuit502also comprises two flip-flops503and504. The flip-flops503and504may be clock-edge-controlled data flip-flops. Both flip-flops503and504receive a clock signal CK at their respective clock input. The first flip-flop503receives the output state N0of the multiplexer502and the second flip-flop504receives the output state N1of the multiplexer502. The value stored by the first flip-flop503is the input state S0of the MH gate501and the value stored by the second flip-flop504is the input state S1of the MH gate501.

The input control state J of the switching logic concerned can change within each period of the system clock CK. For example, J can be derived from outputs Z1and Z0of other MH-X{circumflex over ( )}4gates from another switching logic which is similar or identical in design.

In this way, any complex arrangements of switching logics of the type under consideration can be set up, wherein one, some and/or all state transitions in one, some and/or all switching logics depend on one, some and/or all Boolean secrets hidden in the MH-X{circumflex over ( )}4.

This makes a successful reverse engineering of such switching logic complexes extremely difficult, highly risky (resulting in misinterpretations) and time-consuming.FIG. 6shows an example of such a switching logic complex.

FIG. 6shows a switching logic arrangement600in accordance with one embodiment.

The switching logic arrangement600comprises a plurality of switching logics601, each corresponding to the switching logic500fromFIG. 5and arranged in a chain (according to an index n=1, 2, . . . ). Accordingly, each switching logic (with index n) has an input control state J<n> and receives the clock signal CK. Alternatively and/or additionally, the output states of the respective MH gate501are output states Z0<n> and Z1<n> of the gate.

The input control state J<n> is arranged by a respective EXCLUSIVE-OR gate from the output state Z0<n+1> of the following switching logic and the output state Z1<n−1> of the previous switching logic.

Thus, the input control state J<n> of a switching logic601is formed from the EXCLUSIVE-OR logic operation of MH-X{circumflex over ( )}4outputs Z1and Z0from neighboring (in the chain) switching logics with indices n−1 and n+1.

The first switching logic and the last switching logic in the chain, which each have no neighbors on one side, can be supplied by this constant or the chain can be closed cyclically.

In the switching logic arrangement there is clearly a transfer of states in both directions (the chain upwards and the chain downwards). However, in other possible designs, it is also possible to transfer states in only one direction and/or to transfer an output to a switching logic further away in the chain.

In the following a more complex example of a switching logic is described, using the MH gate MH-X{circumflex over ( )}4.

FIG. 7shows a state diagram700for a switching logic according to a further embodiment.

In contrast to the example shown inFIG. 4, the switching logic has two control input states J and K.

The states <S1,S0>=<0,0>, <0,1>, <1,0>, <1,1> of the input states of MH-X{circumflex over ( )}4are interpreted as states701,702,703,704of the corresponding switching logic with input states J and K.

The four possible states of <S1,S0> are represented by oval symbols as inFIG. 4, each containing one of the four possible values of <S1,S0>, while the conditions necessary on the input state J and K of the switching logic for the possible state transitions between states701to704are indicated within the dashed circles.

The state diagram also shows that the two disallowed input state transitions

are not realized by the corresponding switching logic.

FIG. 8shows a circuit (such as a switching logic)800for implementing a switching logic corresponding to the state diagram700.

The circuit comprises an MH gate801(e.g., an MH gate MH-X{circumflex over ( )}4), as shown inFIG. 2. The two outputs of the MH gate801are connected to control inputs M0and M1of a switching network802, in this example a multiplexer MUX. The multiplexer has four data inputs that are assigned to the four possible bit combinations at the control inputs M0and M1.

The circuit receives two control states and J and K. The combinations <\[K+J],\[K+J\J]>, <J,J>, <J,J> are fed to the data inputs of the multiplexer802in such a way that the following applies:

where N0and N1indicate the output states of the multiplexer802.

The circuit802also comprises two flip-flops803and804. The flip-flops803and804may be clock-edge-controlled data flip-flops. Both flip-flops803and804receive a clock signal CK at their respective clock input. The first flip-flop803receives the output state N0of the multiplexer802and the second flip-flop804receives the output state N1of the multiplexer802. The value stored by the first flip-flop803is the input state S0of the MH gate801and the value stored by the second flip-flop804is the input state S1of the MH gate801.

The input control states J and K of the switching logic under consideration can change within each period of the system clock CK. For example, J and K can be derived from outputs Z1and Z0of other MH-X{circumflex over ( )}4gates from another switching logic, which is similar or identical in design.

In this way, arbitrarily complex arrangements of switching logics of the type under consideration can be set up, wherein one, some and/or all state transitions in one, some and/or all switching logics depend on one, some and/or all Boolean secrets hidden in the MH-X{circumflex over ( )}4.

This makes a successful reverse engineering of such switching logic complexes extremely difficult, highly risky (resulting in misinterpretations) and time-consuming. For example, the switching logic800fromFIG. 8can be used in the switching logic arrangement600ofFIG. 6, analogous to the switching logic500fromFIG. 5.

FIG. 9shows a general structure of a finite automaton900which is protected against reverse engineering (i.e., its confidentiality is protected) using cells (such as gates) that represent Boolean secrets (e.g., MH gates).

The finite automaton900has several stages (or layers)901, numbered from 1 to N.

Each stage901comprises a daisy chain of an MH layer902(labeled as μ), a combination layer903(labeled as φ), and a sequential (state) layer904(which stores a state of the stage labeled as Σ).

The MH layer902comprises one or more MH gates (sequential and/or parallel), the combination layer903is a switching network, for example, and the sequential layer904is a buffer layer, e.g., formed by one or more flip-flops.

The output of the sequential layer904of a stage901is connected to the input of the MH layer902of the subsequent stage901, wherein the stages901are cyclically connected to each other, in other words the output of the sequential layer904of the Nth stage is connected to the input of the MH layer902of the first stage.

The output of the sequential layer904of each stage901is also connected to a respective output layer905(labeled as w), which generates an output (labeled as S2) and outputs it, for example, to a circuit connected to the finite automaton900(which is located, for example, on the same chip as the circuit which implements the finite automaton900).

Therefore, between each sequential layer904and combinatorial layer903(the next stage), an MH layer902is located which transforms the state of the sequential layer904(for example, a set of binary states) according to secrets that represent one or more MH cells of the MH layer. The combination layer903of each stage901thus operates on secret data and the output layer905has a secret input and generates the secret output Ω.

As an option, the finite automaton900can have one or more feedback paths (i.e. feedback loops) in order to implement a desired behavior (states and state transitions of the automaton). In the example ofFIG. 9, there is a large feedback loop due to the connection of the N-th stage to the first stage, as explained above.

The finite automaton900can receive inputs (e.g., input control signals), labeled inFIG. 9as 1, by means of one or more of the combinatorial layers903. These inputs, which are acquired from one or more of the combinatorial layers903, can be used, for example, to control and/or effect state transitions of the automaton900.

The finite automaton900can be regarded as a generalization of the switching logics500,800fromFIGS. 5 and 8, for example as follows: N=1, the MH layer consists of the one MH gate501,801, the combinatorial layer consists of the multiplexer502,802and the sequential layer consists of the flip-flops503,504,803,804. For example, S1and/or S0can be output.

The finite automaton900can also be considered as a generalization of the switching logic arrangement600, for example because an EXCLUSIVE OR gate602together with the multiplexer of a switching logic601is considered as a combinatorial layer of a stage, the flip-flops of a switching logic601as a sequential layer of the stage and the MH gate of the switching logic601as an MH layer of the subsequent stage. In this interpretation, there is feedback from the MH layer of each stage to the combinatorial layer of the stage, which is two stages ahead (due to the feedback of Z0).

By means of the multi-layer structure, as shown inFIG. 9, in principle any finite automaton can be represented with N states.

The following describes some example applications for protecting against reverse engineering.

As a first example application, the secret outputs Ω1, Ω2, . . . (e.g., over several clock pulses) are used as the control information sequence for an algorithm.

For example, redundant coding is currently typically used for integrity protection. However, reverse engineering allows an attacker to discover the exact positions and values needed to force a valid (but malicious) state transition. Using an MH-protected state machine, such as described inFIG. 9for example, it can be ensured that an attacker cannot discover any valid state coding and/or valid state transitions through reverse engineering. The attacker would therefore have to inject faults on a trial-and-error basis and/or intercept all states and registers (e.g., flip-flops) of the state machine. This greatly increases the effort required by the attacker.

For example, the controller of an (e.g., proprietary) cryptographic algorithm can be implemented using an MH-protected state machine.

As a first example application, the secret outputs Ω1, Ω2, . . . (e.g., over several clock pulses) are used as a sequence of cryptographic keys. For example, a set Ω1, Ω2, . . . , ΩNrepresents a cryptographic key and, after a specific number of cycles, the next cryptographic key of the sequence. A state machine901with only one stage can also be taken, which outputs a cryptographic key (optionally parts of the key over several clock cycles).

The basis for protecting the confidentiality and integrity on a (security) controller is typically a secret value used in key-dependent cryptographic functions, also known as a Root Key. Such key-dependent cryptographic functions include, for example, encryption algorithms which are used to provide the secrecy of a memory, for authentication algorithms to control access to content and/or functions, and integrity protection algorithms (MAC, AE) designed to ensure the integrity of memory contents and/or other functions. Typically, the root key R should be protected from extraction by reverse engineering (as this would allow the production of cloned chips). Therefore, this key is a natural candidate for protection in an implementation using a circuit camouflage technique.

A standard IC manufacturing process typically produces a large number of identical copies of the IC. However, most security applications require IC-specific root keys. This conflicts with the static nature of the circuit camouflage, because a camouflage circuit that generates the root key would be identical on identical ICs.

To resolve this conflict, another IC-specific secret value, herein referred to as IV, may be introduced and stored in a non-volatile memory (NVM) of the IC for this purpose. The IC-specific value IV can be combined with fixed component values (identical for some and/or all of the ICs), which are stored, for example, in a ROM (read-only memory) and/or a semi-custom chip area.

However, in many cases, the non-volatile memory must be considered insecure, which means it must be assumed that its contents can be extracted in a reverse engineering attack, as is the case with ROM and semi-custom blocks. This approach allows an attacker to produce a clone of the IC.

According to one embodiment, this is prevented by the IC-specific value IV, which is stored in a non-volatile memory, being transformed by using a state machine in accordance withFIG. 9, by setting Φ=IV and Ω=R. This constitutes a protected key generator that generates an IC-specific key R based on the (not necessarily secret) value IV. This is shown inFIG. 10.

The chip1000comprises a state machine1001, which comprises MH gates, for example, as described with reference toFIG. 9. The chip also comprises a non-volatile memory1002, which stores a (for example, public, i.e. not secret) information item IV. The state machine1001receives the information IV and generates a key (e.g., a root key) R, according to a function fX(IV), which is specific to the chip1000, because the MH gates are individually configured for the chip (i.e. represent chip-specific secrets). X can be a static key, which can also be protected against reverse engineering by means of a camouflage circuit and which is input into the function fX(IV). For example, the secret function fX(.) is chosen such that it avoids collisions, in the sense that for input tuples (IV, X), the probability that the function fX(IV)=f(X, IV) of another chip will generate the same root key is vanishingly small (e.g., the probability may be less than a threshold probability) (for example, it is acceptable for the particular application scenario).

The state machine is the state machine ofFIG. 9, for example, with one stage and Φ=IV and Ω=R, and implements a key generator protected against reverse engineering. For example, the generated chip-specific key R is used by the chip1000for memory encryption, for secure data transmission and/or for authentication.

Integrity protection is achieved in this example because forcing input control states of the state machine1001to specific values will generally result in impermissible input state transitions and an incorrect (or random) key. Protection against reverse engineering results from the use of the state machine1001, which is protected by MH gates.

As a generalization, a state machine1001with a plurality of stages901can be used, such that a sequence (or set) of cryptographic keys is generated by the state machine1001(e.g., one per stage). The state machine1001can output one key at a time in deterministic order (i.e. it does not omit any key and does not generate an earlier key). Suitable coding can be used to ensure that this also remains valid even in the event of fault attacks. For this purpose, the coding can exploit the fact that an MH cell no longer outputs any secret that it represents if its input is set to an impermissible state (or an invalid state transition).

For example, the function fX(IV) is selected to cause a strong mixture of X and IV. For example, it can have the properties of a key-based hash function. The length of the value IV (i.e. the number of bits) is selected in such a way that it results in sufficient diversity.

Using static reverse engineering together with extraction of IV from the non-volatile memory1002, an attacker cannot determine the secret key R (assuming a strong camouflage technology, such as can be obtained by means of MH gates). Thus, the attacker cannot create a cloned IC (i.e. chip) with the root key R, because they do not know the root key R and cannot calculate the root key R from knowledge of the value IV, because they do not know the unknown function fX(.) and cannot copy it.

However, another attack to clone the 1000 chip is possible: assuming that the value IV can be extracted by reverse engineering, an attacker can take another identical chip from the manufacturer and try to inject the value IV into the other chip. This is typically difficult, but may be possible for a powerful attacker. This allows the attacker to perform a one-to-one identity transfer, but they must sacrifice an original IC for each cloned IC that is produced. A mass production of cloned ICs is therefore not possible for the attacker, which may be sufficient for many applications.

In order to achieve full clone protection, according to one embodiment the non-volatile memory of the IC-specific value IV is provided with write-locking and/or one-time programmability (OTP) functionality. This is shown inFIG. 11.

FIG. 11shows a chip1100according to a further embodiment.

According to the chip1000ofFIG. 10, the chip1100comprises a state machine1101and a non-volatile memory1102. The non-volatile memory1102is provided with OTP functionality and/or a write lock1103.

In a personalization act (such as after the hardware manufacture of the chip1100), the value IV is written to the non-volatile memory1102and any further writing to the memory area that stores the value IV (i.e. overwriting the value IV) is prevented (blocked) by the OTP functionality and/or write lock1103.

OTP functionality1103is not limited to a classical NVM-OTP functionality. It can be any single-use functionality, such as a specialized procedure that allows only one-time programming and/or that has a physically irreversible locking act (such as semiconductor fuses, laser fuses, etc.). As explained above, the value IV does not need to be kept secret. The combination of a camouflage technology with storage of the value IV such that it can only be written once, as provided by the example ofFIG. 11, enables complete protection against cloning and the security of the root key.

A protected and controlled unlocking functionality can be provided to allow reprogramming of IV (when using a write lock instead of an OTP functionality).

The secret function fX(.) can be a (e.g., common) cryptographic hash function, an AE (authenticated encryption) function, a MAC (Message Authentication Code) function, and/or other dedicated function that prevents an attacker from deriving and/or guessing the value of the root key R from the input values.

The secret function fX(.) can be implemented using countermeasures against side-channel attacks and/or fault attacks, depending on the accessibility of the value IV to an attacker.

As a third example application, the secret outputs Ω1, Ω2, . . . (e.g., over several cycles) are used as a pseudo-random sequence for masking data for protection (countermeasure) against side-channel attacks and differential fault analysis. The input1in this case can be a true random sequence.

A linear or non-linear shift register can be implemented by providing Φ as a linear or non-linear transition function. The shift register passes through a sequence of values that cannot be predicted by an attacker performing a reverse engineering.

In summary, according to various exemplary embodiments an integrated electronic circuit is provided, as shown inFIG. 12.

FIG. 12shows an integrated electronic circuit1200according to one embodiment.

The integrated electronic circuit1200comprises a switching network1201which is configured to receive binary control states.

The integrated electronic circuit1200also comprises one or more secret-carrying gates1202, wherein each secret-carrying gate1202represents Boolean secrets and is configured to receive binary input states and to output at least one of the Boolean secrets according to a state sequence (i.e. a chronological sequence of states) of the binary input states.

Alternatively and/or additionally, the integrated electronic circuit1200comprises one or more flip-flops1203which are configured to store binary output states output by the switching network1201and to supply binary input states to the one or more secret-carrying gates based on the stored binary output states.

The switching network1201is configured to generate the binary output states by combining the binary control states and Boolean secrets output by the one or more secret-carrying gates.

The integrated electronic circuit1200also has an output1204which is configured to output Boolean secrets output by the one or more secret-carrying gates and/or binary output states output by the switching network1201to another integrated electronic circuit.

In other words, according to different embodiments, a switching logic is provided in an integrated circuit (e.g., on a chip), which comprises one or more secret-carrying gates (i.e. camouflage circuit such as MH gate). Output secrets are processed and supplied to the secret gates once again, such that the integrated circuit passes through a secret sequence of (logic) states.

The integrated electronic circuit thus implements a finite automaton. According to different embodiments, protection of a finite automaton against reverse engineering is thus achieved based on one or more secret-carrying cells (such as gates), each of which can carry and/or supply one or more Boolean secrets. An example of such secret-carrying cells is that of MH cells. However, it should be noted that a plurality of MH cells can be connected in succession to form a chain, such that the secret output by the chain in response to a state transition depends on a sequence of (more than one) previous state transitions. Since the current output value of an MH cell for (one or more) current input states (also) depends on the (one or more) immediately preceding input states, such that an MH cell apparently looks back one clock cycle in the past, by concatenating multiple MH cells it is possible to look back multiple clock cycles into the past.

For example, the output of the integrated circuit is a binary output with one or more bit lines. The states output from the output can be used by the other integrated circuit in different ways, e.g., as control information (e.g., control bits and/or control bit sequence), as part of a cryptographic key, etc.

A state that is supplied to a circuit and/or circuit component can be understood as a logic state. A signal can represent one or more states (over time). A state sequence is thus, for example, a signal that can change its logic level (typically 1 or 0) over time and can thus represent changing logic states.

In the following text various exemplary embodiments are specified.

Exemplary embodiment 1 is an integrated electronic circuit, as shown inFIG. 12.

Exemplary embodiment 2 is an integrated circuit as defined in exemplary embodiment 1, wherein the switching network implements a multiplexer.

Exemplary embodiment 3 is an integrated circuit as defined in exemplary embodiment 2, wherein the Boolean secrets output by the one or more secret-carrying gates control which binary control states are output by the multiplexer as binary output states.

Exemplary embodiment 4 is an integrated circuit as defined in any one of exemplary embodiments 1 to 3, wherein each secret-carrying gate comprises a plurality of field-effect transistor pairs connected in such a way that in response to a first transition from a first binary state of two nodes of the secret-carrying gate and in response to a second transition from a second binary state of the nodes of the secret-carrying gate, the nodes each have an undefined binary logic state if for each field-effect transistor pair the threshold voltages of the field-effect transistors of the field-effect transistor pair are equal, and the threshold voltages of the field-effect transistors of the field-effect transistor pairs are defined in such a way that the nodes each have one predefined binary logic state in response to the first transition and in response to the second transition.

Exemplary embodiment 5 is an integrated circuit as defined in any one of exemplary embodiments 1 to 3, wherein each secret-carrying gate comprises a plurality of field-effect transistor pairs configured such that (e.g., the plurality of field-effect transistor pairs may be connected in such a way that) in response to a first transition from a first binary input state of two input nodes of the secret-carrying gate and/or a second transition from a second binary input state of the input nodes of the secret-carrying gate, one of: if for each field-effect transistor pair of the plurality of field-effect transistor pairs, threshold voltages of the field-effect transistors of the field-effect transistor pair are equal, output nodes of the secret-carrying gate each have an undefined binary output state; or if for each field-effect transistor pair of one or more field-effect transistor pairs of the plurality of field-effect transistor pairs, threshold voltages of the field-effect transistors of the field-effect transistor pair are not equal, the output nodes each have one predefined binary output state based on threshold voltages of the field-effect transistors of the field-effect transistor pair (e.g., threshold voltages of field-effect transistors of the plurality of field-effect transistor pairs may be defined such that the output nodes each have one predefined binary output state in response to the first transition and/or the second transition).

Exemplary embodiment 6 is an integrated circuit as defined in exemplary embodiment 4 or 5, wherein Boolean secrets (e.g., Boolean secrets represented by a secret-carrying gate of the one or more secret-carrying gates) are predefined binary output states (e.g., predefined binary output states of output nodes of the secret-carrying gate).

Exemplary embodiment 7 is an integrated circuit as defined in any one of exemplary embodiments 4 to 6, wherein the secret-carrying gate has one or more pairs of competing paths, such that for each field-effect transistor pair, the two field-effect transistors of the field-effect transistor pair are located in different competing paths of a pair of competing paths.

Exemplary embodiment 8 is a chip having at least one integrated circuit as defined in any one of exemplary embodiments 1 to 7.

Exemplary embodiment 9 is a chip as defined in exemplary embodiment 8, having a plurality of integrated circuits as defined in any one of exemplary embodiments 1 to 7, in which a signal which is output from the output of a second one of the integrated circuits is fed to a first one of the integrated circuits.

Exemplary embodiment 10 is a chip as defined in exemplary embodiment 9, comprising a combination circuit configured to generate the binary control states of the first integrated circuit based on the signal output by the output of the second integrated circuit.

Exemplary embodiment 11 is a chip as defined in exemplary embodiment 9 or 10, in which a signal output by the output of the first integrated circuit is fed to the second integrated circuit.

Exemplary embodiment 12 is a chip as defined in exemplary embodiment 11, comprising a combination circuit configured to generate the binary control states of the second integrated circuit based on the signal output from the output of the first integrated circuit.

Exemplary embodiment 13 is a chip as defined in any one of exemplary embodiments 9 to 12, having a chain of integrated circuits formed by the plurality of integrated circuits, in which a signal output from the output of a preceding integrated circuit in the chain is fed to a following integrated circuit in the chain.

Exemplary embodiment 14 is a chip as defined in exemplary embodiment 13, wherein the following integrated circuit is supplied with the signal output from the output of the preceding integrated circuit as one or more of the binary control states and/or one or more binary states to be combined with stored binary output states (e.g., binary output states that are stored by memory of the chip and/or that are stored by the following integrated electronic circuit).

Exemplary embodiment 15 is a chip as defined in exemplary embodiment 13 or 3, in which a signal output from the output of the following integrated circuit in the chain is fed to the preceding integrated circuit in the chain.

Exemplary embodiment 16 is a chip as defined in exemplary embodiment 15, wherein the preceding integrated circuit is supplied with the signal output from the output of the following integrated circuit as one or more of the binary control states and/or one or more binary states to be combined with stored binary output states (e.g., binary output states that are stored by memory of the chip and/or that are stored by the preceding integrated circuit).

Exemplary embodiment 17 is a chip as defined in either of the exemplary embodiments 13 or 16, in which at least one of the integrated circuits in the chain is supplied with a signal output from the output of the following integrated circuit in the chain and a signal output from the output of the preceding integrated circuit in the chain.

Exemplary embodiment 18 is a chip as defined in exemplary embodiment 17, wherein the at least one integrated circuit is supplied with the signal output from the output of the following integrated circuit and with the signal output from the output of the preceding integrated circuit as one or more of the binary control states and/or one or more binary states to be combined with stored binary output states (e.g., binary output states that are stored by memory of the chip and/or that are stored by the at least one integrated circuit).

Exemplary embodiment 19 is a chip as defined in any one of exemplary embodiments 8 to 15, having a non-volatile memory that stores a value and is configured to supply the at least one integrated circuit with one or more of the binary control states and/or one or more binary states to be combined with stored binary output states (e.g., binary output states that are stored by the non-volatile memory and/or that are stored by the at least one integrated circuit). The non-volatile memory may be configured to supply the at least one integrated circuit with the one or more of the binary control states and/or the one or more binary states based on the value. Alternatively and/or additionally, the one or more of the binary control states and/or the one or more binary states may be combined with the stored binary output states based on the value.

Exemplary embodiment 20 is a chip as defined in exemplary embodiment 19, wherein the memory has a locking mechanism such that the memory can only be written to once.

Exemplary embodiment 21 is a chip as defined in exemplary embodiment 19 or 20, wherein the value is a chip-specific secret value.

Exemplary embodiment 22 is a chip as defined in any one of exemplary embodiments 8 to 21, having a processing circuit, wherein the output of at least one of the integrated circuits is configured to output Boolean secrets output by the one or more secret-carrying gates and/or binary output states output by the switching network to the processing circuit, and the processing circuit is configured to use a sequence of binary states received from the at least one integrated circuit as a cryptographic key.

According to one exemplary embodiment, an integrated electronic circuit is provided. The integrated electronic circuit may comprise a switching network configured to receive one or more control states. The integrated electronic circuit may comprise one or more secret-carrying gates, wherein each secret-carrying gate represents one or more Boolean secrets and is configured to receive one or more input signals and to output at least one of the Boolean secrets according to a chronological state sequence of the one or more input signals, and one or more flip-flops which are configured to store one or more binary output states output by the switching network and to supply binary input states to the one or more secret-carrying gates as the input signal or the plurality of input signals, wherein the switching network is configured to generate the one or more output signals by combining the one or more control signals and one or more of the Boolean secrets output by the one or more secret-carrying gates. The integrated electronic circuit may comprise an output configured to output one or more of the Boolean secrets output by the one or more secret-carrying gates, or one or more output signals output by the switching network, to another integrated electronic circuit.

Although the present disclosure has mainly been shown and described by reference to specific embodiments, it should be understood by those familiar with the technical field that numerous changes can be made with regard to its design and details without departing from the nature and scope of the present disclosure, as defined by the following claims. The scope of the present disclosure is therefore defined by the attached claims and it is intended that any changes that fall within the literal meaning or equivalent scope of the claims are included.

It may be appreciated that combinations of one or more embodiments described herein, including combinations of embodiments described with respect to different figures, are contemplated herein.

Any aspect or design described herein as an “example” is not necessarily to be construed as advantageous over other aspects or designs. Rather, use of the word “example” is intended to present one possible aspect and/or implementation that may pertain to the techniques presented herein. Such examples are not necessary for such techniques or intended to be limiting. Various embodiments of such techniques may include such an example, alone or in combination with other features, and/or may vary and/or omit the illustrated example.

As used in this application, the term “or” is intended to mean an inclusive “or” rather than an exclusive “or”. That is, unless specified otherwise, or clear from context, “X employs A or B” is intended to mean any of the natural inclusive permutations. That is, if X employs A; X employs

B; or X employs both A and B, then “X employs A or B” is satisfied under any of the foregoing instances. In addition, the articles “a” and “an” as used in this application and the appended claims may generally be construed to mean “one or more” unless specified otherwise or clear from context to be directed to a singular form. Also, unless specified otherwise, “first,” “second,” or the like are not intended to imply a temporal aspect, a spatial aspect, an ordering, etc. Rather, such terms are merely used as identifiers, names, etc. for features, elements, items, etc. For example, a first element and a second element generally correspond to element A and element B or two different or two identical elements or the same element.