SEMICONDUCTOR DEVICE HAVING ELECTROMAGNETIC INTERFERENCE (EMI) SENSORS AND A SENSING CIRCUIT TO DETECT EMI ATTACKS

A semiconductor device includes a secured circuit, an electromagnetic interference (EMI) sensor over a surface of the secured circuit, and a sensing circuit. The EMI sensor is configured to receive a reference voltage and the EMI sensor includes at least one of electric (E) field sensor or a magnetic (H) field sensor. The sensing circuit includes a hysteresis comparator and a voltage level comparator. The hysteresis comparator has a first input coupled to a first node of the EMI sensor via a low pass filter, a second input directly connected to the first node, and an output configured to provide an output indicative an EMI attack. An antenna portion of the EMI sensor includes the first node and is coupled between inputs of the voltage level comparator, in which the voltage comparator is configured to provide an output indicative of a physical tampering with the antenna portion.

BACKGROUND

Field

This disclosure relates generally to semiconductor devices, and more specifically, to a semiconductor device with electromagnetic interference (EMI) sensors and a sensing circuit to detect EMI attacks.

Related Art

In many applications today, electronic systems, such as automotive devices, smart cards, digital payment systems, etc., need to be safe and secure to meet end customer needs for the security of transactions and information. Today there are various types of side channel attacks, such as, for example, EMI attacks (in which EMI probes can be used to obtain secure data from secure subsystems) and physical tampering can compromise security. Therefore, a need exists for circuits with improved ability to prevent EMI attacks and detect physical tampering.

DETAILED DESCRIPTION

In one aspect, a semiconductor device includes EMI sensors, including an electric (E) field sensor and a magnetic (H) field sensor to avoid EMI attacks of the semiconductor device, such as on a secured circuit of the semiconductor device. The EMI sensors, along with a secure voltage reference, are used to monitor and detect possible EMI attacks, as well as physical tampering with the sensors. Voltage fluctuations on the secured voltage reference can be monitored to detect attacks. In one example, the EMI sensors may include separate metal-based E and H sensors to detect any spurious or harmful EMI attacks on the semiconductor device. The EMI sensors may be implemented over the surface of any secured circuit of the semiconductor device and are used to generate a failsafe response in the case an attack is detected to prevent hacking of secured data or information.

FIG.1illustrates a semiconductor device10, in accordance with one embodiment of the present invention. In one embodiment, semiconductor device10is implemented as an SoC, and may therefore be referred to as SoC10. SoC10includes a secured circuit30, a fault management circuit50, a power management circuit (PMC)12, a first voltage plane22configured to provide a first supply voltage, a second voltage plane24configured to provide a second supply voltage, and a third voltage planed configured to provide a third voltage source. In one embodiment, the third supply voltage (e.g. VDD) is greater than the second supply voltage (e.g. VSS), in which the second supply voltage may be ground or 0V. The first supply voltage (e.g. Vdd_secure reference) may also be greater than the second supply voltage. Each of the voltage planes are configured to receive their corresponding supply voltages from PMC12, in which PMC12includes a first voltage supply terminal16coupled to voltage plane22and configured to provide Vdd_secure reference (ref), a second voltage supply terminal18coupled to voltage plane24and configured to provide VSS, and a third voltage supply terminal20coupled to voltage plane26and configured to provide VDD. In one embodiment, PMC12includes one or more voltage regulators to provide the supply voltages. PMC12is also able to sense or monitor Vdd_secure ref through the metal plate capacitor structure formed by plane22.

Secured circuit30may include any type of security system or circuitry within SoC10. For example, in one embodiment, secured circuit30may include a hardware security engine (HSE), and a secure memory coupled to the HSE. The HSE may include, for example, cryptographic circuitry to encrypt or decrypt data. In one embodiment, secured circuit30is formed with rows of library cell circuits, and includes a power mesh grid36to provide VSS and VDD as needed to circuitry within secured circuit30. Electrical conductors28may route VSS, as needed, to power mesh grid36and secured circuit30, and electrical conductors34may route VDD, as needed to power mesh grid36and secured circuit30. (Note that power grid36and the conductors between the voltage planes and power grid36are representative of the grid and connections, and are not intended to illustrate precise connections. Also, there may be any number of conductors, such as conductors34and36, as needed, to provide the power connections.)

SoC10also includes sensors48, configured to receive Vdd_secure ref and coupled to EMI and tamper sensing circuit14. Note that EMI and tamper sensing circuit14may simply be referred to as sensing circuit14. Sensors48include an electric field (E field) sensor40and a magnetic field (H field) sensor42, in which each of these sensors may be a metal based sensor including any suitable metal. In the illustrated embodiment, sensors48are formed over plane22, and is also formed over a major surface of secured circuit30. In alternate embodiments, sensors48can be formed over a greater portion of SoC10, including more than secured circuit30, and may even be formed over a major surface of all of SoC10. Each of E field sensor40and H field sensor42are configured to receive the Vdd_secure ref, and each of E field sensor40and H field sensor42include one or more nodes coupled to sensing circuit14of PMC12. Any EMI attacks to SoC10would result in changes to the voltage on the Vdd_secure ref supply network, which is sensed by PMC12. In response to such changes, PMC12can assert a failsafe signal to indicate a possible attack, in which this signal can be provided to, for example, fault management circuit50. Fault management circuit50can be any type of system fault collector and manager, or any other master within SoC10and, in response to assertion of the failsafe signal, can place the system into a safe state to prevent hacking of any secure data from secured circuit30. In one embodiment, sensing circuit14can also detect any physical tampering of sensors40and42, in which case PMC12can also assert the failsafe signal in response to the physical tampering. Sensing circuit14will be described in more detail in reference toFIG.2below.

In the illustrated embodiment, H field sensor42is formed by a continuous metal ring which surrounds at least a portion of underlying secured circuit30(e.g. which mostly surrounds underlying secured circuit30). The continuous metal ring of H field sensor42is located in a plane which is over and parallel to a plane which contains secured circuit30. Although H field sensor42is illustrated as having a rectangular shape, it may be implemented with different shapes, such as by being more circular or oval in shape or having rounded corners. In one embodiment, a node at one end of the metal ring is connected to receive Vdd_secure ref, while a node at another end of the metal ring is connected to sensing circuit14. As described above, the ring formed by H field sensor42surrounds underlying secured circuit30, but in alternate embodiments, may surround more circuitry than just secured circuit30. As also illustrated inFIG.1, E field sensor40is formed of two interdigitated antenna portions, portion44and46, located in a plane that is over and parallel to a plane containing secured circuit30. Each antenna portion is a continuous metal line which “zig zags” or “snakes” over secured circuit30, running parallel to, and isolated from, the other antenna portion. E field sensor40is formed within H field sensor42, such that H field sensor42also mostly surrounds E field sensor40in the plane which contains both E field sensor40and H field sensor42. This plane is located over and parallel to the plane which contains secured circuit30. In this manner, E field sensor40is formed over most or all of underlying secured circuit30(in which, in alternate embodiments, may be formed over most or all of underlying secured circuit30and any additional portion or all of SoC10). Note that a node of one of the portions (e.g. portion44) is connected to receive Vdd_secure ref, while other nodes of the portions (e.g. portion44or46or both) are connected to sensing circuit14.

FIG.2illustrates, in partial block diagram and partial schematic form, further details of sensing circuit14coupled to both H field sensor42and E field sensor40, in accordance with one embodiment of the present invention. A first circuit portion76of sensor circuit14is coupled to E field sensor46, and includes voltage level comparators60and62, as well as a hysteresis comparator56. Comparators60and62provide level checking for tamper detection, and hysteresis comparator56detects a likely EMI probing attack resulting in changes to the E field. Hysteresis comparator56has a first input (e.g. a non-inverting input) coupled to a first node of antenna portion44via a low pass filter58, and a second input (e.g. inverting input) directly connected to the same first node of antenna portion44. The reference voltage, Vdd_secure ref, is provided at a second node of antenna portion44(at an opposite end of antenna portion44to the first node). In this manner, hysteresis comparator56compares the antenna voltage on antenna portion44with a low pass filtered version of the antenna voltage. Low pass filter58includes a resistive element coupled between the first node of antenna portion44at the input of low pass filter58and the first input of comparator56and a capacitive element coupled between the first input of comparator56and VSS (e.g. ground). Note that comparator56is referred to as a hysteresis comparator due to the hysteresis provided by low pass filter58. Note that the output of comparator56remains negated (at a logic level zero) while the inputs are equal, and so long as the antenna voltage moves slowly, comparator56does not overcome its threshold, causing the output to remain negated. However, when there is a spurious, fast moving voltage on the antenna voltage (such as caused by E fields with a frequency greater than the RC time constant of filter58), the output of comparator56is asserted (e.g. to a logic level one), to indicate such a change in the E field.

Each of comparators60and62may be referred to as anti-tamper level-based circuits. Comparator60has a first input coupled to a first node of antenna portion46and a second input coupled to VSS (e.g. ground). A second node at the opposite end of antenna portion46is also coupled to VSS (e.g. ground). Therefore, note that antenna portion46of E field sensor40is coupled between the first and second inputs of comparator60. An output of comparator60remains negated so long as antenna portion46remains physically intact. However, when it is physically compromised (e.g. scratched open), the output of comparator60is asserted. For example, in one embodiment, comparator60includes an offset which can accept small variations in signal, but once the level offset is overcome, the output of comparator60is asserted to indicate the physical tampering. Similarly, comparator62has a first input coupled to the first node of antenna portion44, in which a second node at the opposite end of antenna portion44is coupled, via a resistive element64, to a second input of comparator62, and Vdd_secure ref is provided at the second node of antenna portion44. Comparator62, similar to comparator60, detects physical tampering of antenna portion44. An output of comparator62remains negated (e.g. at a logic level zero) so long as antenna portion44remains physical intact, but if compromised, is asserted (e.g. to a logic level one) to indicate the physical tampering.

A second circuit portion78of sensor circuit14is coupled to H field sensor42, and includes a voltage level comparator72, as well as a hysteresis comparator70. Comparator72operates analogously to comparator62to provide level checking for tamper detection of sensor42(which may also be referred to as antenna42). Hysteresis comparator70operates analogously to hysteresis comparator56but for H field changes rather than E field changes in order to detect a likely EMI probing attack resulting in changes to the H field. Hysteresis comparator70has a first input (e.g. a non-inverting input) coupled to a first node of antenna42via a low pass filter68, and a second input (e.g. inverting input) directly connected to the same first node of antenna42. The reference voltage, Vdd_secure ref, is provided at a second node of antenna42(at the opposite end of antenna42to the first node). In this manner, hysteresis comparator70compares the antenna voltage on antenna42with a low pass filtered version of the antenna voltage. Low pass filter68includes a resistive element coupled between the first node of antenna42at the input of low pass filter68and the first input of comparator70and a capacitive element coupled between the first input of comparator70and VSS (e.g. ground). Note that comparator70is referred to as a hysteresis comparator due to the hysteresis provided by low pass filter68. Note that the output of comparator70remains negated (at a logic level zero) while the inputs are equal, and so long as the antenna voltage moves slowly, comparator70does not overcome its threshold, causing the output to remain negated. However, when there is a spurious, fast moving voltage on the antenna voltage (such as caused by H fields with a frequency greater than the RC time constant of filter68), the output of comparator70is asserted (e.g. to a logic level one), to indicate such a change in the H field. Note that the hysteresis comparators for E sensor40and H sensor42are capable of differentiating an EMI attack versus internal E and H fluctuations due to switching currents.

Comparator72may also be referred to as an anti-tamper level-based circuit. Comparator72has a first input coupled to a first node at a first end of antenna42and a second input coupled to a second node of antenna42, at a second and opposite end of antenna42to the first node. Therefore, note that antenna42(i.e. the H field sensor) is coupled between the first and second inputs of comparator72. An output of comparator72remains negated (e.g. at a logic level zero) so long as antenna42remains physically intact. However, when it is physically compromised (e.g. scratched open), the output of comparator72is asserted (e.g. to a logic level one). For example, in one embodiment, comparator72also includes an offset which can accept small variations in signal, but once the level offset is overcome, the output of comparator72is asserted to indicate the physical tampering.

In one embodiment, any assertion of any output of the hysteresis comparators56or70, or of the anti-tamper circuits (comparator60,62, or72), an EMI attack may be indicated, either due to an EMI probing attack which affects the E or H fields or due to physical tampering of any of the antennas (e.g.,44,46, or42). In response to the indication of the EMI attack, PMC12can assert the failsafe signal. In one embodiment, sensing circuit14includes both portions76and78in order to be able to detect either an EMI attack of the E field or the H field, and to be able to detect any physical tampering of the E field sensor or H field sensor. Alternatively, sensor circuit14may include only one of portions76and78.

Therefore, by now it should be appreciated that there has been provided an SoC (or semiconductor device) with E field and H field sensing circuits which may be used to detect EMI attacks. In one embodiment, a sensing circuit monitors the E field and H field sensors to detect EMI attacks and includes anti-tamper circuits to detect physical tampering with the sensors. In this manner, EMI attacks or physical tampering can be detected. In one embodiment, upon detection of such activity, a failsafe response is asserted in which, in response to assertion of the failsafe response, the SoC can be placed in a safe state to prevent hacking of any secure data or information from the SoC.

Some of the above embodiments, as applicable, may be implemented using a variety of different information processing systems. For example, althoughFIG.1and the discussion thereof describe an exemplary information processing architecture for a secured circuit, PMC, and core, this exemplary architecture is presented merely to provide a useful reference in discussing various aspects of the invention. For example, in alternate embodiments, the layout may differ and the SoC may include more or fewer circuits or modules. Of course, the description of the architecture has been simplified for purposes of discussion, and it is just one of many different types of appropriate architectures that may be used in accordance with the invention. Those skilled in the art will recognize that the boundaries between logic blocks are merely illustrative and that alternative embodiments may merge logic blocks or circuit elements or impose an alternate decomposition of functionality upon various logic blocks or circuit elements. Thus, it is to be understood that the architectures depicted herein are merely exemplary, and that in fact many other architectures can be implemented which achieve the same functionality.

Also for example, in one embodiment, the illustrated elements of SoC10are circuitry located on a single integrated circuit or within a same device. Alternatively, SoC10may not be a single SoC but may include any number of separate integrated circuits or separate devices interconnected with each other.

Although the invention is described herein with reference to specific embodiments, various modifications and changes can be made without departing from the scope of the present invention as set forth in the claims below. For example, each of the E field and H field sensors may include different shapes formed over the secured circuit which allow for detection of changes in the E field or H field, respectively. Accordingly, the specification and figures are to be regarded in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of the present invention. Any benefits, advantages, or solutions to problems that are described herein with regard to specific embodiments are not intended to be construed as a critical, required, or essential feature or element of any or all the claims.

The following are various embodiments of the present invention. Note that any of the aspects below can be used in any combination with each other and with any of the disclosed embodiments.

In one embodiment, a semiconductor device includes a secured circuit; an electromagnetic interference (EMI) sensor over a surface of the secured circuit, wherein the EMI sensor is configured to receive a reference voltage and the EMI sensor comprises at least one of an electric (E) field sensor or a magnetic (H) field sensor; and a sensing circuit coupled to the EMI sensor. The sensing circuit includes a hysteresis comparator having a first input coupled to a first node of the EMI sensor via a low pass filter and having a second input directly connected to the first node, and an output configured to provide an output indicative an EMI attack; and a voltage level comparator, wherein an antenna portion of the EMI sensor includes the first node and is coupled between inputs of the voltage level comparator, the voltage level comparator having an output configured to provide an output indicative of a physical tampering with the antenna portion. In one aspect, the EMI sensor includes the E field sensor, wherein the E field sensor has a first antenna portion isolated from and parallel to a second antenna portion, and the first node of the E field sensor is located at a first end of the first antenna portion. In a further aspect, a second node at a second end of the first antenna portion, opposite the first end, is configured to receive the reference voltage. In yet a further aspect, the voltage level comparator has a first input coupled to the first node of the first antenna portion and a second input coupled to the second node of the first antenna portion. In another further aspect of the above embodiment, each of the first and second antenna portions is a continuous metal line. In a further aspect, the first and second antenna portions zig zag within a plane that is parallel to a plane containing the secured circuit. In another further aspect of the above embodiment, the sensing circuit includes a second voltage level comparator, wherein the first antenna portion is coupled between inputs of the voltage level comparator and the second antenna portion is coupled between inputs of the second voltage level comparator. In yet a further aspect, the output of the voltage level comparator is configured to provide an output indicative of a physical tampering of the first antenna portion, and the second voltage level comparator has an output configured to provide an output indicative of a physical tampering of the second antenna portion. In another further aspect of the above embodiment, the EMI sensor comprises the E field sensor and the H field sensor, wherein the H field sensor includes an antenna which surrounds at least a portion of the E field sensor within a plane containing both the E field sensor and the H field sensor. In a further aspect, the first input of the hysteresis comparator is coupled to a first node of the E field sensor via the low pass filter and the second input of the hysteresis comparator is directly connected to the first node of the E field sensor, and the output of the hysteresis comparator is configured to provide an output indicative of the EMI attack in response to a change in an E field, and the first antenna portion of the E field sensor is coupled between input of the voltage level comparator, and the output of the voltage level comparator is configured to provide an output indicative of a physical tampering of the first antenna portion. In yet a further aspect, the semiconductor device further includes a second hysteresis comparator having a first input coupled to a first node of the H field sensor via a low pass filter and having a second input directly connected to the first node of the H field sensor, and an output configured to provide an output indicative of an EMI attack in response to a change in an H field; and a second voltage level comparator, wherein the antenna of the H field sensor is coupled between inputs of the second voltage level comparator, the second voltage level comparator having an output configured to provide an output indicative of a physical tampering with the antenna of the H field sensor. In another aspect of the above embodiment, the EMI sensor includes the H field sensor, wherein the H field sensor includes an antenna portion which surrounds at least a portion of the secured circuit in a plane parallel to a plane containing the secured circuit. In a further aspect, the H field sensor includes a continuous metal line, wherein the first node is located at a first end of the continuous metal line and a second node is located at a second end of the continuous metal line, opposite the first end, wherein the first node and the second node are coupled to inputs of the voltage level comparator.

In another embodiment, a semiconductor device includes a secured circuit; an electric field (E field) sensor; a magnetic field (H field) sensor, wherein the E field sensor and the H field sensor are both a plane that is over and parallel to a plane containing the secured circuit, wherein each of the E field sensor and the H field sensor is configured to receive a reference voltage; and a sensing circuit coupled to the H field sensor and the E field sensor, the sensing circuit includes a first hysteresis comparator configured to compare a first antenna voltage at a first node of the E field sensor to a filtered version of the first antenna voltage and provide an output indicative of an electromagnetic interference (EMI) attack due to an E field fluctuation; and a second hysteresis comparator configured to compare a second antenna voltage at a first node of the H field sensor to a filtered version of the second antenna voltage and provide an output indicative an electromagnetic interference (EMI) attack due to an H field fluctuation. In one aspect, the semiconductor device further includes a first voltage level comparator, wherein an antenna portion of the E field sensor is coupled between inputs of the first voltage level comparator, the first voltage level comparator configured to provide an output indicative of a physical tampering with the antenna portion of the E field sensor; and a second voltage level comparator, wherein an antenna portion of the H field sensor is coupled between inputs of the second voltage level comparator, the second voltage level comparator configured to provide an output indicative of a physical tampering with the antenna portion of the H field sensor. In yet a further aspect, the semiconductor device further includes a power management circuit (PMC) having the sensing circuit, wherein the PCM is configured to assert a failsafe indicator when at least one of the output of the first hysteresis comparator is asserted to indicate the EMI attack due to the E field fluctuation, the output of the second hysteresis comparator is asserted to indicate the EMI attack due to the H field fluctuation, the output of the first voltage level comparator is asserted to indicate the physical tampering with the antenna portion of the E field sensor, or the output of the second voltage level comparator is asserted to indicate the physical tampering with the antenna portion of the H field sensor. In yet an even further aspect, the semiconductor device is configured to enter a safe state in response to assertion of the failsafe indicator. In another further aspect, the E field sensor has a first antenna portion isolated from and parallel to a second antenna portion, and the first node of the E field sensor is located at a first end of the first antenna portion, and the H field sensor surrounds at least a portion of the first and second antenna portions of the E field sensor in the plane that is over and parallel to the plane containing the secured circuit. In a further aspect, each of the first and second antenna portions and the H field sensor include continuous metal lines, and the first and second antenna portions zig zag over the secure circuit. In another further aspect, the first antenna portion of the E field sensor is coupled between inputs of the first voltage level comparator such that the output of the first voltage level comparator is indicative of a physical tampering with the first antenna portion of the E field sensor, and the semiconductor device further includes a third voltage level comparator, wherein the second antenna portion of the E field sensor is coupled between inputs of the third voltage level comparator, the third voltage level comparator configured to provide an output indicative of a physical tampering with the second antenna portion of the E field sensor.