The present disclosure relates to integrated circuits, and more particularly, to an anti-tamper x-ray blocking package for secure integrated circuits and methods of manufacture and operation. In particular, the present disclosure relates to a structure including: one or more devices on a front side of a semiconductor material; a plurality of patterned metal layers under the one or more devices, located and structured to protect the one or more devices from an active intrusion; an insulator layer between the plurality of patterned metal layers; and at least one contact providing an electrical connection through the semiconductor material to a front side of the plurality of metals.

FIELD OF THE INVENTION

The present disclosure relates to integrated circuits, and more particularly, to an anti-tamper x-ray blocking package for secure integrated circuits and methods of manufacture and operation.

BACKGROUND

When using active x-ray spectrum analysis, a party can observe an integrated circuit under power and a voltage contrast and determine a functional state of the design. Further, it is possible to unlock a private key of devices once a decrypting step of the private key has occurred in a field programmable gate array (FPGA) and the register of the integrated circuit is first used. A known technique to prevent such unlocking can encompass package shielding, but this is still prone to tampering. Accordingly, known techniques have not been able to prevent uncovering of key technology and intellectual property in an integrated circuit.

SUMMARY

In an aspect of the disclosure, a structure comprises: one or more devices on a front side of a semiconductor material; a plurality of patterned metal layers under the one or more devices, located and structured to protect the one or more devices from an active intrusion; an insulator layer between the plurality of patterned metal layers; and at least one contact providing an electrical connection through the semiconductor material to a front side of the plurality of metals.

In another aspect of the disclosure, a structure comprises: at least one device on a front side of semiconductor material; a metal-insular-metal capacitor on a backside of the semiconductor material; at least one contact connecting to a front side of the metal-insular-metal capacitor and which extends through the semiconductor material; and a logic circuit connecting to the plurality of metals via the at least one contact, and which is configured to detect a capacitance change in the backside patterned metal layer.

In another aspect of the disclosure, a method comprises: forming one or more devices on a front side of a semiconductor material; forming a metal-insulator-metal capacitor under the one or more devices, located and structured to protect the one or more devices from an active intrusion; and forming at least one contact providing an electrical connection through the semiconductor material to a front side of the metal-insulator-metal capacitor.

DETAILED DESCRIPTION

The present disclosure relates to integrated circuits, and more particularly, to an anti-tamper x-ray blocking package for secure integrated circuits and methods of manufacture and operation. More specifically, the present disclosure provides multiple buried metal layers forming back end of the line (BEOL) passive devices (e.g., metal-insulator-metal capacitor (i.e., MIM cap), inductor, resistor, etc.) to detect and prevent radio frequency (RF) or an optical probing attack, e.g., x-ray attack. Accordingly and advantageously, the devices described in the present disclosure can prevent an active x-ray attack from determining a functional state of a circuit design and thereby preventing the theft of key technology and intellectual property. In addition, the devices described herein allow RF probing detection, which adds an additional layer of security.

In known circuits, an attack and/or analysis of a circuit functionality can occur on a circuit from scanning a backside of a chip across a die. The attack and/or analysis can capture the function of the device which can then be re-constructed. For example, the analysis can be performed through active and passive optical probing using photo emission (PE), electro-optical frequency modulation, or laser voltage techniques. To avoid such attacks and/or analysis, a charge trap logic structure can be used; however, in this type of circuit, the attack and/or analysis can occur after the charge trap device has been bypassed. Further, package shielding can prevent the attack and/or analysis on a circuit; however, the package shielding is susceptible to tampering.

To solve these and other issues, the present disclosure provides multiple buried metal layers, e.g., buried patterned metal or a backside patterned metal, to “blind” the attacker's x ray system from getting a clear picture of the functional circuit. For example, two or more metals are provided as BEOL structures. These BEOL structures can be resistors, inductors or capacitors for backside attack detection. In use, for example, any tampering to remove the metal changes the capacitance or inductance (of respective capacitor and inductor), which is detected by logic of the integrated circuit. A series of these structures can be added to the chip to “prevent” localized attack. Also, the placement of passive devices in the backside can save valuable chip space on the top side of the wafer, which can now be used for more front end of the line (FEOL) devices or for reduction in overall chip footprint or area.

In more specific embodiments, active and passive devices are formed on a front side of a wafer. A patterned metal is buried between a buried oxide layer (BOX) and a handle wafer with at least two metals and/or a via in between. The patterned metal can be a buried MIM cap. A contact provides an electrical connection from the patterned metal to the front side of the wafer. Further, a logic circuit detects a capacitance change in the patterned metal (like the buried MIM cap) and generates a tamper signal to alter a circuit operation.

In further embodiments, a patterned metal is on a backside of a wafer and buried between a handle wafer and a top wafer with at least two metals and a via in between. A contact provides an electrical connection from the buried metal to the front side of the wafer, and a logic circuit detects a capacitance change in the patterned metal. In further embodiments, multiple structures as described herein can be placed across an integrated circuit to protect against narrow beam direct attacks. These structures can include buried capacitors, inductors, and resistors. The patterned metal layers have dielectric regions under the radio frequency (RF) devices.

FIG. 1shows a substrate, amongst other features, and respective fabrication processes. The structure100ofFIG. 1can be representative of semiconductor on insulator (SOI) technologies. More specifically, inFIG. 1, the structure100includes a substrate115composed of semiconductor material120bonded or attached to an insulating layer130, and the insulating layer130bonded to a handle wafer140. The semiconductor material120can be bonded to the insulating layer130by using wafer bonding techniques and/or other suitable methods. In embodiments, the handle wafer140and semiconductor material120may be composed of any suitable material including, but not limited to, Si, SiGe, SiGeC, GaAs, InAs, InP, and other III/V or II/VI compound semiconductors.

The insulating layer130is also formed by any suitable process, such as separation by implantation of oxygen (SIMOX), oxidation, deposition, and/or other suitable process. The insulator layer130comprises any suitable material, including silicon oxide, sapphire, or other suitable insulating materials, and/or combinations thereof. An exemplary insulator layer130may be a buried oxide layer (BOX). In embodiments, the semiconductor material120and the insulator layer130can have a thickness of about 100 nanometers; although other dimensions are also contemplated herein.

FIG. 2shows front end of the line (FEOL) devices and substrate contacts, amongst other features and respective fabrication processes. InFIG. 2, devices160are formed within or on the semiconductor material120. The devices160can be either active (e.g., logic or RF transistors) or passive devices (e.g., diodes or resistors). For example, the devices160can be transistors, resistors, capacitors, combinations thereof, etc. In embodiments, the devices160can be formed by conventional CMOS processes such that no further explanation is needed for a complete understanding of the present disclosure.

FIG. 2further shows a plurality of contacts150formed by conventional lithography, etching and deposition methods known to those of skill in the art. For example, a resist formed over the semiconductor material120is exposed to energy (light) to form a pattern (opening). An etching process with a selective chemistry, e.g., reactive ion etching (RIE), will be used to form one or more trenches in the semiconductor material120and the insulating layer130through the openings of the resist. Following the resist removal by a conventional oxygen ashing process or other known stripants, metal material can be deposited within the trenches to form a plurality of contacts150, e.g., body contacts. In embodiments, the metal material can be aluminum or tungsten (e.g., WSi) or Copper, amongst other materials, deposited by any conventional deposition processes, e.g., chemical vapor deposition (CVD) processes. Any residual material on the surface of the semiconductor material120can be removed by chemical mechanical polishing (CMP) processes.

FIG. 3shows formation of a back end of the line (BEOL) stack, amongst other features and respective fabrication processes. InFIG. 3, the back end of the line (BEOL) stack110is formed over the semiconductor material120and comprises metal wiring and via interconnects embedded within dielectric material.

FIG. 4shows substrate contacts150connected through the BEOL stack110, amongst other features and respective fabrication processes. In particular, a plurality of substrate contacts155are formed though the dielectric material of the BEOL stack110using conventional lithography, etching and deposition methods as already described herein. The substrate contacts155can be electrically connected to the plurality of contacts150.

Still referring toFIG. 4, a dummy handle wafer170is attached to the BEOL stack110by conventional bonding processes. For example, the dummy handle wafer170can be bonded to the BEOL stack110by contact bonding or thermo-compression bonding. Contact bonding uses a liquid-like curable adhesive layer that is coated onto a carrier wafer; whereas, thermo compression process comprises heating and applying thermal and mechanical pressure to two joining bodies. Further, a thinning of the backside (e.g., the handle wafer140) is performed by a chemical mechanical polishing (CMP) process, as known by one of ordinary skill in the art.

InFIG. 5, the structure100ofFIG. 4is flipped over, e.g., upside down. A first metal180is deposited on the wafer130by conventional deposition methods, followed by a patterning process, e.g., lithography and etching, to form different metal patterns. An insulator material190is deposited over the first metal180by conventional deposition techniques, e.g., CVD. A plurality of via contacts200are formed in the insulator material190using conventional lithography, etching and deposition processes as already described herein. The via contacts200extend through the insulator layer190and contact the patterned metal layer180. A second metal210is deposited over the insulator layer190, followed by a patterning process. In this way, a MIM capacitor can be formed from the combination of the patterned metals180,210and the insulator layer190. The MIM capacitor can have many different structural configurations, depending on the patterning. For example, and as discussed in more detail below, the MIM capacitor can be provided in a gridded format. These patterned metal structures can also be representative of an inductor.

InFIG. 6, the structure is flipped back, e.g., right side up. Following the flip process, the dummy handle wafer170is removed by conventional processes including mechanical polishing, debonding or other known process. The removal of the dummy handle wafer170will expose the BEOL stack110. A handle wafer220is attached to the second metal210by conventional bonding processes, e.g., contact bonding or thermo-compression bonding. In embodiments, the handle wafer220is attached to the second metal210prior to the removal of the dummy handle wafer170.

FIG. 7shows an optional insulator material230region under radio-frequency (RF) devices. This optional insulator material230prevents any interference of the BEOL metal stack with the RF devices which can affect RF performance. In embodiments, the insulator material230region comprises a dielectric material which can be formed by either an additive or subtractive process known to those of skill in the art. For example, in a subtractive process, the layers180,190,200can be removed by selective chemistries (e.g., RIE process), followed by a deposition of the insulator material230. In an additive process, the insulator material230can first be deposited, followed by partially removal for the formation of the appropriate devices, stacks, etc.

By implementing the processes described herein, the present disclosure includes a SOI wafer and utilizes a layer transfer process to form patterned metals (e.g., which form a capacitive structure) between the insulator layer130(i.e., the BOX layer) and the handle wafer220. Further, the buried patterned metallization (i.e., the first metal180and the second metal210) with body contacts (i.e., contacts150) is connected to a logic circuit. The logic circuit can be utilized to detect any tampering of the backside metal (i.e., the first metal180and the second metal210). For example, any attempts to remove the handle wafer220and the buried metal (i.e., the first metal180and the second metal210) will result in a higher capacitance measured by the logic circuit through contacts150, which will trigger a tamper signal. The logic circuit for detecting capacitance changes can be any known circuit design.

FIGS. 8 and 9show plan views of a MIM capacitor formed from the combination of the first metal180, the second metal210, and the insulator layer190using SOI technologies (e.g., similar toFIG. 7). In a top view240of the structure100ofFIG. 8, the buried capacitor structure (i.e., MIM capacitor) includes the first metal180overlaid over the second metal210in a grid pattern, e.g., criss-cross/mesh pattern, on the backside of the device. The grid pattern effectively blocks X-ray attacks from seeing a functional circuit. It should be understood that other patterns (i.e., circle mesh, square mesh, rectangular mesh, and solid mesh) and dimensions of the mesh are contemplated by the present disclosure. In the present disclosure, a change in capacitance is detected when an attacker tires to remove the grid pattern.

Still referring toFIG. 8, the contacts150are provided in a buried oxide (BOX) layer (i.e., the insulating layer130) close to the handle wafer140. The contacts150are also on top of and connected to the first metal180. Further, the first metal180is connected to the second metal210through the via contacts200. In an x-section view250, the contacts150are on top of the first metal180in the insulator190. In an x-section view260, the first metal180is connected to the second metal210through the via contacts200. In an x-section270, the first metal180is on top of the insulator190and the insulator190is on the second metal210.

InFIG. 9, there is no via contact as is the case with the structure shown inFIG. 8. Similar toFIG. 8, inFIG. 9, the first metal180and the second metal210form a metal-insulator-metal capacitor (i.e., MIM capacitor). Further, the contacts150are provided in a buried oxide (BOX) layer (i.e., the insulating layer130) close to the handle wafer140. InFIG. 9, the MIM capacitor is configured as a grid pattern; although other patterns (i.e., circle mesh, square mesh, rectangular mesh, and solid mesh) and dimensions are contemplated by the present disclosure.

Still referring toFIG. 9, in an x-section view285, the contacts150are on top of the second metal210in the insulator190. In an x-section view290, the contacts150are on top of the first metal180. In an x-section295, the first metal180is on top of the insulator190and the insulator190is on the second metal210.

FIGS. 10-12show a through-silicon via (TSV) process and related structures with a backside metal in accordance with aspects of the present disclosure. InFIG. 10, the structure100aincludes a bulk silicon wafer305with a silicon germanium (SiGe) material320grown on the bulk silicon wafer305. In particular, the SiGe material320can be 10-20% Ge and 80-90% Si. The SiGe material320can be 100 nanometers or thicker to act as a marker layer, e.g., etch stop, and the bulk wafer310can be about 0.1 to 100 microns; although other dimensions are also contemplated herein. In embodiments, the semiconductor material310can be single crystalline Si material; although other semiconductor materials as noted herein are also contemplated. In further embodiments, the SiGe stack320can be excluded, with an etch being performed based on a final wafer thickness.

InFIGS. 10 and 11, the back end of the line (BEOL) stack110is formed on the semiconductor material310by conventional CMOS processes as already described herein. In embodiments, the BEOL stack110can comprise a stack of metals and vias for wiring including inductors, resistors, and capacitors. Further, devices160are formed on the semiconductor material310. The devices160can be either active or passive devices (e.g., RF devices) as described herein. Further, for the TSV process on the bulk wafer, the backside of the wafer is thinned to expose the TSV metal on the bottom. Depending on the final thickness of the wafer, similar toFIG. 4, there may need to be a dummy handle wafer (e.g., if the final thickness of the wafer is under 50 microns).

FIGS. 10-12shows a plurality of through-silicon via (TSV) contacts330formed by conventional lithography, etching and deposition methods known to those of skill in the art such that no further explanation is required for an understanding of the present disclosure. The TSV contacts330can extend through the BEOL stack110, semiconductor material310, SiGe material320, and into the wafer305.

InFIG. 12, the wafer305is thinned to a depth of the SiGe material320. Due to the material selectivity between the wafer305and SiGe material320, the SiGe material320can be used as an etch stop layer during a backside etch. Following the SiGe material320removal, the TSVs330are exposed and a first metal180is deposited by conventional deposition methods, followed by a patterning process, e.g., lithography and etching, to form different metal patterns as already described herein. An insulator layer190(e.g., a dielectric) is deposited to the backside of the first metal180by conventional techniques, e.g., CVD. A plurality of via contacts200are formed within the insulator layer190by conventional lithography, etching and deposition methods as already described herein. The via contacts200can extend through the insulator190. A second metal210is formed to the backside of the insulator190, which is also patterned. In an optional embodiment, a handle wafer220can be attached to the second metal210by conventional bonding processes. For example, the handle wafer220can be bonded to the second metal210by contact bonding or thereto-compression bonding.

In alternative embodiments, the SiGe material320can remain on the semiconductor material310as shown representatively inFIG. 12by the dashed line. In this embodiment, the first metal layer180is formed on the backside of the SiGe material320, in electrical contact with the TSV contacts330. In any of the embodiments and as previously noted, metallization (i.e., first metal180and second metal210to form a capacitor or inductor) on the backside of the wafer will prevent scanning electron microscope/transmission electron microscope (SEM/TEM) electrons from reaching the device160.

FIG. 13shows a top view ofFIG. 12, which includes a buried capacitor structure in a bulk wafer, amongst other features. The buried capacitor structure can also be representative of an inductor. In particular,FIG. 13shows the TSV contacts330, the first metal180, the via contacts200, and the second metal210. InFIG. 13, the first metal180and the second metal210form a metal-insulator-metal capacitor (i.e., MIM capacitor). Further, the TSV contacts330are built in the BEOL stack110and the semiconductor material310. InFIG. 13, the MIM capacitor (i.e., the first metal180and the second metal210) is configured as grid pattern, e.g., mesh/criss-cross pattern, to block any X-ray attacks. Again, other patterns (i.e., circle mesh, square mesh, rectangular mesh, and solid mesh) and dimensions of the mesh can be used in the present disclosure. In the present disclosure, a change in capacitance is detected when an attacker tires to remove the grid pattern.

By implementing the processes described herein, patterned backside metallization (i.e., the first metal180and the second metal210) with TSV contacts330connected to a logic circuit which can be utilized to detect tampering. For example, any attempts to remove the insulator190and the buried metal (i.e., the first metal180and the second metal210) will result in a higher capacitance measured by the logic circuit through TSV contacts330. This, in turn, will trigger a tamper signal. The logic circuit for detecting capacitance changes can be any known circuit design.

In still further embodiments, the first metal180and the second metal210can be used as resistors, capacitors, and/or inductors for detecting a backside attack. The location of the first metal180and the second metal210in the backside of the structures100,100acan save space on the top of a wafer. Further, a series of the structures100,100acan be added to a chip to prevent localized attacks. In further embodiments, a unique signature can be programmed into a system by applying a different photo composition on chips and/or wafers.

In further embodiments, a buried MIM capacitor as described above can be implemented with a planar inductor and a front end of the line (FEOL) circuit used as a simple inductance-capacitance (LC) oscillator. This is represented with the first metal180, the second metal210, and the insulator layer190(i.e., MIM capacitor) with an inductor and a FEOL circuit. In these implementations, electromagnetic (EM) or radio frequency (RF) injection probing attacks will change the inductance (L) or capacitance (C) of a circuit which can be detected by a change in an oscillation/resonant frequency of an LC oscillator. In an example, one plate or metal layer (i.e., backside) can be connected to one node of the LC circuit and can be used to detect a change in capacitance. If part of the metal layer is damaged in any way, it causes a change in capacitance of the system, which translates to a change in frequency that can be measured by a device (i.e., an inductance to digital converter (LDC) or a frequency digital converter (FDC) can detect a change in L/C or a filter can be used). Further, if there is a RF probe attack near the MIM capacitor or the backside of a chip, this can be detected using the MIM capacitor and/or an inductor.

An anti-tamper x-ray blocking package can be utilized in system on chip (SoC) technology. It should be understood by those of skill in the art that SoC is an integrated circuit (also known as a “chip”) that integrates all components of an electronic system on a single chip or substrate. As the components are integrated on a single substrate, SoCs consume much less power and take up much less area than multi-chip designs with equivalent functionality. Because of this, SoCs are becoming the dominant force in the mobile computing (such as Smartphones) and edge computing markets. SoC is also commonly used in embedded systems and the Internet of Things.