Decoy security based on stress-engineered substrates

A system includes a stress-engineered substrate comprising at least one tensile stress layer having a residual tensile stress and at least one compressive stress layer having a residual compressive stress. The at least one tensile layer and the at least one compressive layer are coupled such that the at least one tensile stress layer and the at least one compressive stress layer are self-equilibrating. At least one functional device is disposed on the stress-engineered substrate. The stress-engineered substrate is configured to fracture in response to energy applied to the substrate. Fracturing the stress-engineered substrate also fractures the functional device. The system includes at least one decoy device. Fragments of the decoy device are configured to obscure one or more physical characteristics of the functional device and/or one or more functional characteristics of the functional device after the functional device is fractured.

TECHNICAL FIELD

This disclosure relates generally to devices comprising stress-engineered substrates configured to fracture in response to an applied energy and to related methods and systems.

BACKGROUND

Electronic systems capable of fracturing in a controlled, triggerable manner are useful in a variety of applications, such as maintaining security and supply chain integrity.

BRIEF SUMMARY

Some embodiments are directed to a system that includes a stress-engineered substrate. The stress-engineered substrate comprises at least one tensile stress layer having a residual tensile stress and at least one compressive stress layer having a residual compressive stress. The at least one tensile layer and the at least one compressive layer are coupled such that the at least one tensile stress layer and the at least one compressive stress layer are self-equilibrating. At least one functional device is disposed on the stress-engineered substrate. The stress-engineered substrate is configured to fracture in response to energy applied to the stress-engineered substrate. Fracturing the stress-engineered substrate also fractures the functional device. The system includes at least one decoy device. Fragments of the decoy device are configured to obscure one or more physical characteristics of the functional device and/or one or more functional characteristics of the functional device after the functional device is fractured.

Some embodiments involve a method of maintaining the security of a functional device. Energy is applied to a stress-engineered substrate having at least one functional device disposed thereon. The stress-engineered substrate comprises at least one tensile stress layer having a residual tensile stress and at least one compressive stress layer having a residual compressive stress. The at least one tensile layer and the at least one compressive layer are coupled such that the at least one tensile stress layer and the at least one compressive stress layer are self-equilibrating. The applied energy creates an initial fracture in the stress-engineered substrate. The initial fracture generates propagating fractures in the stress-engineered substrate. The propagating fractures fragment the substrate and the functional device. One or more functional characteristics and/or one or more physical characteristics of the functional device are obscured by fragments of a decoy device.

The above summary is not intended to describe each embodiment or every implementation. A more complete understanding will become apparent and appreciated by referring to the following detailed description and claims in conjunction with the accompanying drawings.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

Stress-engineered substrate technology can be used to fragment devices such as integrated circuits into smaller pieces to prevent a hostile party from obtaining information about the devices. Depending on the size of the fragmentation, the ability to reconstruct the devices and/or retrieve data stored in the devices will vary. Embodiments disclosed herein relate to additional measures beyond fragmentation that can be used to create confusion for the hostile party. These additional measures make it more difficult for the hostile party to extract information such as circuit design and/or stored data from fragmented chips.

FIG. 1is a diagram of a system100comprising at least one functional device120and at least one decoy device130. In many systems multiple functional device and/or multiple decoy devices may be present.FIG. 1illustrates both the functional device120and the decoy device130disposed on a frangible, stress-engineered substrate110. As discussed further herein, in other implementations the functional120and decoy130devices may not be disposed on the same substrate.

The functional120and the decoy130devices may be any type of devices. The functional device120may comprise one or more integrated circuits and the decoy device130may comprise one or more integrated circuits. In some embodiments, the functional120and decoy130devices are integrated circuits fabricated using well-known low-cost fabrication techniques (e.g., CMOS or SOI), for example.

The substrate110is stressed such that when a small initial fracture is created in the substrate110, the initial fracture causes propagating fractures that transmit through the substrate110. When the functional120and decoy130devices are co-located on the same substrate110as inFIG. 1, the propagating fractures cause the substrate110, the functional device120and the decoy device130to break into pieces123.

The decoy device130may be positioned relative to the functional device120so that when fragmentation occurs, the fragments of the decoy device130mix with the fragments of the functional device120. For example, the decoy device130may be placed near the functional device120so that when fragmentation of the functional120and decoy130devices occurs, the fragments of the decoy device130mix with the fragments of the functional device120making reconstitution of the functional device difficult to accomplish.

The system may be configured such that fragmentation occurs of functional device120and the decoy device130occurs substantially simultaneously or close in time. In some embodiments, the decoy device130may fragment before and/or or after fragmentation of the functional device120. In some embodiments, the system100may include multiple decoy devices130, at least one of the multiple decoy devices130arranged to fragment before fragmentation of the functional device120and at least another of the multiple decoy devices130arranged to fragment after fragmentation of the functional device120.

The decoy device130is designed to create confusion if an attempt is made to reassemble the pieces123to reconstitute and/or reanimate the functional device120after the functional device120is fragmented. The decoy device130may be designed to obscure physical and/or functional characteristics of the functional device after the decoy device130and the functional device120are fragmented. For example, the decoy device130may obscure one or more physical characteristics of the functional device such as mass, size, shape, material, and/or coatings of the functional device120.

The functional and decoy device may be fragmented in a way that makes it difficult to distinguish which fragments belong to the functional device and which fragments belong to the decoy device. Such fragmentation makes it difficult to discern the mass, size or shape of the functional device from the fragments123of the decoy device130and the functional device120.

In some embodiments, the decoy device130is composed entirely of the same materials as the functional device120. Alternatively, the decoy device130may include one or more materials some or all of which are different from the materials of the functional device120. For example, the decoy device130may include one or more decoy materials wherein the decoy materials are not needed to support or enhance the functionality of the functional device. In some embodiments, both the functional120and the decoy130devices may include the decoy materials.

According to some implementations, the functional device120comprises one or more first coatings and the decoy device comprises one or more second coatings. Some or none of the second coatings may be the same as the first coatings of the functional device. For example, the decoy device and/or the functional device may comprise decoy coatings.

In some embodiments, when the functional device120is fragmented, the fragments of the functional device120have a first thickness or a plurality of first thicknesses. When the decoy device is fragmented, the fragments of the decoy device130may comprise fragments have a second thickness or a plurality of second thicknesses different from the first thicknesses. In some implementations, fragments of the functional device may include some of the second thicknesses and/or fragments of the decoy device may include some of the first thicknesses.

The decoy device130may obscure one or more functional characteristics of the functional device120such as circuit design, circuit operation and/or data stored in the functional device120. In some embodiments, the decoy device130may include decoy circuits that are different from the circuits of the functional device120. The decoy circuits may be arranged such that the circuit design and/or circuit operation of the functional device120is obscured by the decoy circuits when both the decoy device130and functional device120are fragmented.

In some embodiments, the decoy device130includes one or more integrated circuits that are identical to or similar to the integrated circuits of the functional device120. The decoy device circuits store data that is different from the data stored in the integrated circuits of the functional device120. The data stored in the decoy device130may corrupt the data stored in the functional device120when both devices120,130when a hostile party tries to reconstitute the data stored in the functional device120from the fragments123. For example, in some embodiments the data stored in the decoy device130may be null data.

The decoy device need not be on the same substrate as the functional device.FIG. 2Aillustrates the functional device220disposed on a first substrate211and the decoy device230disposed on a separate second substrate212. The substrate211is stressed such that when a small initial fracture is created in the substrate211, the initial fracture causes propagating fractures that transmit through the substrate211and into the functional device220, breaking the functional device220into pieces. Similarly, the substrate212is stressed such that when a small initial fracture is created in the substrate212, the initial fracture causes propagating fractures that transmit through the substrate212and into the decoy device230, breaking the decoy device230into pieces. The fracture of the first substrate211and the functional device220may occur concurrently or close in time with the fracture of the second substrate212and the decoy device230. The first substrate211and the functional device220may be physically located close to second substrate212and the decoy device230. The fracture of the first and second substrates211,212and the functional and decoy devices220,230produces fragments223that obscure the mechanical and/or functional characteristics of the functional device220.

As depicted inFIG. 2B, in some implementations the first and second substrates211,212may be mechanically coupled such that the propagating fractures propagate from one substrate211,212to the other212,211, fragmenting both substrates211,212, the functional device220and the decoy device230.

FIG. 3illustrates an embodiment in which the decoy device is pre-fragmented, such that the decoy device is a plurality fragments331. The functional device320is disposed on a substrate310. An initial fracture in the substrate causes propagating fractures through the substrate310and the functional device320. The fragments of the substrate310and the functional device320combine with the fragments of the decoy device331, obscuring mechanical and/or functional characteristics of the functional device320.FIG. 3shows the combined fragments123.

According to some embodiments, as shown inFIG. 4, an integrated circuit450disposed on a stress-engineered substrate410includes both the functional device420and the decoy device430. An initial fracture in the stress-engineered substrate410causes propagating fractures that fragment423the integrated circuit450including the functional device420and the decoy device430.

The process used in preparing the stress-engineered substrate, e.g., chemical tempering, imparts a large stress gradient within the thickness of the support substrate. This stored mechanical energy is abruptly released when an initial fracture is formed. In some embodiments discussed below, the initial fracture is caused when a localized area is heated. For example, rapid heating and subsequent cooling damage the substrate leading to the initial fracture and propagating fractures.

As shown in the cross sectional view ofFIG. 1the stress-engineered substrate110may be a wafer-like structure including at least one tensile stress layer115having a residual tensile stress and at least one compressive stress layer116having a residual compressive stress. Tensile stress layer115and compressive stress layer116(collectively referred to herein as “stress-engineered layers”) can be operably integrally connected together such that residual tensile and compressive stresses are self-equilibrating and produce a stress gradient. As set forth in additional detail below, the stress-engineered layers116and115may be fabricated either by post-treating a substrate material using strategies similar to glass tempering (e.g., by way of heat or chemical treatment), or by depositing the substrate layers using, for example chemical, vapor deposition techniques in which the deposition parameters (i.e., temperature, pressure, chemistry) are varied such that the layers collectively contain a significant inbuilt stress gradient. Note that the arrangement of stress-engineered layers116and115indicated inFIG. 1is not intended to be limiting in that one or more stress-engineered and/or non-stressed substrate layers may be disposed on and/or between the two stress-engineered layers.

Various methods may be used to fabricate the stress-engineered substrate. One example approach involves thin film sputter deposition. In thin film sputter deposition, generally two distinct regimes can be identified leading to very different film morphology and characteristics, and result in either compressive or tensile stress. Metals are often used because of functionality (e.g., electrical properties), their structural qualities (e.g., ductility), and the fact that a conductive sputter target allows for a simple, high yield, glow discharge DC magnetron sputtering process. However, stress-engineered metal oxides and glasses (silicon oxides) can be sputtered as well; these insulating or semiconducting films can be sputter deposited by either radiofrequency (RF) sputtering or by reactive sputtering in a mixed inert/reactive gas plasma (e.g. argon/oxygen).

To achieve reliable fragmentation of the stress-engineered substrate, a method for generating stressed support substrates involves adapting stress-engineered thin film fabrication techniques with ion-exchange tempering to create stress profiles in glass (SiO2) substrates, e.g., glass (SiO2) substrates.

FIGS. 5A to 5Eillustrate a first methodology in which a stress-engineered support substrate510A is built up by patterned SiO2stress-engineered support substrates generated entirely using plasma vapor deposition (PVD) techniques. This method provides a high degree of control over the specific stress profile generated in the stress-engineered support substrate and provides for continuous control over glass formulation and morphology through the thickness dimension of the stress-engineered support substrate. A wafer500(e.g., silicon or other material) is coated with a release layer510, most likely a metal. InFIG. 5B, a thick liftoff mask520is then patterned on release layer510such that mask520defines an opening522. Note that wafer500, release layer510, and mask520form a sacrificial structure. Referring toFIGS. 5C and 5D, PVD processing is then used to create the stress engineered layers510A-1and510A-2in opening522, placing stresses in the deposited substrate material530-1and530-2, for example, by altering the process parameters (e.g., using different temperatures T1and T2and/or pressures P1and P2). Finally, as indicated inFIG. 5E, the mask is then lifted off, and stress-engineered substrate510A is singulated (removed) from the remaining sacrificial structure by under-etching the release layer.

FIGS. 6A to 6Eillustrate a second methodology in which a stress-engineered support substrate610B is built up by patterned SiO2on a thin glass core using PVD techniques. This methodology provides a high degree of control over the specific stress profile generated in the stress-engineered support substrate. Referring toFIG. 6A, the process begins using a substantially unstressed glass core substrate610B-0having a thickness T0in the range of 25 μm and 100 μm. Suitable glass core substrates are currently produced by Schott North America, Inc. of Elmsford, N.Y., USA). Referring toFIGS. 6B to 6E, SiO2is then deposited on alternating sides of core substrate410B-0via PVD using methods similar to those described above. Specifically,FIG. 6Bshows the deposition of material630-1in a manner that forms stress-engineered layer610B-11on core substrate610B-0.FIG. 6Cshows the deposition of material630-2in a manner that forms stress-engineered layer610B-21on an opposite side of core substrate610B-0.FIG. 6Cshows the subsequent deposition of material630-1in a manner that forms stress-engineered layer610B-12on core layer610B-11, andFIG. 6Eshows the deposition of material630-2in a manner that forms stress-engineered layer610B-22layer610B-21.FIG. 6Eshows completed stress-engineered support substrate610B including core substrate (central, substantially unstressed layer)610B-0with stress-engineered layers610B-11,610B-12,610B-21and610B-22formed thereon.

FIGS. 7A to 7Eillustrate a third methodology in which a stress-engineered substrate710C is produced by subjecting a core substrate to one of an ion-exchange tempering treatment, a chemical treatment and a thermal treatment. Specifically,FIGS. 7A to 7Eillustrate an exemplary ion-exchange tempering treatment during which various stress profiles are introduced in a core substrate via molten-salt ion exchange.FIG. 7Ashows a core substrate710C-0over a vat750containing a molten-salt solution755.FIG. 7Bshows core substrate710C-0immediately after submersion in molten-salt solution755,FIG. 7Cshows core substrate710C-0after a first time period of submersion in molten-salt solution555in which a first stress-engineered layer710C-1is formed, andFIG. 7Dshows the structure after a second time period of submersion in molten-salt solution755in which a second stress-engineered layer710C-2is formed on first stress-engineered layer710C-1.FIG. 7Eshows completed stress-engineered support substrate700C including central core substrate710C-0and stress-engineered layers710C-1and710C-2.

According to a fourth methodology, a hybrid of the above second and third methods is employed in which diced, thin glass core substrates are ion-exchange tempered, and then multiple layers of SiO2 are deposited on the tempered substrates to further increase the induced stresses.

According to some embodiments, the system may also include a triggering mechanism that supplies the energy that create the initial fracture. For example, the trigger mechanism may supply mechanical energy, thermal energy, electrical energy, chemical energy, magnetic energy, and/or optical energy to create the initial fracture. The trigger mechanism may operate in response to a trigger signal that can be generated manually or by a sensor configured to sense a trigger stimuli. The trigger stimuli may comprise one or more of electromagnetic radiation (e.g., radio frequency (RF) radiation, infrared (IR radiation), visible light, ultraviolet (UV) radiation, x-ray radiation, etc.), vibration, a chemical, vapor, gas, sound, temperature, passage of time, moisture, an environmental condition, etc. For embodiments in which the trigger stimulus is visible light, the sensor may be configured to generate the trigger signal in response to exposure to broadband light, such as sunlight or room light, or narrow band light, such as green, red, or blue visible light. For example, the green, red or blue light may be produced by a laser.

In some embodiments, the sensor is configured to detect a tampering event. For example, the tampering event can be detected when the device is exposed to a chemical used for removal of a package cover, the device is vibrated above a threshold vibration, and/or if snooping with x-rays occurs.

In some embodiments, the sensor is a clock that detects the passage of time. After a predetermined amount of time has passed, a trigger signal is generated to activate the trigger mechanism.

In some embodiments, the trigger mechanism may supply mechanical energy to the substrate to form the initial fracture. The initial fracture can be formed by a mechanical impact, e.g. supplied by an electromagnet or other actuator. In some embodiments, the initial fracture can be formed by concurrently creating a weakened region and applying mechanical stress to the substrate sufficient to cause the initial fracture as discussed in commonly owned U.S. patent application Ser. No. 15/981,328 filed May 16, 2018 which is incorporated herein by reference.

The trigger mechanism may supply thermal energy in the form of sudden heating and/or cooling to create the initial fracture as discussed in commonly owned U.S. patent application Ser. Nos. 15/220,164 and 15/220,221 filed Jul. 26, 2016 which are incorporated herein by reference. Electrical energy in the form of current may flow through a resistive heater disposed on the substrate to provide the fracture initiating thermal energy. Alternatively, optical energy in the form of intense laser radiation may be directed to an optical absorber pad on the substrate The intense radiation heats the absorber pad operates as a trigger mechanism that generates heat which provides the fracture initiating thermal energy. In some embodiments, the trigger mechanism may release a chemical which causes a chemical reaction which generates the initial fracture that creates propagating cracks that destroy the substrate and devices disposed thereon.

FIGS. 8A, 8B, and 8Cshow three versions of a system801,802,803comprising a at least one functional device820and at least one decoy device830disposed on a stress-engineered substrate configured to fracture in response to a trigger signal. For convenience, the triggering mechanism is described as a heater, however, the concepts described with reference toFIGS. 8A, 8B, and 8Care also applicable to any type of trigger mechanism, including those discussed above. For example, in some implementations, the trigger mechanism need not be electrically coupled to the trigger circuitry.

System801,802,803includes a stress-engineered substrate810, a functional device820, a decoy device,830, and a trigger mechanism860. The trigger mechanism860is configured to apply energy to the substrate810that causes the initial fracture which in turn leads to propagating fractures that fragment the substrate810, functional device820, and decoy device830. For convenience, the trigger mechanism is described as a heater, however, the concepts described with reference toFIGS. 8A, 8B, and 8Care also applicable to any type of trigger mechanism, including those discussed above.

The heater860is thermally coupled to the substrate810. In some embodiments, the heater860is a resistive conductive film that is energized by flowing electrical current. In other embodiments, the heater is energized by radio-frequency-coupled microwave. In yet another embodiment, the heater is an optical absorber energized by an intense laser beam. In the resistive conductive film embodiment, the heater can be a thin film fuse that breaks when the temperature reaches a sufficiently high value.

Trigger circuitry850is configured to cause the heater860to be coupled to a power source840in response to exposure to a trigger stimulus. The trigger circuitry850may include a sensor851and a switch852. The sensor851generates a trigger signal when exposed to the trigger stimulus. After activation by the trigger signal, the switch852electrically couples the power source840to the heater860. When energized by the power source840, the heater860generates heat such that the heating and subsequent cooling of the substrate form an initial fracture of the substrate810. The initial fracture generates propagating fractures through the substrate810, functional device820, and decoy device830. The substrate810is engineered to fracture and break into pieces. In some embodiments, the fracture dynamics are designed so that the substrate810fractures into small particles that have length, width, and height dimensions of less than about 900 μm, less than about 500 μm, or even less than about 100 μm.

In one version of the system801shown inFIG. 8A, the sensor851and switch852are located on the substrate810. In another version of the device802, shown inFIG. 8B, the switch852is not located on the stress-engineered substrate810. In yet another version of the device803shown inFIG. 8C, neither the sensor851nor switch852is located on the substrate810.

Various modifications and alterations of the embodiments discussed above will be apparent to those skilled in the art, and it should be understood that this disclosure is not limited to the illustrative embodiments set forth herein. The reader should assume that features of one disclosed embodiment can also be applied to all other disclosed embodiments unless otherwise indicated. It should also be understood that all U.S. patents, patent applications, patent application publications, and other patent and non-patent documents referred to herein are incorporated by reference, to the extent they do not contradict the foregoing disclosure.