Device for protecting an integrated circuit chip against attacks

An integrated circuit chip includes: a plurality of parallel wells of alternated conductivity types formed in the upper portion of a semiconductor substrate of a first conductivity type; in each well of the first type, a plurality of MOS transistors having a channel of the second conductivity type, and in each well of the second type, a plurality of MOS transistors having a channel of the first type, transistors of neighboring wells being inverted-connected; and a device of protection against attacks, including: a layer of the second type extending under said plurality of wells, from the lower surface of said wells; and regions of lateral insulation between the wells, said regions extending from the upper surface of the wells to said layer.

BACKGROUND

1. Technical Field

The present disclosure relates to the protection of an integrated circuit chip against attacks aiming at obtaining protected confidential data.

2. Description of Related Art

In some secure devices such as payment cards, integrated circuits chips are likely to process and/or store critical data, for example, encryption keys. Such chips may be fraudulently manipulated to obtain protected confidential data.

Among known attacks, so-called “fault injection attacks” comprise intentionally disturbing the chip operation and analyzing the influence of the disturbances on its behavior. The attacker especially examines the influence of the disturbances on data such as output signals, the consumption, or response times. He is likely to infer from it, by statistic studies or the like, critical data such as algorithms implemented by the chip, and possibly encryption keys.

To intentionally cause anomalies in the circuits of a chip, an attack mode comprises bombarding chip areas with a laser beam while the chip is operating. Faults can thus be injected into certain memory cells and/or affect the behavior of certain components. Due to the presence of interconnection metal tracks on the front surface side of the substrate, laser attacks are often carried out on the rear surface of the chip. The attacker may provide a preliminary step of thinning of the chip substrate, which enables to minimize the beam attenuation by the substrate, and thus to improve the efficiency of the attack.

To avoid frauds, chips comprising an attack detection device coupled with a chip protection circuit have been provided. When an attack is detected, the protection circuit implements measures of protection, alienation, or destruction of the critical data. For example, it may be provided, when an attack is detected, to interrupt the power supply of the chip or to cause its resetting, to minimize the time during which the attacker can study the response of the chip to a disturbance.

Attack detection solutions may be logic. They for example comprise regularly introducing integrity tests into the calculations, to make sure that data have not been modified. Such solutions have the disadvantage of introducing additional calculation steps, thus increasing the chip response times. Further, integrity tests cannot detect all the disturbances caused by an attacker. The latter thus has room for maneuver to acquire critical data.

Other so-called physical attack detection solutions comprise sensors sensitive to temperature variations, to ultraviolet or X rays, enabling to detect suspicious activities. Like logic solutions, such solutions are not perfectly reliable. Indeed, before the attack detection, the attacker has room for maneuver to obtain critical data. Further, the implementation of such solutions is complex and increases the silicon surface area to form the chip.

BRIEF SUMMARY

One embodiment of the present disclosure is a structure for protecting an integrated circuit chip against attacks, which overcomes at least some of the disadvantages of existing solutions.

The present disclosure here provides a protection device enabling, instead of detecting that an attack is going on and of implementing measures of protection, alienation, or destruction of the confidential data, as usual protection devices do, preventing the attack from causing faulty operations in the chip circuits. The attacker will then no longer be able to inject faults into the chip circuits to deduce critical data therefrom.

One embodiment of the present disclosure is a protection device enabling to prevent the injection of faults by a laser beam.

One embodiment of the present disclosure is a protection device which does not increase the semiconductor surface area of the chip.

One embodiment of the present disclosure is a protection device further enabling to detect whether an attack is going on.

One embodiment provides an integrated circuit chip comprising: a plurality of parallel wells of alternated conductivity types formed in the upper portion of a semiconductor substrate of a first conductivity type; in each well of the first type, a plurality of MOS transistors having a channel of the second conductivity type, and in each well of the second type, a plurality of MOS transistors having a channel of the first type, transistors of neighboring wells being inverted-connected; and a device of protection against attacks, comprising: a layer of the second type extending under the plurality of wells, from the lower surface of said wells; and regions of lateral insulation between the wells, the lateral regions extending from the upper surface of the wells to the layer of the second type.

According to an embodiment, the lateral insulation regions entirely cross the layer of the second type and stop in the substrate.

According to an embodiment, the lateral insulation regions extend down to a depth greater than 2 μm.

According to an embodiment, the lateral insulation regions are trenches with insulated walls filled with a conductive material.

According to an embodiment, the conductive material is polysilicon.

According to an embodiment, the chip further comprises at least one detector associated with at least one of the lateral insulation regions, the detector being capable of detecting variations of the voltage of the conductive material of this region.

According to an embodiment, the detector is selected to detect variations of the voltage of the conductive material that may result from a bombarding of the chip by a laser beam.

According to an embodiment, the detector comprises a comparator having a first input terminal maintained, in operation, at a reference voltage, and having a second input terminal connected to the conductive material.

DETAILED DESCRIPTION

For clarity, the same elements have been designated with the same reference numerals in the different drawings and, further, as usual in the representation of integrated circuits, the various drawings are not to scale.

FIGS. 1A to 1Dschematically and partially show an embodiment of an integrated circuit chip1.FIG. 1Ais a top view of chip1, andFIGS. 1B,1C, and1D are cross-section views, respectively along planes A-A, B-B, and C-C, ofFIG. 1A.

Chip1is formed from a lightly-doped P-type semiconductor substrate3(PSUB), for example, a silicon substrate. Juxtaposed wells of alternated conductivity types are formed in the upper portion of substrate3. In this example, only two wells5and7, respectively of type N and of type P, having, in top view, the shape of juxtaposed parallel strips (in dotted lines inFIG. 1A), have been shown. In practice, chip1may comprise a large number of juxtaposed parallel wells of alternated conductivity types.

N-type well5comprises channels of a plurality of P-channel MOS transistors9. Each transistor9comprises heavily-doped P-type source and drain regions9S and9D (P+), delimited by an insulated conductive gate9G formed at the surface of well5. Well5further comprises a plurality of heavily-doped N-type regions11, forming biasing contact areas of the well. In this example, a contact area11is arranged in the vicinity of each transistor9.

P-type well7comprises channels of a plurality of N-channel MOS transistors13. Each transistor13comprises heavily-doped N-type source and drain regions135and13D (N+), delimited by an insulated conductive gate13G formed at the surface of well7. Well7further comprises a plurality of heavily-doped P-type regions15, forming biasing contact areas of the well. In this example, a contact area15is arranged in the vicinity of each transistor13.

Insulating regions17,17aare formed in the upper portion of wells5and7to insulate the transistors from one another and from the contacting areas. In particular, an insulating region17ahaving, in top view, the shape of a strip parallel to wells5and7, extends with no discontinuity above the junction area between wells5and7, thus insulating transistors9from transistors13. Insulating regions17and17afor example are trenches of a depth approximately ranging from 100 to 300 nm, filled with silicon oxide. Such trenches may be formed according to a method currently designated as STI (Shallow Trench Insulation) in the art.

In chip1, each transistor9of well5is, in top view, arranged close to a transistor13of well7. Neighboring transistors9and13are inverter-connected, that is, gate9G of transistor9is connected to gate13G of transistor13, forming the input terminal of an inverter19, and drain9D of transistor9is connected to drain13D of transistor13, forming output terminal OUT of inverter19. The gate-gate and drain-drain interconnects are formed by conductive tracks, not shown, for example, made of polysilicon or metal. As an example, in operation, source9S of transistor9is at a high power supply voltage Vdd, source13S of transistor13is at a low power supply voltage Gnd, bias contact11of well5is at high voltage Vdd, bias contact15of well7is at low voltage Gnd, and substrate3is at low voltage Gnd.

Inverters19form elementary cells of chip1. They are interconnected by conductive tracks, not shown, to form blocks implementing functions of the chip.

The present inventors have studied the effects of a bombarding of chip1by a laser beam. They have observed the appearance of eddy currents due to the forming of electron-hole pairs at the level of the reverse-biased PN junctions, and especially at the level of the PN junctions between well5and well7and between substrate3and well5. Such currents are capable of turning on parasitic NPN bipolar transistors formed by areas11and well5(N), well7(P), and drain regions13D (N; PNP transistors formed contact areas15and well7(P), well5(N), and drain regions9D (P; PNP transistors formed by drain regions9D (P), well5(N), and substrate3(P); and PNP transistors formed by source regions9S (P), well5(N), and substrate3(P). Bipolar transistors crossing source regions95and13S of MOS transistors9and13may also be turned on. This may result in various operating anomalies, for example, logic faults, that is, the value of the signal on output terminal OUT of one or more of the inverters19is inverted with respect to the value which should normally be present on this terminal, given the signal applied on input terminal IN. Delay faults may also occur, that is, the switching of the output signal of one or more of the inverters19is delayed with respect to a switching in the absence of the laser beam.

FIGS. 2A to 2Dschematically and partially show an embodiment of an integrated circuit chip21protected against attacks.FIG. 2Ais a top view of chip21, andFIGS. 2B,2C, and2D are cross-section views, respectively along planes A-A, B-B, and C-C ofFIG. 2A.

Like chip1ofFIGS. 1A to 1D, chip21comprises parallel wells of alternated conductivity types, P-channel MOS transistors being formed in N-type wells and N-channel MOS transistors being formed in the P-type wells. Neighboring transistors of opposite types, formed in wells of opposite conductivity types, are assembled as inverters, forming elementary cells of chip21. The elements common to chips1and21have been designated with the same reference numerals in the drawings and will not be described in detail again hereafter.

In chip21, an N-type layer23extends under wells5and7, at the interface between the wells5and7and a lower portion3A of the substrate3. As an example, the thickness of wells5and7ranges between 0.5 and 1.5 μm, and the thickness of layer23ranges between 1 and 2 μm. It should be noted that in practice, layer23and wells5, of type N, may form a same N-type region.

Further, in chip21, parallel wells5(of type N) and7(of type P) are not juxtaposed like in chip1ofFIGS. 1A to 1D, but are separated by an insulating region25which extends from the upper surface of the wells to N layer23. Region25forms a lateral insulation wall which behaves as an interface between well5and well7. There thus do not exist, under inverters19, lateral PN junctions between wells5and7, as is the case in chip1ofFIGS. 1A to 1D.

In the shown example, region25entirely crosses N-type layer23, to emerge into the lower portion3A of the substrate3. Region25may be interrupted or opened in regions separating two inverters of the chip or in regions comprising no MOS transistors (no interrupt or opening is shown inFIGS. 2A to 2D). Such interrupts enable to guarantee the uniformity of the biasing of layer23. In an alternative embodiment, region25may stop at an intermediate depth of layer23, without extending into substrate3.

In this example, insulating region25extends from the upper surface of surface insulating region17aseparating transistors9of well5from transistors13of well7. In top view (FIG. 2A), insulating region25has the shape of a strip, possibly interrupted in certain regions of the chip, parallel to wells5and7, having a smaller width than strip17a, and substantially coinciding with the central portion of strip17a. Thus, the provision of insulating region25does not increase the semiconductor surface area used to form the chip. In an alternative embodiment, surface insulation region17amay be omitted.

Insulating region25for example is formed in a trench25A having a depth approximately ranging from 2 to 4 μm and a width approximately ranging from 200 to 500 nm. The insulating region25includes a film27of an insulating material, such as silicon oxide, coating lateral walls and a bottom of the trench25A and is filled with a conductive material29such as polysilicon. Such trenches may be formed according to a method currently designated as DTI (Deep Trench Insulation) in the art. In an alternative embodiment, trench25may be entirely filled with an insulating material such as silicon oxide. Any method capable of forming a sufficiently deep lateral insulation trench may be used.

InFIGS. 2A to 2D, only two parallel wells5and7have been shown. However, in practice, chip21may comprise a large number of parallel wells of alternated conductivity types, separated from one another by regions25having, in top view, the shape of strips (or of separate aligned strip sections) parallel to wells5and7. Thus, in chip21, transistors9and13forming a same inverter19are separated by an insulating wafer portion25.

Trials performed by the present inventors have shown that the bombarding of a chip of the type described in relation withFIGS. 2A to 2Dby a laser beam causes no operating anomalies. In the presence of the laser beam, a relatively high eddy current, due to the forming of electron-hole pairs at the level of the reverse-biased PN junction formed between the lower portion3A of the substrate3and layer23, effectively appears in substrate3. However, such an eddy current has no incidence on the operation of the chip circuits. In particular, due to the presence of layer23and of insulating regions25, no parasitic bipolar transistor is capable of being turned on under the effect of the laser beam.

In the case where lateral insulation region25comprises openings in certain chip regions, there remains, in these regions, lateral PN junctions between wells5and7. However, such junctions have a small surface area and are sufficiently spaced apart from inverters19not to enable the injection of faults in circuits of the chip.

Thus, in chip21, layer23and insulating regions25are elements of a protection device configured to protect the chip21against attacks by preventing consequences of an attack, that is, the injection of faults or operating anomalies into the chip circuits. This contrast with prior art devices that seek to detect an attack, and then to protect, alienate, or destroy the critical data of the chip.

An advantage of the provided protection device is that it enables to protect the chip, not only against laser attacks, but also against other types of attack, for example, attacks by fault injection by means of an electromagnetic field.

Another advantage of such a protection device is that it causes no increase of the silicon surface area used to form the chip.

FIG. 3schematically and partially shows an alternative embodiment of an integrated circuit chip protected against attacks. Chip31ofFIG. 3comprises a protection device enabling not only to prevent the injection of faults, like in chip21described in relation withFIGS. 2A to 2D, but also to detect whether an attack is going on.

FIG. 3is a cross-section view in the same plane asFIG. 2B. Chip31comprises the same elements as chip21ofFIG. 2B, and further comprises an attack detection circuit33. For clarity, circuit33has been shown in the form of an electric diagram connected to chip31. In practice, circuit33may be integrated in the chip31, or be a circuit external to chip31.

To detect that an attack is going on, the detection circuit detects abnormal variations of voltage VTRof conductive material29filling trenches25arranged between neighboring parallel wells.

Conductive region29forms an electrode of a plurality of stray capacitors, especially between material29and well5, between material29and well7, between material29and layer23, and between material29and substrate3. There exist other stray capacitors in chip31, for example at the level of the PN junction between substrate3and layer23, and between well7and layer23.

The chip bombarding by a laser beam causes a fast modification of the bias voltages of substrate3, of layer23, and/or of wells5and7. The variations of the bias voltages are transmitted by the above-mentioned stray capacitor network, and cause a variation of the voltage of conductive region29.

It is here provided to detect, using the circuit33, variations of the voltage of conductive region29corresponding to a fraudulent attack. Once the attack has been detected, various measures of protection, alienation, or destruction of the confidential data may be implemented.

In this example, circuit33comprises a comparator35comprising input terminals35a,35band an output terminal35c. Input terminal35bis electrically connected to conductive material29filling the trench with insulated walls25. In operation, a reference voltage VREFis applied to input terminal35a, and output terminal35cprovides a signal VERRcapable of switching between a high value and a low value according to whether voltage VTRof conductive material29is greater or smaller than voltage VREF. Conductive material29filling trench25is further connected to a high voltage terminal VDDvia a switch37. In operation, switch37, normally off, is periodically turned on, for example, for each rising or falling edge of the chip clock signal, to maintain conductive material29at a substantially constant floating voltage. As a variation, a bias voltage may be permanently applied to conductive material29(non-floating biasing).

FIG. 4is a timing diagram illustrating the variation of voltage VTRof conductive region29during the chip operation. In normal operation, voltage VTRis maintained at a voltage greater than voltage VREFapplied to input terminal35aof comparator35. As an example, voltage VREFis approximately 0.5 V, and voltage VTRis maintained at a substantially constant value on the order of 0.7 V.

Peaks41are observed on signal VTR, which correspond to fast, low-amplitude variations of voltage VTR. Peaks41are a consequence of normal transient phenomena occurring during the chip operation. As an example, the amplitude of peaks41is smaller than 0.1 V.

The timing diagram ofFIG. 4further shows a hollow43corresponding to an abrupt drop, of strong amplitude, of voltage VTR. Such a voltage drop typically occurs in the presence of a fraudulent attack, for example, during the chip bombarding by a pulsed laser beam. More generally, in a fraudulent attack, a fast variation of voltage VTRoccurs in conductive areas29of the attacked area. As an example, amplitude variations greater than 0.3 V can be typically observed in case of a laser attack on chips powered under 1.2 V. Voltage VTRthen drops to a value smaller than voltage VREF, thus resulting in a detection of the attack by circuit33.

In practice, several detection circuits33may be provided on chip31. One or several detection circuits33may for example be associated with each region25of separation of the chip wells. As an alternative, detection circuits33may be provided in the most critical chip areas only. It is also possible to provide, on a same chip31, detection circuits33having different detection thresholds, for example, by applying different reference voltages VREFto input terminals35aof the different comparators35. It should be noted that the present disclosure is not limited to the use of above-described detection circuit33. It will be within the abilities of those skilled in the art to provide any other circuit capable of detecting variations of the voltage of conductive regions29capable of corresponding to a fraudulent attack.

An advantage of the protection device described in relation withFIGS. 3 and 4is that it provides an increased security, since it enables to detect that an attack is going on, in addition to preventing the injection of faults, like the protection device described in relation withFIGS. 2A to 2Ddoes. This enables to provide additional protection measures such as resetting the chip in case of an attack.

Specific embodiments of the present disclosure have been described. Various alterations, modifications and improvements will readily occur to those skilled in the art.

In particular, embodiments of an integrated circuit chip protected against laser attacks has been described hereabove, the chip comprising parallel wells of alternated conductivity types formed in the upper portion of a semiconductor substrate, the wells being separated from one another by insulating regions25. The present disclosure is not limited to the specific example described hereabove in which the wells have, in top view, the shape of parallel strips. “Parallel wells” is here more generally used to designate neighboring wells arranged so that a surface of a first well is in front of a surface of the second well and substantially parallel to this surface. In the provided structure, an insulating trench25forms an interface between said substantially parallel surfaces.

Further, examples of integrated circuit chips formed from a P-type substrate have been described hereabove. It will be within the abilities of those skilled in the art to adapt the provided protection device to a chip formed from an N-type substrate.

Such alterations, modifications, and improvements are intended to be part of this disclosure, and are intended to be within the spirit and the scope of the present disclosure. Accordingly, the foregoing description is by way of example only and is not intended to be limiting.