Abstract:
A semiconductor chip includes a first integrated circuit chip and a depression substrate attached to the integrated circuit chip, wherein the integrated circuit chip and the depression substrate define a cavity therebetween. The semiconductor chip also includes a stress sensitive material located in the cavity and a chemical located in the cavity, wherein detection of tampering causes a reaction by the chemical such that the semiconductor chip is at least partially destroyed.

Description:
BACKGROUND 
       [0001]    Anti-tamper (“AT”) protection is employed so that it is very difficult to reverse engineer or alter the function of electronic hardware (e.g., computer processors, integrated circuits, multi-chip modules, etc). For some commercial applications, designers often spend vast sums of money to develop a “next generation” circuit. These companies often wish to deter, or at least hamper a competitor&#39;s reverse engineering efforts. The motivation in this case is to protect valuable intellectual property. Military and Government users also have a strong interest in AT protection. When new military hardware is fielded, often the consequences of capture are not fully understood or considered by the designer of the hardware. Similarly, the combat loss of any one of a thousand pieces of sensitive, high-tech military hardware could do irreparable damage to national security. 
         [0002]    AT standards have been defined according to the Federal Information Protection Standard (FIPS) 140-2. The standard describes the requirements for four levels of protection. For the standards for multi-chip, embedded modules, Level 1 calls for standard passivation techniques (i.e., a sealing coat applied over the chip circuitry to protect it against environmental or other physical damage). The standard describes that Level 2 can be achieved using anti-tamper coatings or passive AT. Level 3 may use passive AT if tampering will likely destroy the module. Level 4 requires the use of active AT technologies. 
         [0003]    Most AT is categorized as either passive or active. In each case, the intent is to delay, prevent or stop tampering and potential reverse engineering of an electronic circuit. Passive AT is currently the most widespread method of deterring an opponent from reverse engineering or spoofing an electronic circuit. Current passive AT arrangements include encapsulation and various types of conformal coatings such as epoxies. Methods to defeat common encapsulents are well documented. 
         [0004]    Layered anti-tamper arrangements are also employed in which alternating layers of passive AT with active AT yields a synergy in probing difficulty. With active AT methods, a protected circuit will take some action when unauthorized activities are detected. Any number of events can trigger a programmed circuit response. Examples of active triggering arrangements include: voltage, photon detection, acceleration, strain, thermal, chemical attack, and proximity or tamper-respondent enclosures. The response of an active AT circuit upon triggering is also widely variable. For example, zeroization may be employed in which critical memory cells or an entire die can be erased. Similarly, a response can trigger overwriting of some or all of a memory die. Another detection response is to physically obliterate or mutilate the circuit using, for example, embedded microexplosive charges beneath dice. In this case, when power is improperly removed or when tampering is otherwise detected, the circuit literally destroys itself. 
       SUMMARY 
       [0005]    In one embodiment, the present invention is directed to a semiconductor chip including an integrated circuit chip and a depression substrate attached to the integrated circuit chip, wherein the integrated circuit chip and the depression substrate define a cavity therebetween. The semiconductor chip also includes a stress sensitive material located in the cavity and a chemical located in the cavity, wherein detection of tampering causes a reaction by the chemical such that the semiconductor chip is at least partially destroyed. 
         [0006]    In one embodiment, the cavity includes a stress-sensitive material, such as a piezoelectric, located therein. In such an embodiment, when an intrusion is detected and a signal received, the stress-sensitive material initiates a reaction by the chemical such that the package is at least partially destroyed. 
         [0007]    In one embodiment, the cavity includes a stress-sensitive material, such as a piezoelectric, located therein. In such an embodiment, when an intrusion is detected and a signal received, the stress-sensitive material reacts such that the package is at least partially destroyed. 
         [0008]    In one embodiment, the present invention is directed to a destructor electronic device. The destructor electronic device includes an interposer defining a cavity therein and a chemical located in the cavity. The semiconductor package also includes a conductive via extending from a top surface of the interposer to the cavity, wherein an electrical signal passed through the conductive via causes a reaction by the chemical such that the destructor electronic device is at least partially destroyed. 
         [0009]    In one embodiment, the present invention is directed to a semiconductor interposer. The semiconductor interposer includes a first substrate and a second substrate, wherein the first substrate and the second substrate define a cavity therebetween. The semiconductor interposer also includes a stress-sensitive material located in the cavity, wherein receipt of a signal from a sensor causes a reaction by the stress-sensitive material such that the semiconductor interposer is at least partially destroyed. 
         [0010]    In one embodiment, the present invention is directed to a method of fabricating a destructor electronic device. The method includes attaching a first substrate to a second substrate such that a cavity is formed therebetween, wherein one of the first substrate and the second substrate includes an opening to the cavity and filling at least a portion of the cavity with a chemical. 
         [0011]    In one embodiment, the present invention is directed to a method of fabricating a destructor electronic device. The method includes forming a via in a first substrate, forming an opening in the first substrate, and filling the via with a conductive material. The method also includes forming a channel in a second substrate, bonding the first substrate to the second substrate such that the opening and the channel form a reservoir and the via extends into the reservoir, and filling at least a portion of the reservoir with a chemical. 
         [0012]    In various embodiments, the present invention is directed to methods of fabricating semiconductor and MCM packages. The packages can be fabricated from a number of materials including high temperature co-fired ceramic (HTCC), low temperature co-fired ceramic (LTCC), silicon dioxide, aluminum oxide, beryllium oxide ceramics, epoxy-glass laminate, polyimide-glass laminate, etc. 
     
    
     
       BRIEF DESCRIPTION OF THE FIGURES 
         [0013]      FIGS. 1A through 1J  illustrate embodiments of a cross section of a destructor integrated circuit chip in various stages of fabrication; 
           [0014]      FIGS. 2A through 2G  illustrate embodiments of a cross section of a destructor interposer in various stages of fabrication; 
           [0015]      FIG. 2H  illustrates an embodiment of a cross section of a destructor electronic device employing flip chip bonding; 
           [0016]      FIG. 3  illustrates another embodiment of a cross section of a destructor electronic device employing flip chip bonding; 
           [0017]      FIG. 4  illustrates an embodiment of a cross section of a destructor electronic device employing wire bonding; and 
           [0018]      FIG. 5  illustrates another embodiment of a cross section of a destructor electronic device employing wire bonding. 
       
    
    
     DESCRIPTION 
       [0019]    Various embodiments of the present invention include packages, for example, integrated circuits and multi-chip modules that include an anti-tampering feature that causes the package or a portion of the package to be damaged, deformed, and/or destroyed upon detection of tampering. In various embodiments, after tamper detection by a sensor (e.g., a passive sensor or an active sensor), an actuator such as, for example, a metal hydrate actuator, a piezoelectric actuator, a magnetostrictive actuator, a swellable polymer gel actuator, or a shape alloy memory actuator may be used to trigger or cause damage, deformation, and/or destruction of the package or a portion of the package. 
         [0020]      FIGS. 1A through 1J  illustrate embodiments of a cross section of a destructor integrated circuit chip in various stages of fabrication. As shown in  FIG. 1A , fabrication starts with an integrated circuit “IC” wafer  10  (e.g., a wafer constructed of Silicon) that will form the roof of the destructor integrated circuit chip. In  FIG. 1B , the wafer  10  is reduced in thickness to form wafer  10 ′ so that the wafer  10 ′ may readily break during a destructive event. By way of example, the wafer  10  may be thinned from about 0.020 in. to 0.005 in. In  FIG. 1C , a layer  12  such as a photoresist layer is formed on the wafer  10 ′ to define the structure of the destructor integrated circuit chip. 
         [0021]    As shown in  FIG. 1D , photoresist is deposited onto the wafer  10 ′, which is then masked and hardened. The wafer  10 ′ is etched to form openings  14 . The photoresist is then stripped. In  FIG. 1E , a second blank wafer  16  undergoes a similar process as that described above for the wafer  10 ′ to form depressions  18 . In  FIG. 1F , actuators  20  such as, for example, piezoelectric actuators, are formed on divided walls  21  of the depressions  18  in the depression wafer  16 . In  FIG. 1G , the thinned IC wafer  10 ′ is bonded to the depression wafer  16  using, for example, anodic wafer bonding to form IC wafer  22 . The depressions  18  and the openings  14  form reservoirs  24  and  24 ′. 
         [0022]    In  FIG. 1H , the reservoirs  24  and  24 ′ are filled with one or more chemicals. In various embodiments, the reservoirs  24  and  24 ′ are each filled with the same type of chemical or chemicals. In various embodiments, the reservoirs  24  and  24 ′ are each filled with different types of chemicals. The chemicals may be, for example, the following either alone or in combination: C4, RDX, HMX, Semtex, pentaerythritoltetranitrate, TNT, Picric acid, tri-nitrobenzene, tri-nitrophenol, nitroglycerine, nitrocellulose, nitroguanadine, a nitromethane/ammonium nitrate mixture, an ammonia/hydrogen peroxide mixture, any suitable type of nitrated compound, lead azide, silver azide, mercury fulminate, any suitable type of shock sensitive azo or peroxy compound, etc. 
         [0023]    In  FIG. 1I , caps  26  have been secured to the package  22  to seal the reservoirs  24  and  24 ′. The caps  26  may be secured by, for example, epoxy. In  FIG. 1J , the IC wafer, is singulated into individual chips  28 ,  28 ′ and  28 ″ using, for example, a wafer saw. 
         [0024]    In operation and according to various embodiments, when tampering or a similar event is detected, a signal is sent to the actuator  20 , which is breached in response to the signal. A breach of the actuator  20  causes chemical or chemicals in the reservoirs  24  and  24 ′ to mix and detonate, thus destroying and/or deforming at least a portion of the chip  28 . 
         [0025]      FIGS. 2A through 2G  illustrate embodiments of a cross section of a destructor interposer in various stages of fabrication. In  FIG. 2A , bonding pads  30  are formed on a substrate  32  (e.g., a Silicon substrate) by using, for example, standard wafer fabrication metallization processes. In  FIG. 2B , photoresist  34  is deposited on the wafer  32  to pattern the footprint of the IC that is to be formed on the substrate  32 , including window frames  36 . In  FIG. 2C , after masking, hardening, and etching, a second photoresist layer  38  is deposited on the underside of the substrate  32  to define vias and an opening. As shown in  FIG. 2D , after masking, hardening, and etching, vias  40  and opening  42  are created. In  FIG. 2E , the photoresist layer  38  is stripped and the vias  40  are filled with a conductive material. 
         [0026]    In  FIG. 2F , a second substrate  44  is fabricated in a similar manner as that described in connection with the substrate  32  of  FIGS. 2A through 2E  such that a depression  46  is formed. In  FIG. 2G , the substrate  32  is bonded to the substrate  44  to create an interposer  49  by, for example, anodic bonding such that the opening  42  and the depression  46  form a reservoir  48 . 
         [0027]    In  FIG. 2H , the destructor electronic device  50  is formed by bonding an integrated circuit (IC) chip  52  onto the interposer  49  at the bonding pads  30 . The reservoir  46  is filled with a chemical or chemicals, such as an explosive chemical, and a cap  54  is attached to the interposer  49  by, for example, epoxy bonding. 
         [0028]    In operation, if tampering is detected by some sensor in the package  50 , an actuator (not shown) can send an electrical signal through the vias  40  such that the chemical or chemicals in the reservoir  46  detonate or ignite by, for example, a chemical reaction caused by the current of the electrical signal passing through the chemical or chemicals. 
         [0029]      FIG. 3  illustrates another embodiment of a cross section of a destructor electronic device  60  employing flip chip bonding. The destructor electronic device  60  is similar to the electronic device  50  of  FIG. 2H  except that a cap  62  is formed on the underside of the substrate  44  after a reservoir  64  is filled with a chemical or chemicals. 
         [0030]      FIG. 4  illustrates an embodiment of a cross section of a destructor electronic device  66  employing wire bonding. The electronic device  66  is similar to the destructor electronic device  50  of  FIG. 2H  except that the integrated circuit chip  52  is attached to the interposer  49  and electrically connected to the interposer through wire bonds  68 .  FIG. 5  illustrates an embodiment of a cross section of a destructor electronic device  70  employing wire bonding. The destructor electronic device  70  is similar to the destructor electronic device  60  of  FIG. 3  except that the thinned IC chip  52  is directly anodic bonded to the depression half of the interposer  44  and electrically connected to the interposer through wire bonds  72 . 
         [0031]    It is to be understood that the figures and descriptions of embodiments of the present invention have been simplified to illustrate elements that are relevant for a clear understanding of the present invention, while eliminating, for purposes of clarity, other elements. Those of ordinary skill in the art will recognize, however, that these and other elements may be desirable for practice of various aspects of the present embodiments. However, because such elements are well known in the art, and because they do not facilitate a better understanding of the present invention, a discussion of such elements is not provided herein. 
         [0032]    It can be appreciated that, in some embodiments of the present methods and systems disclosed herein, a single component can be replaced by multiple components, and multiple components replaced by a single component, to perform a given function or functions. Except where such substitution would not be operative to practice the present methods and systems, such substitution is within the scope of the present invention. 
         [0033]    Examples presented herein, including operational examples, are intended to illustrate potential implementations of the present method and system embodiments. It can be appreciated that such examples are intended primarily for purposes of illustration. No particular aspect or aspects of the example method, product, computer-readable media, and/or system embodiments described herein are intended to limit the scope of the present invention. 
         [0034]    It should be appreciated that figures presented herein are intended for illustrative purposes and are not intended as construction drawings. Omitted details and modifications or alternative embodiments are within the purview of persons of ordinary skill in the art. Furthermore, whereas particular embodiments of the invention have been described herein for the purpose of illustrating the invention and not for the purpose of limiting the same, it will be appreciated by those of ordinary skill in the art that numerous variations of the details, materials and arrangement of parts/elements/steps/functions may be made within the principle and scope of the invention without departing from the invention as described in the appended claims.