Patent Publication Number: US-7710161-B1

Title: Digital low frequency detector

Description:
TECHNICAL FIELD 
     This subject matter relates generally to digital low frequency detectors. 
     BACKGROUND 
     A contactless smart card is commonly used for security access or payment systems. Contactless smart cards generally include an antenna, in the form of an inductor, coupled to an integrated circuit (IC). The IC commonly includes a capacitor which forms a resonant circuit with the antenna. A card reader presents an alternating magnetic field that excites the inductor/capacitor resonant circuit, which in turn energizes and powers the IC. The IC can then perform one or more functions, such as transmitting a card number through the antenna to the card reader. 
     Many smart cards include an integrated circuit (IC) device. The IC device includes various circuits and a central processing unit (CPU) for performing operations on data, including operations on secret data (e.g., manipulating a private key). The CPU can be subjected to an analysis attack by an individual seeking to recover the secret data. For example, an attacker may try to deduce a secret key by measuring various circuit voltages through the IC device, single-stepping the CPU clock, then measuring the circuit voltages again to deduce the operation performed by the CPU and the operand manipulated during the operation. 
     Conventional solutions to protect against analysis attacks use two low frequency detectors to detect low clock frequencies. A first low frequency detector is connected to a clock pin of the IC chip. A second, low frequency detector is connected to an internal clock. The second low frequency detector is capable of detecting lower clock frequencies than the first low frequency detector. The second low frequency detector typically includes a custom cell delay line which consumes a large area on the IC die. This large footprint can preclude using the second low frequency detector on more than one clock on the IC device. 
     SUMMARY 
     A digital circuit is disclosed for detecting clock activity in an IC device. In one implementation, a clock detection circuit can include two flip flops. A first flip flop detects activity on the clock being tested (e.g., the flip flop is set when a positive clock edge is detected). The first flip flop can be reset by a reset signal. A second flip flop is coupled to the output of first flip flop and is operable by an enable signal to sample the output of the first flip flop. The output of the second flip flop is asserted as active, when a positive clock edge occurs between the release of the reset signal on the first flip flop and the assertion of the enable signal on the second flip flop. In some implementations, one or more additional flips can be interposed between the first and second flips to control metastability. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of an example IC device for an IC device, including a clock detect circuit. 
         FIG. 2  is block diagram of an example clock detect circuit. 
         FIG. 3  is timing diagram illustrating the operation of the clock detect circuit of  FIG. 2 . 
         FIG. 4  is a block diagram of the clock detect circuit of  FIG. 2 , including an additional flip flop to control metastability. 
     
    
    
     DETAILED DESCRIPTION 
     Example IC Device with Digital Clock Detect Circuit 
       FIG. 1  is a block diagram of an example IC device  100  for an electronic device (e.g., a contactless smart card), including a digital low frequency detector (DLFD). In some implementations, the IC device  100  includes a central processing unit (CPU)  102 , one or more clock inputs  104 , one or more DLFD(s)  106 , a low frequency detector (LFD)  108 , a multiplexer  110 , a memory management unit  112 , non-volatile memory  114  (e.g., EEPROM, ROM) and volatile memory  116  (e.g., RAM). Other components can be included in the IC device  100  but are not shown for clarity purposes. 
     The CPU  102  performs various operations for the electronic device. In the case of a contactless smart card, the CPU  102  can demodulate input signals, modulate output signals and perform cryptographic operations on secret data. The CPU  102  is coupled to the memory management unit (MMU)  112  which manages access to memory  114 ,  116 . The non-volatile memory  114  can contain secret data (e.g., a private key) used in the cryptographic operations. 
     The clock inputs  104   a ,  104   b ,  104   c , are coupled to clock generators A, B, C, respectively. Other implementations can include more or fewer clock generators. In the example shown, clock inputs  104  are fed into multiplexer  110 . The output of multiplexer  110  is coupled to the clock input of the CPU  102 . Clock generator A provides a clock A (clk) for the DLFDs  106   a ,  106   b ,  106   c , as described in reference to  FIG. 2 . The LFD  108  ensures that clock A is protected. The output of each DLFD  106  provides an active signal to indicate an active clock, as described in reference to  FIG. 2 . 
     Example Clock Detect Circuit 
       FIG. 2  is block diagram of an example DLFD  106 . The DLFD  106  is used to detect clock activity. In some implementations, the DLFD  106  has four inputs: a test clock (test_clk), a sample reset signal (samp_rst), a sample signal (samp) and a protected clock signal (clk). The test_clk is the clock being tested (e.g., clock A, clock B or clock C), samp_rst resets the DLFD  106  before a next sampling period, samp is asserted at the end of the sample period, and clk is the protected clock used by the DLFD  106 , as shown in  FIG. 1 . 
     In some implementations, the DLFD  106  includes two flip flops. A first flip flop  200  (FF 1 ) detects activity on test_clk. FF 1   200  is set when a positive edge (+ve) of test_clk is detected. FF 1   200  is reset by samp_rst (e.g., when samp_rst is low). A second flip flop  202  (FF 2 ) is coupled to the output of FF 1   200  and is operable to sample the output of FF 2  in response to the enable signal, samp. The output of FF 2   202  is asserted as active if the positive edge of test_clk occurs between the release of samp_rst on FF 1   200  and the enabling of FF 2   202  by samp. 
     The flip flops FF 1 , FF 2 , can be standard R/S flip-flops. One or more gates can be added to FF 1   200 , FF 2   202  as needed to provide the described functionality. The samp signal should be asserted long enough to capture the positive edge of test_clk. The operation of the DLFD  106  is described more fully in reference to  FIG. 3 . 
     Example Operation of Clock Detect Circuit 
       FIG. 3  is timing diagram illustrating the operation of the DLFD  106  of  FIG. 2 , both when tripped and not tripped. The clk (e.g., provided by clock A) can be derived from a clock pad, which can be protected by a low frequency detector (e.g., LFD  108 ). The sample period, defined from samp_rst to samp, is greater than the maximum sample period expected on test_clk. When determining the maximum sample period, allowances can be made for clock delaying components and errors, including but not limited to: clock dividers, clock stealers, cycles lost by internal/external clock multiplexers (e.g., multiplexer  110 ), sampling errors, etc. 
     Referring to  FIG. 3 , at the start of the second clk cycle, the samp_rst signal is asserted low causing FF 1  to reset. The release of the samp_rst signal  302  starts the sample period. At the start of the fifth clk cycle, a positive edge  304  of test_clk is detected and FF 1  output goes high  306 . At the start of the tenth clk cycle, samp is asserted high  308 , and the output of FF 1  is pushed (sampled) to the output of FF 2  (active) during the next clk cycle. The assertion of samp ends the sample period. 
     In this example, the FF 2  output is active during the first ten clk cycles shown in  FIG. 3 . The sample period starts at the assertion of samp_rst and ends at the assertion of samp. Samp and samp_rst are each asserted low for one clock period. Samp is asserted high a sample period after samp_rst is asserted high. Samp_rst is asserted low one clk period after samp is asserted high. Preferably, samp_rst is glitch free as it feeds asynchronous flip flops. 
       FIG. 4  is a block diagram of an example DLFD  400 , including an additional flip flop  402  to control metastability. The DLFD  400  operates in the same manner as the DLFD  106  in  FIG. 2 , except the additional flip flop  402  (FF 2 ) is interposed between the output of FF 1   202  and the input of FF 2   204  to control metastability. An additional reset line has been added to reset FF 2  and FF 3  (e.g., reset at power up). 
     There are several advantages associated with the DLFDs  106 ,  400 . For example, the DLFDs  106 ,  400  consume less IC die area than conventional solutions. The DLFDs  106 ,  400  can also be implemented as a standard cell and used with multiple clocks on the IC.