Patent Description:
As ICs have become more complex and powerful, an increasing amount of attention has been paid to the risks posed by unauthorised access to certain parts - e.g. those which contain sensitive data or software or which can be used to exercise unauthorised control of a device incorporating the IC. Manufacturers therefore now routinely employ measures to discourage or prevent such access by hackers.

In recent years, hackers have begun to tamper with actively running digital circuits by injecting energy into the circuit, by means of e.g. an electromagnetic pulse (EMP) or laser attack. Such attacks can provoke faulty behaviour due to changing flip-flop values, spikes on logic nets, or timing changes in the logic. Erroneous toggling of flip-flops is of particular concern, due to the possibility of spike injection in clock nets, such as by an EMP pulse, which can cause a wide set of flops to erroneously change state. <NPL>) discloses a fully-digital mechanism to detect electromagnetic fault injection (EMFI).

Another type of attack is a targeted attack on individual critical flops e.g. by using a backside laser. These critical flops can e.g. protect access to the debug port. A critical flop attack could therefore allow reading out assets or repurposing the circuit with assets still present in the device. As such, although a targeted attack is a higher cost attack, it is potentially more severe.

The Applicant has recognised that EMP attacks pose a security threat to integrated circuits and thus that detection measures are desirable. Typically, if critical flops are identified during design, they are individually protected by a shadow flop. The shadow flop captures the critical flop value. An XNOR gate may then take the critical flop value and the shadow flop value, and an error may be triggered if either of the flops change value due to an energy injection event such as an EMP attack. This design however, only protects the single critical flop to which the shadow flop is connected.

A more typical attack is a directed attack with an EMP probe to a portion of the die. In this case, strong electromagnetic fields are injected onto a portion of the die surface to disturb the flip-flop contents of the die. These attacks typically only toggle components on a portion of a die. Therefore if an EMP attack occurs on a portion of the die which is not individually protected by a shadow flip-flop then no error will be triggered by the attack, allowing it to go undetected.

The present invention aims at least partly to address the issues set out above and when viewed from a first aspect provides an integrated circuit comprising a detection circuit portion for detecting an electromagnetic pulse (EMP) attack on the integrated circuit, the detection circuit portion comprising:.

wherein the error circuit portion is arranged to selectively output an error signal if: the shadow flip-flop is clocked by a signal from the clock net and the clock gate is in the closed state.

Thus it will be appreciated by those skilled in the art that the present invention provides a detection circuit portion for detecting EMP attacks on an integrated circuit. An EMP attack will typically cause the clock net to toggle and therefore the shadow flip-flop to receive a clock pulse from the clock net. If this occurs when there the clock gate is not opened by the enable signal, the clock signal received by the shadow flip-flop will be flagged as an error. The detection circuit portion in accordance with the present invention may only require common circuit elements and as such may be fully compatible with a normal design flow so that it can be instantiated in any normal digital logic circuit. Since the clock net will typically be toggled by an EMP attack even if the clock gate is not opened by the enable signal, the clock net may act as an energy detector. The detection circuit portion is preferably fully passive such that the closure of the clock gate means there is no active power consumption by the detection circuit portion and only minimal leakage currents are incurred.

In a set of embodiments, the integrated circuit further comprises a critical circuit portion. The shadow flip-flop may be arranged to protect the critical circuit portion. The critical circuit portion may receive the clock signal as an input and output a critical signal. The critical signal may then be input to the detection circuit portion. The error circuit portion may be arranged to compare the critical signal and the output from the shadow flip-flop and selectively output an error signal if these two inputs are the same. The critical signal and shadow flip-flop signal may be the same if the shadow flip-flop is clocked by a signal from the clock net when the clock gate is closed, as this may indicate that the pulse in the clock net comes from an EMP attack instead. In a set of embodiments the critical circuit portion comprises a critical flip-flop.

In a set of embodiments, the enable signal only enables the clock signal to pass through the clock gate to the clock net when there is a valid update made to the protected critical circuit portion, such as software writing code to a given register. In such embodiments, the shadow flip-flop is therefore only clocked when a critical value is captured by the critical circuit portion.

As mentioned above, in a set of embodiments, the error circuit portion is arranged to compare the critical signal and the output from the shadow flip-flop and selectively output the error signal if the values are the same. This may indicate that the shadow flip-flop has received one or more unexpected clock edges without a valid update being made causing the shadow flip flop to capture the same (unchanged) value as the critical circuit portion. In a set of embodiments, the detection circuit portion further comprises an XOR gate. The XOR gate may be arranged with a first input being the enable signal and a second input being the critical signal. It will be understood by those skilled in the art that the XOR gate will output a logic <NUM> if the first and second inputs are the same, and a logic <NUM> if the first and second inputs are different.

In a set of embodiments, the error circuit portion comprises an XNOR gate with a first input being the critical signal, and a second input being a signal at the output of the shadow flip-flop. It will be understood by those skilled in the art that the XNOR gate will output a logic <NUM> if the first and second inputs thereof are different, and a logic <NUM> if the first and second inputs thereof are the same. Therefore, an error signal is only output by the XNOR gate if the critical circuit portion output and shadow flip-flop output are the same.

In such embodiments the shadow flip-flop in the detection circuit portion should only be clocked to load the critical value when the enable signal opens the clock gate such that the clock signal is input to the shadow flip-flop. If a subsequent valid update is made to the critical circuit portion which is protected by the detection circuit portion (i.e. a new critical value is provided), then the enable signal will again open the clock gate. The clock gate will therefore enable the clock signal to propagate along the clock net to the shadow flip-flop. The enable signal is also an input to the XOR gate, along with the output of the critical circuit portion which is being validly written. The XOR gate will therefore output an inverted critical value as an input to the shadow flip-flop. The shadow flip-flop will therefore have a different output to the output of the critical circuit portion which it is protecting, and the XNOR gate in the error circuit portion will not output an error signal as the critical signal and shadow flip-flop values will be different.

It will be appreciated therefore that in accordance with preferred embodiments, the enable signal closes the clock gate when the critical circuit portion is not being validly written, so only if there is an energy injection in the vicinity of the clock net will the shadow flip-flop value unexpectedly toggle. This will result in the shadow flip-flop output and the critical circuit portion output having the same value, and as such the XNOR gate in the error circuit portion will output an error signal, which may provide a warning to another part of the IC that there is an EMP attack on the circuit.

In a set of embodiments, the integrated circuit ceases or pauses operation in response to the error signal output by the error circuit portion in order to prevent an attacker accessing any assets protected by the critical circuit portion.

In a set of embodiments, the clock net is distributed around the integrated circuit. The Applicant has appreciated that as the shadow flip-flop only needs to be clocked when the enable signal opens the clock gate in the event of a valid update, the clock net does not need to observe normal timing rules and can therefore be spread out in the proximity of any other custom logic along its path. Part of the clock net may be physically located in the proximity of one or more critical circuit portions; other parts may be spaced away from those critical circuit portions. In this way, the clock net is likely to be toggled by an energy injection event anywhere in the vicinity of the clock net routing, even if the attack point is far away from the end point shadow flip-flop. The circuit may therefore be able to detect the presence of a directed EMP attack even when the shadow flip-flop is not directly in the line of attack, unlike prior art designs which protect an individual critical flip-flop with an individual shadow flip-flop.

In a set of embodiments, the clock net comprises an inverter chain. If the PMOS or NMOS in any inverter in the clock net changes its static behaviour due to the energy injection, this will create a pulse which will propagate down the clock net until it reaches the shadow flip-flop.

In a set of embodiments, the integrated circuit further comprises a clock providing the clock signal. The clock may comprise an electronic oscillator arranged to output a periodic clock signal, such as a crystal oscillator. The clock signal may be used for timing purposes in the integrated circuit.

In order to protect even more critical circuit portions in various parts of the integrated circuit, in a set of embodiments the integrated circuit comprises plurality of detection circuit portions, each detection circuit portion connected to a different critical circuit portion. The clock nets from each of the plurality of detector circuit portions may be physically spread around the integrated circuit, which will offer strong protection against any energy injection events at any location in the integrated circuit.

Where reference is made to different embodiments, it should be understood that these are not necessarily distinct but may overlap.

An embodiment of the invention will now be described, by way of example only, and with reference to the accompanying drawings in which:.

<FIG> shows a circuit diagram of a prior art shadow detector circuit <NUM> in an integrated circuit <NUM>, to protect a critical flip-flop <NUM> which has been identified during design. The shadow detector circuit <NUM> comprises a NOT gate <NUM>, a multiplexer <NUM>, a shadow flip-flop <NUM> and an XNOR gate <NUM>.

The critical flip-flop <NUM> is clocked by a clock signal <NUM>, e.g. from a crystal oscillator, which is also used to clock the shadow flip-flop <NUM>. The critical flip-flop <NUM> output is also connected to the NOT gate <NUM> which is further connected as an input to the multiplexer <NUM>. The multiplexer <NUM> has a second input from the output of the shadow flip-flop <NUM>, as well as a selector input provided by a capture signal <NUM>. The multiplexer <NUM> output provides an input to the shadow flip-flop <NUM>. The XNOR gate <NUM> receives the shadow flip-flop <NUM> output and the critical flip- flop output <NUM>.

The enable signal <NUM> provides a selector input to the multiplexer <NUM>. The enable signal <NUM> is only high when a valid update to the critical flip-flop <NUM> occurs, such as when software is used to write to a given register.

As will be seen below, the shadow detector circuit <NUM> is arranged to output an error signal <NUM> if either the shadow flip-flop <NUM>, or critical flip-flop <NUM> which the shadow flip-flop <NUM> is arranged to protect, change value due to an energy injection event when the enable signal <NUM> is low.

To achieve this, the NOT gate <NUM> provides an inverted version of the critical flop output to the multiplexer <NUM>. Therefore, if the enable signal <NUM> is high the shadow flip-flop <NUM> and critical flip-flop <NUM> outputs will be different, and no error signal <NUM> will be triggered by the XNOR gate <NUM>.

If either the shadow flip-flop <NUM> or critical flip-flop <NUM> output (Q) are changed such that the shadow flip-flop <NUM> and critical flip-flop <NUM> have the same value, an error signal <NUM> will be output by the XNOR gate <NUM>. As the enable signal <NUM> is low when the critical flip-flop <NUM> is not being written to, if either the critical flip-flop <NUM> or shadow flip-flop <NUM> changes value this is interpreted as a potential attack so then the error signal <NUM> will be triggered.

<FIG> shows how in such an arrangement the shadow flip-flop <NUM> can protect only a single critical flip-flop 8D. However, as may be seen, the exemplary synchronous circuit <NUM> contains four critical flip-flops 8A, 8B, 8C, 8D connected to a clock tree <NUM> which is comprised of inverters <NUM>.

As the shadow flip- flop <NUM> is configured to protect only one of the critical flip-flops 8D, only a direct EMP attack which toggles this flip-flop 8D can be detected. However, a more likely attack is a directed attack with an EMP probe to a portion of the die on which the circuit <NUM> is arranged. This type of attack injects strong electromagnetic fields onto a portion of the die surface, in order to disturb flip-flop contents. Typically these attacks will only toggle a portion of the clock tree <NUM>.

<FIG> shows an EMP attack <NUM> on the circuit <NUM> of <FIG>. Flops 8A and 8B are affected by the EMP attack, but flip-flops 8C and 8D are unaffected. As such, the shadow flip-flop <NUM> would offer no protection in the attack shown in <FIG>. Whilst multiple shadow flops could be provided, this will of course add to chip area and therefore cost as well as power consumption.

Even if the EMP attack <NUM> did target the branch of the clock tree <NUM> which contains the shadow flip-flop <NUM>, an error signal <NUM> would only be provided if the flip-flop 8D or the shadow flip-flop <NUM> actually changed value. Moreover, an attack further upstream on the clock tree <NUM> may toggle both the critical flip-flop 8D and the shadow flip-flop <NUM>, in which case no error signal <NUM> would be output. As such, the solution shown in <FIG> offers no protection for other flip-flops 8A, 8B, 8C, and does not even offer full protection for the 'protected' flip-flop 8D as it does not detect energy injection events unless they cause a toggle of just one of the paired flip-flops <NUM>, 8D.

<FIG> is a schematic block diagram of an integrated circuit <NUM> in accordance with the invention. The integrated circuit <NUM> comprises a 'critical' flip-flop <NUM>, e.g. one which controls access to a secure part of the integrated circuit, and a detection circuit portion <NUM> described in greater detail below with reference to <FIG>. A clock <NUM> provides a periodic clock signal <NUM> to the critical flip-flop <NUM> and the detection circuit portion <NUM>. The detection circuit portion <NUM> receives an output signal <NUM> from the critical flip-flop <NUM>. The detection circuit portion <NUM> has a second input which receives an 'enable signal' <NUM> e.g. from a central processing unit (CPU) (not shown) when a valid update to the critical flip-flop <NUM> is being made.

<FIG> shows the detection circuit portion <NUM> in more detail. The detection circuit portion <NUM> comprises a clock gate <NUM> in the form of a flip-flop, a (linear) clock net <NUM> comprising a chain of inverters <NUM>, a shadow flip-flop <NUM>, an XOR gate <NUM> and an error circuit portion <NUM>. The clock gate <NUM> is connected to the root of the clock net <NUM> so the output of the clock gate <NUM> propagates down the clock net <NUM> to the clock input of the shadow flip-flop <NUM>. The error circuit portion <NUM> comprises an XNOR gate <NUM>, the output of which provides the error signal <NUM>. The clock net <NUM> is physically distributed around the integrated circuit <NUM> and located in the proximity of other custom logic along its path, as will be explained later.

The clock signal <NUM> is provided to the clock gate <NUM> as well as to the critical flop <NUM>. The enable signal <NUM> is connected to an input of the clock gate <NUM>, and the XOR gate <NUM>.

The XOR gate <NUM> receives a second input which is the output signal of the critical flip-flop <NUM> known as the critical signal <NUM>. The output of the XOR gate <NUM> provides a second input to the shadow flip-flop <NUM>.

The output of the shadow flip-flop <NUM> is input to the XNOR gate <NUM> of the error circuit portion <NUM>. The output signal <NUM> of the critical flop-flop <NUM> provides a second input to the XNOR gate <NUM> of the error circuit portion <NUM>. The output of the XNOR gate <NUM> provides the error signal <NUM>.

Operation of the detection circuit portion <NUM> will now be described. The clock gate <NUM> is controlled to be in an open or closed state by the enable signal <NUM> so as to selectively pass the clock signal <NUM> to the clock net <NUM> and therefore to the shadow flip-flop <NUM>.

The enable signal <NUM> provided by the CPU (not shown) only switches the clock gate <NUM> to an open state when a valid update to the critical flip-flop <NUM> occurs, such as when software is used to write code to a given register. In this instance, the XOR gate <NUM> sends an inverted value of the critical signal <NUM> to the shadow flip-flop <NUM>. As the enable signal <NUM> switches the clock gate <NUM> to an open state, the clock gate <NUM> passes the clock signal <NUM> to the clock net <NUM>. The clock signal <NUM> then propagates along the clock net <NUM> and clocks the shadow flip-flop <NUM>.

As the shadow flip-flop <NUM> receives the clock signal <NUM> and an inverted value of the critical signal <NUM> as inputs, it outputs the inverse value of the critical signal <NUM>. The XNOR gate <NUM> of the error circuit portion <NUM> therefore has the critical signal <NUM> and the inverse value of the critical flop output from the shadow flip-flop <NUM> as inputs, i.e. its inputs are different. As such, the error signal <NUM> output by the XNOR gate <NUM> of the error circuit portion <NUM> is low. The enable signal <NUM> therefore allows the clock signal <NUM> to pass to the shadow flip-flop <NUM> when the critical flip-flop <NUM> is being validly written.

However the enable signal <NUM> does not allow the clock signal <NUM> to pass through the clock gate <NUM> to the clock net <NUM> when there is no valid update being made to the critical flip-flop <NUM>. The shadow flip-flop <NUM> should therefore not receive any input clock signal when there is no valid update being made to the critical flip-flop <NUM>. The error signal <NUM> will thus remain low.

However in case of an energy injection event, such as an EMP attack in the vicinity of the clock net <NUM> routing, the PMOS or NMOS in any inverter <NUM> in the inverter chain which comprises the clock net <NUM> changes its static behaviour due to the energy injection, creating a pulse which propagates down the clock net <NUM> to the shadow flip-flop <NUM>. This causes the shadow flip-flop <NUM> to change state to match the state of the critical flip-flop <NUM>. Therefore, the two inputs to the XNOR gate <NUM> of the error portion <NUM> are the same, thus triggering the error signal <NUM> to go high. In this situation the clock net therefore acts as an energy detector.

<FIG> shows a simplified circuit diagram illustrating how the detection circuit portion <NUM> as shown in <FIG> can protect multiple critical flip-flops 108A, 108B, 108C, 108D in the integrated circuit <NUM>. The critical flops 108A, 108B, 108C, 108D are connected to a clock tree <NUM> which is comprised of inverters <NUM>. It may be seen that the clock net <NUM> of the error detection circuit <NUM> is physically distributed around the IC <NUM> so that the inventers <NUM> thereof are adjacent to various elements such as the inverters <NUM> of the clock tree <NUM> and one of the critical flip-flops 108D. Since the clock net <NUM> only toggles once to load the shadow flip-flop <NUM>, it does not need to observe normal timings rules and as such it is not adversely affected by being physically spread out around the integrated circuit <NUM>.

The consequence of this is that it increases the chance that an EMP attack <NUM> occurs in the vicinity of one of the inverters <NUM> in the clock net <NUM>. The detector <NUM> is therefore more sensitive to an attack on any part of the circuit compared to the prior art shadow detector shown in <FIG>. Any unexpected toggling of the clock net <NUM> when there is no enable signal will result in an error signal <NUM>.

In order to protect more multiple critical flip-flops, multiple clock nets <NUM> associated with multiple detector circuits may be spread around the circuit.

If the error signal <NUM> goes high, the CPU may implement preventative measures such as rebooting, or pausing operation.

It will be appreciated by those skilled in the art that the detection circuit portion <NUM> described herein does not depend on any uncommon constructs; it is also fully compatible with a normal design flow, and can be instantiated in any normal digital logic circuit. Moreover as the illustrated detection circuit portion <NUM> is a fully passive circuit, it provides protection for critical flip-flops with very low added cost or leakage, and no active power consumption.

Claim 1:
An integrated circuit (<NUM>) comprising a detection circuit portion (<NUM>) for detecting an electromagnetic pulse attack on the integrated circuit (<NUM>), the detection circuit portion (<NUM>) comprising:
a shadow flip-flop (<NUM>) comprising a clock input; and
characterized by further comprising:
a clock net (<NUM>) connected to said clock input;
a clock gate (<NUM>) connected to the clock net (<NUM>), wherein the clock gate (<NUM>) is controlled by an enable signal so as selectively to be in an open state in which the clock gate (<NUM>) passes a clock signal to the clock net (<NUM>) or in a closed state in which the clock gate (<NUM>) does not pass the clock signal to the clock net (<NUM>); and
an error circuit portion (<NUM>);
wherein the error circuit portion (<NUM>) is arranged to selectively output an error signal if: the shadow flip-flop (<NUM>) is clocked by a signal from the clock net (<NUM>) and the clock gate (<NUM>) is in the closed state.