Patent Description:
A multitude of mechanisms are disclosed for enhancing security and preventing hacking of a flash memory device.

<CIT> discloses that the present invention discloses systems and methods for communicating with a storage device configured to store signed program files, the method including the steps of: generating, by a program process, a respective command number associated with a process command; issuing, by the program process, the process command with the respective command number to the storage device; and according to the respective command number, verifying, by the storage device, whether the process command originated from a trusted program process launched from the program files stored in the storage device. Preferably, the step of verifying includes: generating, by the storage device, a respective initial command number associated with a requested program file; and attaching, by the storage device, the respective initial command number to a copy of the requested program file.

Non-volatile memory cells are well known in the art. One prior art non-volatile split gate memory cell <NUM>, which contains five terminals, is shown in <FIG>. Memory cell <NUM> comprises semiconductor substrate <NUM> of a first conductivity type, such as P type. Substrate <NUM> has a surface on which there is formed a first region <NUM> (also known as the source line SL) of a second conductivity type, such as N type. A second region <NUM> (also known as the drain line) also of N type is formed on the surface of substrate <NUM>. Between the first region <NUM> and the second region <NUM> is channel region <NUM>. Bit line BL <NUM> is connected to the second region <NUM>. Word line WL <NUM> is positioned above a first portion of the channel region <NUM> and is insulated therefrom. Word line <NUM> has little or no overlap with the second region <NUM>. Floating gate FG <NUM> is over another portion of channel region <NUM>. Floating gate <NUM> is insulated therefrom, and is adjacent to word line <NUM>. Floating gate <NUM> is also adjacent to the first region <NUM>. Floating gate <NUM> may overlap the first region <NUM> to provide coupling from the first region <NUM> into floating gate <NUM>. Coupling gate CG (also known as control gate) <NUM> is over floating gate <NUM> and is insulated therefrom. Erase gate EG <NUM> is over the first region <NUM> and is adjacent to floating gate <NUM> and coupling gate <NUM> and is insulated therefrom. The top corner of floating gate <NUM> may point toward the inside corner of the T-shaped erase gate <NUM> to enhance erase efficiency. Erase gate <NUM> is also insulated from the first region <NUM>. Memory cell <NUM> is more particularly described in <CIT>.

One exemplary operation for erase and program of prior art non-volatile memory cell <NUM> is as follows. Memory cell <NUM> is erased, through a Fowler-Nordheim tunneling mechanism, by applying a high voltage on erase gate <NUM> with other terminals equal to zero volts. Electrons tunnel from floating gate <NUM> into erase gate <NUM> causing floating gate <NUM> to be positively charged, turning on the cell <NUM> in a read condition. The resulting cell erased state is known as ` <NUM>' state.

Memory cell <NUM> is programmed, through a source side hot electron programming mechanism, by applying a high voltage on coupling gate <NUM>, a high voltage on source line <NUM>, a medium voltage on erase gate <NUM>, and a programming current on bit line <NUM>. A portion of electrons flowing across the gap between word line <NUM> and floating gate <NUM> acquire enough energy to inject into floating gate <NUM> causing the floating gate <NUM> to be negatively charged, turning off the cell <NUM> in a read condition. The resulting cell programmed state is known as '<NUM>' state.

Memory cell <NUM> is read in a Current Sensing Mode as following: A bias voltage is applied on bit line <NUM>, a bias voltage is applied on word line <NUM>, a bias voltage is applied on coupling gate <NUM>, a bias or zero voltage is applied on erase gate <NUM>, and a ground is applied on source line <NUM>. There exists a cell current flowing from bit line <NUM> to source line <NUM> for an erased state and there is insignificant or zero cell current flow from the bit line <NUM> to the source line <NUM> for a programmed state. Alternatively, memory cell <NUM> can be read in a Reverse Current Sensing Mode, in which bit line <NUM> is grounded and a bias voltage is applied on source line <NUM>. In this mode the current reverses the direction from source line <NUM> to bitline <NUM>.

Memory cell <NUM> alternatively can be read in a Voltage Sensing Mode as following: A bias current (to ground) is applied on bit line <NUM>, a bias voltage is applied on word line <NUM>, a bias voltage is applied on coupling gate <NUM>, a bias voltage is applied on erase gate <NUM>, and a bias voltage is applied on source line <NUM>. There exists a cell output voltage (significantly >0V) on bit line <NUM> for an erased state and there is insignificant or close to zero output voltage on bit line <NUM> for a programmed state. Alternatively, memory cell <NUM> can be read in a Reverse Voltage Sensing Mode, in which bit line <NUM> is biased at a bias voltage and a bias current (to ground) is applied on source line <NUM>. In this mode, memory cell <NUM> output voltage is on the source line <NUM> instead of on the bit line <NUM>.

In the prior art, various combinations of positive or zero voltages were applied to word line <NUM>, coupling gate <NUM>, and floating gate <NUM> to perform read, program, and erase operations.

In response to the read, erase or program command, the logic circuit <NUM> (in <FIG>) causes the various voltages to be supplied in a timely and least disturb manner to the various portions of both the selected memory cell <NUM> and the unselected memory cells <NUM>.

For the selected and unselected memory cell <NUM>, the voltage and current applied are as follows. As used hereinafter, the following abbreviations are used: source line or first region <NUM> (SL), bit line <NUM> (BL), word line <NUM> (WL), and coupling gate <NUM> (CG).

In a recent application by the applicant-<CIT> - the applicant disclosed an invention whereby negative voltages could be applied to word line <NUM> and/or coupling gate <NUM> during read, program, and/or erase operations. In this embodiment, the voltage and current applied to the selected and unselected memory cell <NUM>, are as follows.

In another embodiment of <CIT>, negative voltages can be applied to word line <NUM> when memory cell <NUM> is unselected during read, erase, and program operations, and negative voltages can be applied to coupling gate <NUM> during an erase operation, such that the following voltages are applied:.

The CGINH signal listed above is an inhibit signal that is applied to the coupling gate <NUM> of an unselected cell that shares an erase gate <NUM> with a selected cell.

<FIG> depicts an embodiment of another prior art flash memory cell <NUM>. As with prior art flash memory cell <NUM>, flash memory cell <NUM> comprises substrate <NUM>, first region (source line) <NUM>, second region <NUM>, channel region <NUM>, bit line <NUM>, word line <NUM>, floating gate <NUM>, and erase gate <NUM>. Unlike prior art flash memory cell <NUM>, flash memory cell <NUM> does not contain a coupling gate or control gate and only contains four terminals - bit line <NUM>, word line <NUM>, erase gate <NUM>, and source line <NUM>. This significantly reduces the complexity of the circuitry, such as decoder circuitry, required to operate an array of flash memory cells.

The erase operation (erasing through erase gate) and read operation are similar to that of the <FIG> except there is no control gate bias. The programming operation also is done without the control gate bias, hence the program voltage on the source line is higher to compensate for lack of control gate bias.

Table No. <NUM> depicts typical voltage ranges that can be applied to the four terminals for performing read, erase, and program operations:.

<FIG> depicts an embodiment of another prior art flash memory cell <NUM>. As with prior art flash memory cell <NUM>, flash memory cell <NUM> comprises substrate <NUM>, first region (source line) <NUM>, second region <NUM>, channel region <NUM>, bit line <NUM>, and floating gate <NUM>. Unlike prior art flash memory cell <NUM>, flash memory cell <NUM> does not contain a coupling gate or control gate or an erase gate. In addition, word line <NUM> replaces word line <NUM> and has a different physical shape than word line <NUM>, as depicted.

One exemplary operation for erase and program of prior art non-volatile memory cell <NUM> is as follows. The cell <NUM> is erased, through a Fowler-Nordheim tunneling mechanism, by applying a high voltage on the word line <NUM> and zero volts to the bit line and source line. Electrons tunnel from the floating gate <NUM> into the word line <NUM> causing the floating gate <NUM> to be positively charged, turning on the cell <NUM> in a read condition. The resulting cell erased state is known as '<NUM>' state. The cell <NUM> is programmed, through a source side hot electron programming mechanism, by applying a high voltage on the source line <NUM>, a small voltage on the word line <NUM>, and a programming current on the bit line <NUM>. A portion of electrons flowing across the gap between the word line <NUM> and the floating gate <NUM> acquire enough energy to inject into the floating gate <NUM> causing the floating gate <NUM> to be negatively charged, turning off the cell <NUM> in read condition. The resulting cell programmed state is known as '<NUM>' state.

Exemplary voltages that can be used for the read, program, erase, and standby operations in memory cell <NUM> are shown below in Table <NUM>:.

Security and anti-tampering measures are becoming increasingly important as cyber-attackers and hackers become more and more sophisticated. For example, when a mobile phone is stolen, it is common for the thief or someone to whom the phone is sold to attempt to retrieve data from the phone. This can be done by hacking the password to the phone, or by hacking underlying hardware within the phone.

The prior art includes dozens of software-based security measures that can be implemented on the system level (e.g., for the phone). These measures, however, do not prevent someone from disassembling the phone and retrieving data directly from non-volatile storage such as from a flash memory device. To date, the security measures available for flash memory devices have been extremely limited.

What is needed are improved security measures specifically for flash memory devices.

Multiple embodiments are disclosed for enhancing security and preventing hacking of a flash memory device. The embodiments prevent malicious actors from hacking a flash memory chip to obtain data that is stored within the chip. The embodiments include the use of fault detection circuits, address scrambling, dummy arrays, password protection, improved manufacturing techniques, and other mechanisms.

<FIG> depicts an embodiment of a flash memory system comprising the security enhancements described herein. Die <NUM> comprises: memory arrays <NUM>, <NUM>, <NUM>, and <NUM> for storing data, each memory array optionally utilizing memory cell <NUM> as in <FIG>, memory cell <NUM> as in <FIG>, memory cell <NUM> as in <FIG>, or other known types of memory cells; row decoder circuits <NUM>, <NUM>, <NUM>, and <NUM> used to access the row in memory arrays <NUM>, <NUM>, <NUM>, and <NUM>, respectively, to be read from or written to; column decoder circuits <NUM>, <NUM>, <NUM>, and <NUM> used to access the column in memory arrays <NUM>, <NUM>, <NUM>, and <NUM>, respectively, to be read from or written to; sensing circuit <NUM> used to read data from memory arrays <NUM> and <NUM> and sensing circuit <NUM> used to read data from memory arrays <NUM> and <NUM>; analog, chip fault detection (CFD), and physically unclonable function (PUF) circuits <NUM>; logic and logic fault detection (LFD) circuits <NUM> for providing various control functions, such as redundancy and built-in self-testing; high voltage circuits <NUM> used to provide positive and negative voltage supplies for the system; charge pump circuits <NUM> to provide increased voltages for erase and program operations for memory arrays <NUM>, <NUM>, <NUM>, and <NUM>; interface circuit (ITFC) <NUM> to provide interface pins to connect to other macros on chip; and high voltage decoder circuits <NUM>, <NUM>, <NUM>, and <NUM> used during read, erase, and program operations as needed. Die <NUM> further comprises address fault detection blocks <NUM>, <NUM>, <NUM>, and <NUM> and array fault detection sense circuits <NUM>, <NUM>, <NUM>, and <NUM>.

A first embodiment is depicted in <FIG>. Here, certain sectors and information sectors are subject to security measures to make them secured sectors and secured information sectors, respectively. Array <NUM> is an example of one of memory arrays <NUM>, <NUM>, <NUM>, and <NUM> for storing data, where array <NUM> comprises rows and columns of memory cells such as memory cell <NUM> in <FIG>, memory cell <NUM> in <FIG>, memory cell <NUM> in <FIG>, or other known types of memory cells. Array <NUM> is divided into a plurality of sectors. A sector typically consists of two rows of memory cells in the array. Unsecured sectors <NUM> and <NUM> are normal sectors with no added security measure. Secured sectors <NUM> and <NUM> are written to and read from using a scrambling algorithm described below.

In one embodiment, sector <NUM> is never erased or programmed and serves as a source for a random number generator, as described in <CIT>, and titled "System And Method For Generating Random Numbers Based On Non-volatile Memory Cell Array Entropy" ("Random Number Application") which was filed by the same assignee as the present application. As indicated in the Random Number Application, it has been discovered that by reading memory cells in pairs using differential sensing (which requires <NUM> memory cells for each bit of information), in subthreshold operation (meaning that the select gates are off so that any detected read current is leakage current only), the leakage current provides a good measure of the randomness of the cells. Each bit value of information is derived from the leakage current of four memory cells, combined onto two bit lines, with the two combined currents being subtracted from each other to yield a positive or negative result reflective of a single bit value. It is the combination of these single bit values for all of the dedicated cells that provide a number that is random (reflecting the randomness of the memory cell fabrication cell-to-cell), is unique to the memory cell array, and can be reliably and repeatably read from the memory cell array. Alternatively, a random number can be generated by a PUF (physically unclonable function) based on an intrinsic characteristic of a flash memory cell, such as coupling ratio variation, dimensional characteristics (e.g.,width, length, thickness), and electrical mismatch (such threshold voltage variation). For example, programming or erasing at a fixed voltage for all cells in an array will result in some random cell current levels for different cells. Differential latch sensing can be used with two different cells to establish a random output, basically comparing one cell versus the other. The two cells are strategically placed to maximize entropy. The mismatch between the two cells will result in a random unique number. Multiple cells can be used to represent one super cell to enhance repeatability of the random number generation over variations in process, temperature and voltage. For example, <NUM> cells can represent one input to the differential amplifier, hence a total of <NUM> cells are required to generate one random bit.

Here, control logic <NUM> determines a random number from cells in sector <NUM> using the invention of the Random Number Application or other techniques, and it utilizes that random number in programming and reading from secured sectors <NUM> and <NUM>. For example, the random number, R, can be applied to an address as an offset. If a write operation to secured sectors <NUM> and <NUM> is intended for Address A, then the write operation might actually occur to a location in the row corresponding to Address A with an offset within the row equal to R*k (where k is a constant for generating an integer value), where the offset simply causes the write to occur in that row but at a cell that is R*k locations to the right of the cell corresponding to Address A (where you simply wrap around to the cell in that row in the first column after the cell in that row in the last column). In this manner, the random number R affects the location of write operations to secured sectors <NUM> and <NUM>. For read operations from sectors <NUM> and <NUM>, the same random number R is used to perform an offset to an Address A that is the subject of the read request. Thus, a hacker who wishes to read data from Address A will be unable to do so since he or she will not know the random number R.

In another embodiment, then data is read from secured sectors <NUM> and <NUM>, optionally random data can be read in parallel from another sector, such that if sense amplifiers are hacked, it will be unclear which data was stored in secured sectors <NUM> and <NUM> and which data was the "dummy" random data read from elsewhere.

Metadata or system information typically is stored in array <NUM> as well. Here, unsecured information sector <NUM> is a normal information sector with no added security measure. Secured information sector <NUM> is subject to the same mechanism as secured sectors <NUM> and <NUM>, the only difference being that secured information sector <NUM> contains metadata or system information and not user data.

<FIG> depicts password-protected access method <NUM>, whereby an outside device is allowed to access die <NUM> for reading or writing only if it provides the password that was previously stored in secured information sector <NUM>. First, die <NUM> receives password authentication request <NUM> comprising received password <NUM> (step <NUM>). Second, authentication controller <NUM> compares received password <NUM> against stored password <NUM> (step <NUM>). Here, authentication controller <NUM> can be part of logic circuit <NUM>, and stored password <NUM> was previously stored in secured information sector <NUM> or elsewhere in die <NUM> during the manufacturing of die <NUM>, during the initial configuration of die <NUM>, or be a user during the first use of die <NUM>. If received password <NUM> is the same as stored password <NUM>, then die <NUM> permits the access requested by the outside device (step <NUM>). If received password <NUM> is not the same as stored password <NUM>, then die <NUM> does not permit the access requested by the outside device (step <NUM>). Optionally, access to secured information sector <NUM> can be disabled after stored password <NUM> is initially stored there, for example, by setting an OTP bit. Optionally, stored password <NUM> can be encrypted and decrypted by authentication controller <NUM> using a unique key generated by a PUF (physically unclonable function) based on variation of non-volatile memory such as described in the Random Number Application or as described above.

<FIG> depicts a flash memory system <NUM> (which can be implemented on die <NUM>). Flash memory system <NUM> comprises arrays <NUM> and <NUM> (corresponding to arrays <NUM> and <NUM> in <FIG>), row decoders <NUM> and <NUM> (corresponding to row decoders <NUM> and <NUM>), column decoders <NUM> and <NUM> (corresponding to column decoders <NUM> and <NUM>), and sensing circuit <NUM> (corresponding to sensing circuit <NUM>). Flash memory system <NUM> further comprises reference array <NUM> and sensing circuit current reference <NUM>.

Each column of flash memory cells in array <NUM> is coupled to a bit line, such that there is one bit line for every column in array <NUM>. Similarly, each column of flash memory cells in array <NUM> is coupled to a bit line, such that there is one bit line for every column in array <NUM>. Column decoders <NUM> and <NUM> connect selected bit lines to sensing circuit <NUM> during a read operation for a selected address. Sensing circuit <NUM> comprises a plurality of sense amplifier circuits 707a, 707b,. 707n, where n is the number of bit lines that can be read concurrently and is referred to as the IO width of flash memory system <NUM> (typically, n is <NUM> or <NUM>). These sense amplifier circuits will be referred to collectively as sense amplifier circuits <NUM>.

In this embodiment, reference array <NUM> is an array of dummy flash memory cells that are identical in structure to the flash memory cells of arrays <NUM> and <NUM> but which are not actually used to store user data. The reference array <NUM> serves to generate read reference bias for sensing both arrays <NUM> and <NUM>. In an alternative embodiment, reference array <NUM> comprises regular reference transistors without flash memory cells. These regular reference transistors are sized and/or biased differently to provide different trip points (i.e., the current or voltage level that demarcates a "<NUM>" from a "<NUM>") for the sensing circuit <NUM>. In another alternative embodiment, reference array <NUM> comprises regular reference resistors without flash memory cells. These regular reference resistors are sized differently to provide different trip points for the sensing circuit <NUM>.

Sensing circuit current reference <NUM> is coupled to one or more of the dummy flash memory cells and generates a current. Using current mirror techniques, that current is mirrored in each of the sense amplifier circuits <NUM>. The mirrored reference current is them compared against a selected memory cell from array <NUM> or <NUM> to generate an output that indicates the value of the data stored in the selected memory cell.

<FIG> depicts another flash memory system <NUM> (which can be implemented on die <NUM>). Flash memory system <NUM>, like flash memory system <NUM>, comprises arrays <NUM> and <NUM>, row decoders <NUM> and <NUM>, and column decoders <NUM> and <NUM>. Flash memory system <NUM> further comprises reference arrays <NUM> and <NUM> and sensing circuit <NUM>.

Each column of flash memory cells in array <NUM> is coupled to a bit line, such that there is one bit line for every column in array <NUM>. Similarly, each column of flash memory cells in array <NUM> is coupled to a bit line, such that there is one bit line for every column in array <NUM>. Column decoders <NUM> and <NUM> connect selected bit lines to sensing circuit <NUM> during a read operation for a selected address. Sensing circuit <NUM> comprises a plurality of sense amplifier circuits 804a, 804b,. 804n, where n is the number of bit lines that can be read concurrently and is referred to as the IO width of flash memory system <NUM> (typically, n is <NUM> or <NUM>). These sense amplifier circuits will be referred to collectively as sense amplifier circuits <NUM>.

In this embodiment, reference arrays <NUM> and <NUM> both are an array of dummy flash memory cells that are identical in structure to the flash memory cells of arrays <NUM> and <NUM> but which are not actually used to store user data. When the selected memory cells are in array <NUM>, each sense amplifier circuit <NUM> will be connected to a memory cell in reference array <NUM>, where that memory cell will act as a reference memory cell. When the selected memory cells are in array <NUM>, each sense amplifier circuit <NUM> will be connected to a memory cell in reference array <NUM> that will act as a reference memory cell. Thus, unlike flash memory system <NUM>, flash memory system <NUM> does not require sensing circuit current reference <NUM> or the use of current mirrors. In another alternative embodiment, reference arrays <NUM> and <NUM> comprise regular reference transistors without flash memory cells. These regular reference transistors are sized and/or biased differently to provide different trip points for the sensing circuit <NUM>. In another alternative embodiment, the reference arrays <NUM> and <NUM> comprise regular reference resistors without flash memory cells. These regular reference resistors are sized differently to provide different trip points for the sensing circuit <NUM>.

<FIG> depicts a system and method of system power balancing for providing security against a situation where a hacker is monitoring a signature of the power consumption such as by utilizing Side Channel Attack techniques using Simple Power Analysis SPA or Differential Power Analysis DPA) of die <NUM> or certain components within die <NUM> in an attempt to determine the data that is stored within the arrays. Specifically, in prior art flash memory systems, a hacker could discern the data being read by a sensing circuit based on the power consumption of each read cycle. For example, a different amount of power will be consumed for reading a "<NUM>" from a flash memory cell compared to reading a "<NUM>" from a flash memory cell. Thus, by monitoring the power consumption of a sensing circuit, one could deduce the values of the cells being read, and therefore could deduce the data that was being read from the array.

In the system of <FIG>, when Data D is written to Address A in array <NUM> or <NUM>, the complement of that data, DATA D-bar, is written to Address A in array <NUM> or <NUM>. Thereafter, when data is read from Address A in arrays <NUM> or <NUM>, data also is read concurrently from Address A in arrays <NUM> or <NUM>. Because the data stored in the two arrays at the same address necessarily are complements of one another, for each read operation, both a "<NUM>" and a "<NUM>" will be read, and the combined power consumption of sensing circuits <NUM> and <NUM> will be the same for every read operation. A hacker therefore will not be able to determine the data that is read from any of the arrays simply by monitoring the power consumed by sensing circuits <NUM> and <NUM>. The above power balancing approach can be applied at the system level where there are multiple instances of flash memory macros that are being used. In this case, DATA D is stored in one instance and DATA D-bar is stored in another instance and both DATA D and DATA D-bar are being activated in a read operation at the same time.

<FIG> depicts memory array and noise component <NUM>. Here, data is written into array <NUM> or <NUM> as in the prior art. However during a read operation, sensing circuit <NUM> reads the data from array <NUM> or <NUM>, and sensing circuit <NUM> reads concurrently random data from an address in array <NUM> or <NUM>. Thus, the combined power consumption of sensing circuits <NUM> and <NUM> will include a component attributable to the data being read from array <NUM> or <NUM> and a component attributable to a "<NUM>" or "<NUM>" being read from a random data in array <NUM> or <NUM>. As a result, a hacker will be unable to discern all of the data being read from array <NUM> or <NUM> based on the power consumption of sensing circuits <NUM> and <NUM> due to the random data read from array <NUM> or <NUM>, particularly in the situation where a "<NUM>" and "<NUM>" or a "<NUM>" and "<NUM>" are read by sensing circuits <NUM> and <NUM>. In an embodiment that includes multiple instances of flash memory macros, only one flash memory macro is needed to store the random data. The macro with random data is activated in parallel when reading data from any other flash memory macros.

<FIG> depicts differential memory arrays <NUM>. Here, the arrays are arrays <NUM> and <NUM> from <FIG>. It is to be understood that the arrays also could be arrays <NUM> and <NUM> and their associated circuitry, or any other pair of arrays. In the system of <FIG>, when Data D is written to Address A in array <NUM>, the complement of that data, DATA D-bar, is written to Address A in array <NUM>. Thereafter, when data is read from Address A in array <NUM> or <NUM>, data also is read concurrently from Address A in array <NUM>. Because the data stored in the two arrays at the same address necessarily are complements of one another, for each read operation, both a "<NUM>" and a "<NUM>" will be read, and the power consumption of sensing circuit <NUM> will be the same for every read operation. A hacker therefore will not be able to determine the data that is read from any of the arrays simply by monitoring the power consumed by sensing circuit <NUM>.

<FIG> depicts exemplary circuitry for sensing circuit <NUM>. Sense amplifier circuit <NUM> comprises memory data read block <NUM>, memory reference read block <NUM>, and differential amplifier block <NUM>.

Memory data read block <NUM> comprises sensing load PMOS transistor <NUM>, switch <NUM> to apply a bias voltage VBLRD_BIAS to sensing node <NUM>, and enabling sensing NMOS transistor <NUM> coupled to selected memory cell <NUM>. Sensing load PMOS transistor <NUM> provides a read reference current to be compared versus the cell current from memory cell <NUM>. The sensing node <NUM> goes high (toward VDDIO <NUM>) if the read reference current from sensing load PMOS transistor <NUM> is larger than the memory cell current and goes low (toward ground) if the memory cell current is larger than the read reference current. The reference current from sensing load PMOS transistor <NUM> optionally can be provided using a current mirror configuration whereby it a current from a reference memory cell. Alternatively, the reference current from sensing load PMOS transistor <NUM> can be provided using a current mirror configuration whereby it mirrors a current from a reference resistor or a reference transistor, appropriately sized or biased.

Memory reference read block <NUM> comprises sensing load PMOS transistor <NUM>, switch <NUM> to apply a bias voltage VBLRD_BIAS on reference node <NUM>, and enabling sensing NMOS transistor <NUM> coupled to complementary memory cell <NUM>. Complementary memory cell <NUM> serves as a holding capacitor to hold the reference voltage VBLRD _BIAS on the sensing node <NUM>. Alternatively, an explicit capacitor such as a MOMCAP (metal oxide metal cap) can be used as a holding capacitor. Alternatively, parasitic capacitances such as from a junction capacitance or a gate capacitance on node <NUM> can be used as a holding capacitor. The reference block <NUM> serves as a dummy block for reference node <NUM>. The reference sensing load PMOS transistor <NUM> may be in an off state or may be used to provide a compensatory leakage current such as for leakage on node <NUM> from junction and/or transistor leakage on an un-selected bitline. The bias voltage level on VBLRD_BIAS serves as a reference voltage on reference node <NUM> to be compared against sensing voltage on the sensing node <NUM>.

Differential amplifier block <NUM> comprises input cross coupled PMOS transistors <NUM> and <NUM> and input cross coupled NMOS transistors <NUM> and <NUM> together forming a comparator, PMOS enabling transistor <NUM> (which also acts as a transient bias tail current for the cross coupled PMOS transistor <NUM> and <NUM>), and NMOS enabling transistor <NUM> (which also acts as a transient bias tail current for the cross coupled NMOS transistors <NUM> and <NUM>). In comparison, the NMOS transistor <NUM> is enabled first to trigger the comparison from the NMOS transistors <NUM> and <NUM> to develop a voltage delta between node <NUM> and <NUM>, and then the PMOS transistor <NUM> is enabled to start the comparison from the PMOS transistors <NUM> and <NUM>, which restores the full power supply to both nodes <NUM> and <NUM>. Alternatively, both NMOS transistor <NUM> and PMOS transistor <NUM> can be enabled simultaneously to trigger the comparison.

During operation, differential amplifier block <NUM> will compare sensing node <NUM> created by memory data read block <NUM> and reference node <NUM> created by memory reference read block <NUM> to generate output <NUM>. Initially, the voltages on nodes <NUM> and <NUM> are initialized at the same reference voltage level VBLRD _BIAS (by the switches <NUM> and <NUM>). Then the voltage on sensing node <NUM> is developed (going high or low depending on the selected memory cell current <NUM> is less or more than the read reference current conducting in the PMOS transistor <NUM>). Then the comparison is triggered to compare the voltage on sensing node <NUM> versus the voltage on reference node <NUM> (by transistors <NUM> and <NUM>). The final voltage on sensing node <NUM> and reference node <NUM> is at full supply level after the comparison is completed.

If the read reference current conducting in transistor <NUM> exceeds the memory cell current drawn from memory cell <NUM> (signifying that a "<NUM>" is stored in the selected memory cell), then output <NUM> will be low. If the read reference current in transistor <NUM> is less than the memory cell current drawn from memory cell <NUM> (signifying that a "<NUM>" is stored in the selected memory cell), then output <NUM> will be high.

Memory data read block <NUM> and memory reference read block <NUM> draw power from power bus <NUM> (also labeled VDDIO, i.e., IO power supply), which typically is around <NUM> volts. Differential amplifier block <NUM> draws power from power bus <NUM> (also labeled VDDSA, typically core logic power supply), which typically is around <NUM> volts or lower for scaled technology node such as <NUM> or smaller. To get high memory cell current for high performance requirements, the read bitline voltage needs to be as high as possible, meaning the voltage on node <NUM> needs to be high, such as 1v to <NUM>. This means transistor <NUM> needs to work from a voltage supply that is much higher than the core logic supply of typically <=<NUM>. Hence, circuit blocks <NUM> and <NUM> need to work at IO supply, which is much higher than the core logic supply. This means circuit blocks <NUM> and <NUM> will include 3v IO transistors, which require a relatively large area.

In another method of operation for sensing circuit <NUM>, sensing circuit <NUM> operates as a differential sensing circuit with two complementary cells as follows. The sensing load PMOS transistor <NUM> of the memory data read block <NUM> may be in an off state or may be used to provide a compensatory leakage current such as for leakage on node <NUM> from junction and/or transistor leakage on a selected bitline. The switch <NUM> is used to pre-charge the sensing node <NUM> to a bias voltage VBLRD_BIAS. In the mean-time, the switch <NUM> is used to pre-charge the reference node <NUM> to the bias voltage VBLRD_BIAS. The complementary memory cell <NUM> is now coupled to anther memory cell that has its data complementary to that of the selected cell <NUM>. After the pre-charging period, for example for the case when the selected cell <NUM> data is '<NUM>' and the complementary cell <NUM> data is `<NUM>', the sensing node <NUM> and the reference node <NUM> will both discharge towards ground with the sensing node <NUM> being faster. At certain time during the ramping down, the comparator circuit <NUM> is enabled to compare the sensing node <NUM> versus the reference node <NUM>. For the above case when the selected cell <NUM> data is '<NUM>' and the complementary cell <NUM> data is '<NUM>', the sensing node <NUM> will go to ground and the reference node <NUM> will go towards VDDSA. In this case, the entire circuit <NUM> only needs to operate from the VDDSA supply (core logic supply). This method is a preferred method to apply to the differential memory array <NUM>.

<FIG> depicts a power balancing circuitry for sensing circuit <NUM>. Sense amplifier circuit <NUM> comprises memory data read block <NUM>, memory reference read block <NUM>, and differential amplifier block <NUM>. The sensing circuit <NUM> is a balanced (constant) power differential latch sensing circuit that provides a balanced power in response to any data pattern.

Memory data read block <NUM> comprises sensing load PMOS transistor <NUM>, switch <NUM> to apply a bias voltage VBLRD _BIAS to sensing node <NUM>, and enabling sensing NMOS transistor <NUM> coupled to selected memory cell <NUM>. Sensing load PMOS transistor <NUM> provides a read reference current to be compared versus the cell current from memory cell <NUM>. The sensing node <NUM> goes high (toward VDDIO <NUM>) if the read reference current from sensing load PMOS transistor <NUM> is larger than the memory cell current and goes low (toward ground) if the memory cell current is larger than the read reference current. The reference current from sensing load PMOS transistor <NUM> optionally can be provided using a current mirror configuration whereby it a current from a reference memory cell. Alternatively, the reference current from sensing load PMOS transistor <NUM> can be provided using a current mirror configuration whereby it mirrors a current from a reference resistor or a reference transistor, appropriately sized or biased.

Memory reference read block <NUM> comprises sensing load PMOS transistor <NUM>, switch <NUM> to apply a bias voltage VBLRD_BIAS on reference node <NUM>, and enabling sensing NMOS transistor <NUM> coupled to complementary memory cell <NUM>. Complementary memory cell <NUM> serves as a holding capacitor to hold the reference voltage VBLRD _BIAS on the sensing node <NUM>. Alternatively, an explicit capacitor such as a MOMCAP (metal oxide metal cap) can be used as a holding capacitor. Alternatively, parasitic capacitances such as from a junction capacitance or a gate capacitance on node <NUM> can be used as a holding capacitor. The reference block <NUM> serves as a dummy block for reference node <NUM>. The reference sensing load PMOS transistor <NUM> may be in an off state or may be used to provide a bias current including a reference current and a compensatory leakage current such as for leakage on node <NUM> from junction and/or transistor leakage on an un-selected bitline. The bias voltage level on VBLRD _BIAS serves as a reference voltage on reference node <NUM> to be compared against sensing voltage on the sensing node <NUM>.

Differential amplifier block <NUM> further comprises PMOS transistor <NUM> and NMOS transistors <NUM> and <NUM>, which together that form a balancing power circuit that can provide a balanced power for the sensing circuit <NUM> in response to any data pattern. The transistor <NUM> is sized such that voltage level on the sensing node <NUM> is less than voltage level on reference node <NUM> when the selected cell <NUM> is in an erased state (memory cell conducting large current).

During operation, differential amplifier block <NUM> will compare sensing node <NUM> created by memory data read block <NUM> and reference node <NUM> created by memory reference read block <NUM> to generate output <NUM>. Initially, the voltages on nodes <NUM> and <NUM> are initialized at the same reference voltage level VBLRD _BIAS (by the switches <NUM> and <NUM>). Then the voltage on sensing node <NUM> is developed more or less than reference node <NUM> (depending on the selected memory cell current <NUM> versus the read reference current conducting in the PMOS transistor <NUM>). Then the comparison is triggered to compare the voltage on sensing node <NUM> versus the voltage on reference node <NUM> (by transistors <NUM> and <NUM>). The final voltage on sensing node <NUM> and reference node <NUM> is at full supply level after the comparison is completed.

<FIG> depicts a system and method for providing security against a situation where a hacker is monitoring the power consumption of die <NUM> or certain components within die <NUM> during a programming operation. Specifically, in prior art flash memory systems, one could discern whether a cell was being programmed (i.e., a "<NUM>" was bring written into the cell) by monitoring the power consumption for each programming cycle, which would indicate whether a "<NUM>" is being programmed or not (here, not programmed means that the cell will remain a "<NUM>").

In the system of <FIG>, when Data D is written to Address A in array <NUM>, the complement of that data, DATA D-bar, is concurrently written into dummy array <NUM>. If Data D is "<NUM>", then Address A in array <NUM> will be programmed to a "<NUM>," and DATA D-bar will be a "<NUM>," meaning that no programming will occur in dummy array <NUM>. If Data D is "<NUM>," then Address A in array <NUM> will be not be programmed, and DATA D-bar will be a "<NUM>" and will be programmed into a cell in dummy array <NUM>. Thus, for any programming operation, the power consumption will be the same, and a hacker therefore will not be able to determine whether the data at Address A in array <NUM> is a "<NUM>" or "<NUM>" based on the programming operation.

<FIG> depicts wafer <NUM>. In the prior art, wafer <NUM> will be fabricated and will contain a plurality of different instantiations of die <NUM>.

<FIG> depicts nine exemplary instances of die <NUM> within wafer <NUM>. In the prior art, it is common to include wafer test interconnect (not shown) inside each die. After <NUM> is fabricated, wafer test interconnect (not shown) is used to test each die <NUM>. Thereafter, once it is known which dies <NUM> have passed the testing procedure and which ones have not, wafer <NUM> is sliced into individual dies <NUM>. Exemplary slice lines, known as scribe lines <NUM>, are depicted in <FIG>. Hackers have been known to take prior art devices, remove the packaging, and access the contents of die <NUM> using the wafer test interconnect.

<FIG> depicts an improved method of slicing wafer <NUM> with secured test interconnect. Wafer test interconnect matrix <NUM> is shown to extend into the scribe region. Specifically, horizontal scribe lines are now made to be directly adjacent to the bottom edge of dies <NUM>, thus removing each die <NUM> from its coupled wafer test interconnect matrix <NUM> such that no remnants of wafer test interconnect matrix <NUM> is attached to die <NUM> when die is packaged and sent to the field. Thus, hackers will not be able to access the contents of die <NUM> using wafer test interconnect matrix <NUM> because the latter will no longer be present.

<FIG> depicts die <NUM>, which is an embodiment of die <NUM>. In the prior art, hackers often removed the package from a chip and electrically probed a semiconductor die to determine the contents of the die. Die <NUM> contains a design for counteracting such activity. Die <NUM> comprises top enabling logic fault detection (LFD) interconnect matrix <NUM>, metal shield <NUM>, and other layers <NUM> (which includes the remaining active chip layers and metal layers). Top enabling LFD interconnect matrix <NUM> and metal shield <NUM> are essential components to the secured circuitry of die <NUM>. If a hacker electrically probes die <NUM>, the LFD interconnect matrix and/or metal shield <NUM> will be damaged, and the circuitry coupled to the damaged area will be destroyed, as the metal that was damaged will cause short circuits and/or open circuits, resulting in intrusion fault detection, which allows on-chip controller to take preventive action or security measures, such as disabling chip access or chip operation. This makes it much more difficult for hackers to determine the contents of die <NUM> by performing electrical probing of die <NUM>.

<FIG> depicts an embodiment of an address fault detection system. Memory system <NUM> includes row decoder <NUM>, array <NUM>, and column decoder <NUM> as in previously described embodiments. Memory system <NUM> further includes address fault detection array <NUM>, address fault detection array <NUM>, address fault detection array <NUM>, address fault detection circuit <NUM> and address fault detection circuit <NUM>. Column decoder <NUM> is a set of multiplexors, and often will comprise tiered multiplexors. With reference to <FIG>, a portion of exemplary column decoder <NUM> is shown. Each column in array <NUM> is coupled to a bit line. Here, four bit lines are shown and labeled as BL0 to BL3. A first tier of multiplexors selects a pair of adjacent bit lines to be activated. Two such multiplexors are shown: T0 and T1. A second tier of multiplexors selects a bit line among a pair of adjacent bit lines. Here, each bit line has its own multiplexor, labeled as V0 through V3. Thus, if BL0 is intended to be selected, then WO and V0 will be activated.

With reference again to <FIG>, it can be appreciated that column decoder <NUM> is susceptible to faults as is row decoder <NUM>. In this example, Address Y is input to column decoder <NUM> and Address X is input to row decoder <NUM>. Address Y contains bits that indicate which multiplexors are to be activated (which in turn will assert a bit line). Each bit line is coupled to a row in address fault detection array <NUM>. When a bit line is asserted, a row in address fault detection array <NUM> will be asserted and a row in address fault detection array <NUM> will be asserted, and a value will be output. That value can be compared to the column portion of Address Y. If the values are different, then a fault has occurred and the wrong bit line has been asserted. The address fault detection array <NUM> is used to detect when an unwanted row address is asserted. When a row (such as wordline WL0) is asserted in a malicious manner, a row in the address fault detection array <NUM> is asserted and a value is output. That value can be compared to the Address X by the address fault detection circuit <NUM>. If the values are different, then a fault has occurred and the wrong wordline line has been asserted.

An exemplary encoding scheme for use in the embodiment of <FIG> is shown in <FIG>. Here, two tiers of multiplexors are used. The first tier comprises multiplexors controlled by values T[<NUM>] through T[<NUM>], and the second tier comprises multiplexors controlled by values V[<NUM>] through V[<NUM>]. It is to be understood that additional tiers are possible. Here, each multiplexor in the first tier is associated with a three-bit value (e.g., V[<NUM>] = <NUM>), and each multiplexor in the second tier is associated with a two-bit value (e.g., T[<NUM>] = <NUM>). Address fault detection array <NUM> and <NUM> contains an encoded value for each multiplexor value. E each "<NUM>" in the column component of the address is encoded as "<NUM>," and each "<NUM>" in the address is encoded as "<NUM>.

With reference again to <FIG>, the encoding scheme of <FIG> can be used. Address fault detection circuit <NUM> will output a "<NUM>" if a "<NUM>" or "<NUM>" pattern is detected in bit pairs of the encoded values stored in address fault detection array <NUM>. Thus, memory system <NUM> is able to detect faults in the column components of addresses. This scheme is equally applied to the row address fault detection.

<FIG> depicts logic fault detection circuit <NUM>. Logic fault detection circuit comprises erase/program/read/test (E/P/R/T) command logic <NUM>, replica erase/program/read/test command logic <NUM>, and logic fault detector (digital comparator) <NUM>. Erase/program/read/test command logic <NUM> receives signals from input pins containing commands for a memory device, such as CEb, Web, CLK, Din, and Address signals and generates erase/program/read/test chip enable signals. Replica erase/program/read/test command logic <NUM> generates erase/program/read/test chip enable signals partly based on stored configuration data (such as for E/P/R/T signals sequencing) and therefore can be considered the "ideal" enable signals that should be used during erase, program, read, and test operations. The enable signals from erase/program/read/test command logic <NUM> and replica erase/program/read/test command logic <NUM> are provided to logic fault detector (digital comparator) <NUM> and compared. If the signals are the same, then the output of logic fault detector circuit <NUM> indicates there is no fault. If the signals are different, then the output of logic fault detector circuit <NUM> indicates there is a fault. A fault might occur, for instance, if a hacker force a read command using input pins in an attempt to read data stored in an array. A hacker might not know the exact sequence and timing of input signals to use, and the resulting enable signals from erase/program/read/test command logic <NUM> might be slightly different than the ideal enable signals from replica erase/program/read/test command logic <NUM>, which would result in a LFD fault indication. The scheme can be used to detect the unwanted addressing logic by monitoring the addressing decoding circuitry.

Another embodiment of logic fault detection circuit <NUM> is for replica erase/program,/read/test command logic <NUM> to receive the same signals from input pins as erase/program/read/test command logic <NUM>. This embodiment would provide security against a scenario in which a hacker bypasses the pins and simply provides enable signals directly, in which case logic fault detector <NUM> will receive enable signals on one input (e.g., from the output of erase/program/read/test command logic <NUM>), but it will receive no enable signals from the other input (e.g., from replica erase/program/read/test command logic <NUM>), because the hacker will not know that it needs to provide the enable signals in two locations in order to not trigger a fault by logic fault detection circuit <NUM>.

<FIG> depicts chip analog and/or mixed signal fault detection circuit <NUM>. Any tampering with the circuits that are used by the flash memory chip such as by physical intrusion such as by micro-probing would be detected. Chip fault detection circuit comprises power source fault detector <NUM>, high voltage erase/program/read fault detector <NUM>, clock (CLK) fault detector <NUM>, temperature fault detector <NUM>, and flash circuit fault detector <NUM>. Power source fault detector <NUM> outputs a "<NUM>" when it detects a power source that it outside of a pre-specified range. High voltage erase/program/read fault detector <NUM> outputs a "<NUM>" when it detects a high voltage signal that is outside of a pre-specified range. Clock fault detector <NUM> outputs a "<NUM>" when it detects a clock signal that is outside of a pre-specified frequency range. Temperature fault detector <NUM> outputs a "<NUM>" when it detects an operating temperature outside of a specified range. Flash circuit fault detector <NUM> outputs a "<NUM>" if any of the other modules outputs a "<NUM>" (i.e., if a fault has been detected by any of the modules). In one embodiment, flash circuit fault detector <NUM> is a NOR gate.

<FIG> depicts chip fault detection circuit <NUM>. Chip fault detection circuit <NUM> comprises circuit <NUM> and replica circuit <NUM>. Circuit <NUM> provides an output Vr1, and circuit <NUM> provides an output Vr2. Vr1 and Vr2 are provided to DeltaV detector <NUM>, which outputs a "<NUM>" if the difference in voltage between Vr1 and Vr2 is above a certain threshold (such as <NUM>-<NUM> mV), and outputs a "<NUM>" otherwise. Examples of circuit <NUM> include on-chip reference bandgap circuits, linear voltage regulator LDO (low drop out) circuits, HV regulators, etc. Chip fault detection circuit <NUM> will protect against a situation where a hacker is probing the chip and is attempting to manipulate its behavior by injecting certain signals into the circuitry.

In all of the embodiments described above, if a fault is detected or some other event occurs that indicates a potential security breach, various counter-measures can be invoked. For example, a "chip enable" signal can be de-asserted, rendering the entire chip containing die <NUM> non-operational. Or a particular operation, such as a read operation, can be prevented by de-asserting a signal such as a read enable signal. Numerous other counter-measures are possible.

Claim 1:
A flash memory system, comprising:
an array comprising a plurality of flash memory cells organized into rows and columns; and
a logic fault detection circuit (<NUM>) comprising:
a command logic circuit (<NUM>) to generate enable signals in response to signals from input pins;
a replica command logic circuit (<NUM>) to generate enable signals in response to the signals from input pins; and
a comparator (<NUM>) for comparing the enable signals from the command logic circuit and the enable signals from the replica command logic circuit, wherein the comparator generates a first output value if the enable signals from the command logic circuit and the enable signals from the replica command logic circuit are identical and the comparator generates a second output value if the enable signals from output of the command logic circuit and the enable signals from the replica command logic circuit are not identical, wherein the second output value disables access to the array.