Patent Description:
Packages can be damaged for a variety of reasons, both benign and not so benign. In a benign example, packages may be designed to be opened whereby the opening process causes predictable and/or intended collateral damage to the package.

However in a not so benign example, integrated circuit chip packages can be damaged due to an intentional physical hacking attack designed to compromise the security features of the integrated circuit. Hacking techniques include: package thinning, FIB (Focused Ion Beam) holes, and de-capping.

<CIT> discloses a semiconductor chip with a protective layer acting as a diffuser and coupled to a light sensor. This design is intended to detect a mechanical manipulation of the protective layer.

In some cases, compromised chips may reveal their proprietary circuit structures and schematics. In other situations, such compromised chips can be powered to either reveal their operation, or reprogrammed to gain access to a secure system, such as a banking server.

According to the present invention as set out in independent claim <NUM>, a breach sensor comprises:
a substrate including an integrated circuit; a passivation layer protecting the integrated circuit in the substrate; a breach sensing element coupled to the integrated circuit; wherein the breach sensing element is on a first side of the passivation layer and the substrate is on a second side of the passivation layer; and a barrier configured to separate the breach sensing element from an ambient environment; wherein the breach sensing element is responsive to barrier damage; wherein the breach sensor includes a light sensor and the breach sensing element includes a light sensing element configured to generate power in response to barrier damage; and wherein the integrated circuit is coupled to receive the power generated by the light sensor; wherein the integrated circuit is arranged so that detect, alert and avert circuits are powered by the light sensing element even if the integrated circuit is disconnected from a power source.

In another example embodiment, the breach sensing element includes a humidity sensing element configured to detect a humidity level change in response to barrier damage.

In another example embodiment, the humidity sensing element is pre-calibrated with a first humidity level; further comprising a second humidity sensing element pre-calibrated with a second humidity level, different from the first humidity level; and the first and second humidity sensor are separated by a second barrier.

In another example embodiment, the humidity sensor includes at least one of: a capacitive sensing structure or a polyimide.

In another example embodiment, the barrier is directly bonded to the breach sensing element.

In another example embodiment, the barrier includes at least one of: a encapsulation material, a cover, a wrapper, a glue, or a seal.

In another example embodiment, the barrier damage includes at least one of: a focused ion beam hole, a de-capping, a shear, a tear, an etch, or a physical attack.

In another example embodiment, the breach sensor includes a light sensor and the breach sensing element includes a light sensing element configured to detect a photo current change in response to barrier damage.

In another example embodiment, the light sensor includes an avalanche photodiode.

In another example embodiment, the circuit, in response to the barrier damage, is configured to at least one of: damage the circuit, erase a memory, transmit an alert, enter a decoy mode, or blow a fuse.

In another example embodiment, further comprising an antenna coupled to the circuit and configured to transmit a breach signal in response to barrier damage.

In another example embodiment, the breach sensor includes a light sensor and the breach sensing element includes a light sensing element configured to generate power in response to barrier damage.

In another example embodiment, the circuit is coupled to receive the power generated by the light sensor.

In another example embodiment, further comprising a second breach sensor, having a second breach sensing element, proximate to the breach sensor; and the two breach sensors are separated by a second barrier configured to separate the second breach sensing element from the first breach sensing element.

In another example embodiment, the two breach sensors are at least one of: stacked or side-by-side.

According to another example embodiment, an article of manufacture including at least one non-transitory, tangible machine readable storage medium containing executable machine instructions for breach sensing, comprising: wherein the article includes, a substrate including an integrated circuit; a passivation layer protecting the integrated circuit in the substrate; a breach sensing element coupled to the integrated circuit; wherein the breach sensing element is on a first side of the passivation layer and the substrate is on a second side of the passivation layer; a barrier configured to separate the breach sensing element from an ambient environment; wherein the breach sensing element is responsive to barrier damage; wherein the breach sensor includes a light sensor and the breach sensing element includes a light sensing element configured to generate power in response to barrier damage; and wherein the integrated circuit is coupled to receive the power generated by the light sensor; wherein the integrated circuit is arranged so that detect, alert and avert circuits are powered by the light sensing element even if the integrated circuit is disconnected from a power source; and wherein the instructions include, monitoring an output signal of the breach sensing element; and detecting a change in the output signal in response to barrier damage.

In another example embodiment, the monitoring instruction includes: monitoring at least one of a humidity level change or a photo current change in response to barrier damage.

In another example embodiment, in response to the barrier damage the instructions include at least one of: damaging the circuit; erasing a memory; transmitting an alert; placing the circuit into a decoy mode; or blowing a fuse.

In another example embodiment, the instructions include: distinguishing between barrier damage due to at least one of: a focused ion beam hole, a de-capping, a shear, a tear, an etch, or a physical attack.

In another example embodiment, the breach sensor includes a light sensor; and the instructions includes generating power with the light sensor in response to barrier damage.

The above discussion is not intended to represent every example embodiment or every implementation within the scope of the current claim set.

Description that follow also exemplify various example embodiments.

Various example embodiments may be more completely understood in consideration of the following Detailed Description in connection with the accompanying Drawings, in which:.

It should be understood, however, that other embodiments, beyond the particular embodiments described, are possible as well. All modifications, equivalents, and alternative embodiments falling within the spirit and scope of the appended claims are covered as well.

Discussed herein are structures and techniques for detecting and alerting in response to both benign and not so benign package breaches. And, in the case of a not so benign breach, averting intentional physical hacking attacks designed to compromise various security features.

Structures include integrated circuit tampering detection structures based on relative humidity (RH) and/or ambient light (AL) sensors set to a first calibration state, such as by surrounding them with a barrier impervious to humidity and/or light, which then shift to a second calibration state in response to a breach in the barrier structure. Such structures permit distinguishing between various physical hacking attacks (e.g. a complete full package removal, and a local attack using FIB techniques) based on the RH and AL sensors' signal responses.

In response to a detected breach, additional alert and/or avert signals are selectively generated in various example embodiments.

<FIG> is an example breach sensor <NUM>. In one example embodiment, the breach sensor <NUM> includes a lead-frame <NUM>, a substrate <NUM> including an integrated circuit (not shown), a passivation layer <NUM>, a first breach sensing element <NUM>, a second breach sensing element <NUM>, and a barrier <NUM>.

In this example, the first breach sensing element <NUM> is a humidity sensing element <NUM> which functions as part of a humidity sensor and is coupled to the circuit. The humidity sensing element <NUM> is configured to detect a humidity level change in response to barrier <NUM> damage. The humidity sensing element <NUM> can be made of a polyimide and is coupled to a capacitive sensing structure and the integrated circuit so that a humidity reading may be monitored.

In an example embodiment, the first breach sensing element <NUM> is on a first side of the passivation layer <NUM> and the substrate <NUM> is on a second side of the passivation layer <NUM>. The passivation layer <NUM> protects the integrated circuit in the substrate <NUM>.

The humidity sensing element <NUM> in one example measures approximately <NUM>×<NUM> and is made in an extra metal layer on top of the passivation layer <NUM>.

The second breach sensing element <NUM>, in one example, is a light sensing element <NUM> which functions as part of a light sensor and is coupled to the circuit. The light sensing element <NUM> is configured to detect a light level change in response to barrier <NUM> damage. The light sensing element <NUM> can be made of a solar cell, an avalanche photodiode, or some other light sensitive device and is coupled to the integrated circuit so that a light level (e.g. photo current change) reading may be monitored.

The light sensing element <NUM> in one example is of a double diode configuration, created in a FEOL active area.

In other embodiments, the light sensing element <NUM> is configured to generate power in response to barrier <NUM> damage. The integrated circuit can be configured to receive this electric power thereby enabling various circuit functions which is further discussed below.

The first and second breach sensing elements <NUM>, <NUM> can be formed respectfully on top of or as part of a CMOS device. In other embodiments the breach sensing elements <NUM>, <NUM> could also be a gas sensor, or another capacitive sensing structure.

The barrier <NUM> is configured to separate the first and second breach sensing elements <NUM>, <NUM> from an ambient environment. In <FIG>, the barrier <NUM> is directly bonded to the first breach sensing element <NUM> and surrounds the second breach sensing element <NUM>. The barrier <NUM> can be formed from an encapsulation material, a cover, a wrapper, a glue, a seal or other material.

The barrier <NUM> in one example is formed using a standard packaging encapsulant and can be applied using SO or QFN.

When covered by the barrier <NUM>, the first and second breach sensing elements <NUM>, <NUM> transmit reference signals to the integrated circuit.

However, when the barrier <NUM> is damaged the first and second breach sensing elements <NUM>, <NUM> are able to respond to the ambient environment and the first and second breach sensing elements <NUM>, <NUM> no longer transmit the reference signals to the integrated circuit. Instead the first and second breach sensing elements <NUM>, <NUM> transmit new output signals that depend upon, for example, how much humidity and light is now reaching the first and second breach sensing elements <NUM>, <NUM> from the ambient environment. The first and second breach sensing elements <NUM>, <NUM> in one example embodiment are not calibrated due to a large difference between the reference signals and the new output signals.

This first and second breach sensing elements <NUM>, <NUM> responsiveness corresponds to a "detection event", such as a focused ion beam hole, a de-capping, a shear, a tear, an etch, or a physical attack.

The detection event causes the integrated circuit in the breach sensor <NUM> to either generate an alert and/or enter one or more avert states.

Alerts establish a communication capability with an environment external to the breach sensor <NUM> (e.g. the outside world). Alerts can be interpreted in a variety of ways such as: a security breach, an SOS signal, an opening event, a changed operational state, an event completion, and so on. For example, if the alert corresponds to a security breach the alert can notify authorities, a manufacturer, an OEM, a networked environment, a bank, and/or others that the physical security of the device has been breached.

Example breach sensors <NUM> which also include an antenna coupled to the circuit can broadcast an alert over a much greater distance. In most cases the earlier such a security breach is detected and made known to the outside world, the better one can implement any damage control measures.

Avert states either alter circuits locally connected to the breach sensor <NUM> or cause remote servers to activate, deactivate, validate and/or invalidate devices and/or services monitored by the breach sensor <NUM>. For example, in response to barrier <NUM> damage commensurate with a security breach, the breach sensor's <NUM> avert functionality can be configured to: switch off the normal chip operation, physically break a device, damage a circuit, erase a memory, enter a decoy mode, blow a fuse, and so on. Alternatively, in response to barrier <NUM> damage commensurate with an intended event, the breach sensor's <NUM> avert functionality can be configured to: switch on normal chip operation, activate a device, download data into a memory, and so on.

The detect, alert and avert circuits are in one embodiment powered by the light sensing element <NUM> even if the integrated circuit is disconnected from a power source (not shown). However in another example embodiment the power source is used by the detect, alert and avert circuits.

<FIG> is an example breach <NUM> of the sensor <NUM>. In <FIG> a FIB hole <NUM> has been created in the barrier <NUM>. The FIB hole <NUM> permits humidity <NUM> to reach the first breach sensing element <NUM>. This changes a signal output by the first breach sensing element <NUM> resulting in a detection of the FIB hole <NUM>. This detection, as mentioned above, can trigger various alert and avert events.

<FIG> is a first example layout <NUM> of the breach sensor <NUM> over or in a first circuit <NUM>. The breach sensor cell <NUM> includes a set of breach sensing elements (e.g. the array pattern RH, AL, RH, AL, AL, RH, AL and RH shown in <FIG>).

In one example, the breach sensing elements are separated by a set of vertical barriers <NUM> laid out in such a way that selected breach sensing elements do not all respond to certain types of barrier damage and/or respond all at the same time. For example, in one example design a FIB hole over one relative humidity sensor does not trigger a detection event in another relative humidity sensor.

Such a configuration can provide useful information on which parts of the first circuit <NUM> have been breached, which may result in a different alert or avert response. Alternatively, such a configuration permits the set of breach sensing elements to have different reference states.

For example, one humidity sensing element can be pre-calibrated with a first humidity level, and a second humidity sensing element can be pre-calibrated with a second humidity level, different from the first humidity level. Such a design could detect barrier damage even in a controlled humidity environment.

<FIG> is a second example layout <NUM> of the breach sensor <NUM> over or in a second circuit <NUM>. The array of breach sensing cells <NUM> include nine side-by-side cells which themselves include a set of breach sensing elements, such as described in <FIG>. This configuration fully covers the second circuit <NUM>.

<FIG> is a third example layout <NUM> of the breach sensor <NUM> over or in a third circuit <NUM>. This configuration includes a first breach sensing element <NUM> and a second breach sensing element <NUM> stacked underneath the first breach sensing element <NUM>. In one example the first breach sensing element <NUM> is a diode closer to an external surface of the circuit <NUM> and that primarily is designed to detect visible light. The second breach sensing element <NUM> could then be a second diode buried within the circuit <NUM> and primarily designed to detect infrared light.

As shown by the examples in <FIG> and <FIG>, the breach sensing element can easily be configured in size and shape so as to fit in either free circuit areas or wherever needed (e.g. above secure areas or at the periphery of a circuit).

<FIG> is an example un-breached package <NUM>. The un-breached package <NUM> is shown in a first cross-sectional view <NUM>, a second top-down view <NUM> and a third perspective view <NUM>. The first cross-sectional view <NUM> shows one example relative humidity sensor (RHS), covered by a polyimide layer <NUM>, and one ambient light sensor (ALS). The second top-down view <NUM> shows a pattern of ambient light (AL) and relative humidity (RH) sensors covered by a molding compound. The third perspective view <NUM> shows a finished package.

<FIG> is an example package <NUM> breached by a full de-capping. The de-capped package <NUM> is shown in a first cross-sectional view <NUM>, a second top-down view <NUM> and a third perspective view <NUM>. The first cross-sectional view <NUM> shows a fully exposed relative humidity sensor (RHS) with the polyimide layer <NUM> removed. This would cause a change in the relative humidity sensor's signal output, and the ambient light sensor (ALS) would also receive an increase in light intensity causing its output signal to change. The second top-down view <NUM> shows the exposed pattern of ambient light (AL) and relative humidity (RH) sensors with the molding compound removed. The third perspective view <NUM> shows the exposed chip package.

One example set of effects of a full de-capping is as follows. If the molding compound is completely chemically removed, then those chemicals will also remove the polyimide (of the RH sensor) which is present as a full layer. In this example it may not matter how many RH metal structures are present as the change in dielectric constant will be from approximately <NUM> towards ±<NUM> which is enough to detect an intrusion a breach.

The de-capped RHS has a second capacitance lower than its first capacitance. Capacitance reduction in the RH structure as Polyimide is removed. Polyimide is removed, only (moist) air present. This generates a 2X-3X capacitance drop which can easily be spotted. This is a fairly steep step.

The AL sensor now has a second photo current greater than its reference first photo current. Photo current increases to levels > µA. Dark Current levels (sub-nA). Smaller sensor dimensions will give even larger effects.

<FIG> is an example package <NUM> breached by a focused ion beam (FIB) hole <NUM>. The FIB-breached package <NUM> is shown in a first cross-sectional view <NUM> with the FIB hole <NUM>, a second top-down view <NUM> and a third perspective view <NUM>. The first cross-sectional view <NUM> shows the relative humidity sensor (RHS) exposed by the FIB hole <NUM>. This would cause a change in the relative humidity sensor's signal output, and the ambient light sensor (ALS) would also receive an increase in light intensity causing its output signal to change. The second top-down view <NUM> shows the pattern of ambient light (AL) and relative humidity (RH) sensors with the molding compound breached by the FIB hole <NUM> which is closer to a particular set of AL and RH sensors. The third perspective view <NUM> shows the chip package exposed the FIB hole <NUM>.

One example set of effects to a FIB-breached package <NUM> is as follows. The full layer polyimide is present everywhere. Fast diffusion will mean that moisture equilibrium will always reach the RH capacitor structure no matter how far away from the FIB hole <NUM>. As the package is normally deposited at high temperatures (low moisture content), there will always be a delta RH that is large enough to be measured. Value of the un-breached RH capacitor can be stored at post-assembly test. If the FIB-breached package <NUM> is hooked up again then the new value can be compared to the original reference value (or to a reference cap in the interconnect).

The FIB hole <NUM> breached package <NUM> RHS sensor has a third capacitance greater than a first capacitance. The FIB hole <NUM> opens up the package molding compound to moisture and the polyimide layer is present everywhere with fast H2O diffusion. The change in capacitance will not be as dramatic as for full de-cap, but will be slightly more gradual. Contrary to the de-cap, the capacitance change will now be an increase in capacitance.

The FIB hole breached package <NUM> AL sensor has a third photo current greater than first photo current if the FIB hole <NUM> is close to buried photo sensor. Depending on the proximity of the AL sensor, an increase in photo current can be expected. The higher the photodiode density the better in that respect. If the FIB hole <NUM> is in the proximity of the AL sensor, the generated photocurrent will most probably give a large enough delta compared to the dark current. Smaller breach sending element dimensions will give even larger effects.

<FIG> is an example list of breach sensing and response instructions. The order in which the instructions are discussed does not limit the order in which other example embodiments implement the instructions unless otherwise specifically stated. Additionally, in some embodiments the instructions are implemented concurrently.

A first example instruction begins in <NUM>, by monitoring an output signal of the breach sensing element. Next, in <NUM>, detecting a change in the output signal in response to barrier damage.

The instructions can be augmented with one or more of the following additional instructions, presented in no particular order: <NUM> - monitoring at least one of a humidity level change or a photo current change in response to barrier damage; <NUM> - wherein in response to the barrier damage the instructions include at least one of: damaging the circuit; erasing a memory; transmitting an alert; placing the circuit into a decoy mode; or blowing a fuse; <NUM> - distinguishing between barrier damage due to at least one of: a focused ion beam hole, a de-capping, a shear, a tear, an etch, or a physical attack; and <NUM> - generating power with a light sensor in response to barrier damage.

<FIG> is an example system for hosting the breach sensing instructions. The system <NUM> shows an input/output data <NUM> interface with an electronic apparatus <NUM>. The electronic apparatus <NUM> includes a processor <NUM>, a storage device <NUM>, and a non-transient machine-readable storage medium <NUM>. The machine-readable storage medium <NUM> includes instructions <NUM> which control how the processor <NUM> receives input data <NUM> and transforms the input data into output data <NUM>, using data within the storage device <NUM>. Example instructions <NUM> stored in the machine-readable storage medium <NUM> are discussed elsewhere in this specification. The machine-readable storage medium in an alternate example embodiment is a non-transient computer-readable storage medium.

Claim 1:
A breach sensor (<NUM>), comprising:
a substrate (<NUM>) including an integrated circuit;
a passivation layer (<NUM>) protecting the integrated circuit in the substrate (<NUM>);
a breach sensing element (<NUM>) coupled to the integrated circuit;
wherein the breach sensing element (<NUM>) is on a first side of the passivation layer (<NUM>) and the substrate (<NUM>) is on a second side of the passivation layer (<NUM>); and
a barrier (<NUM>) configured to separate the breach sensing element (<NUM>) from an ambient environment;
wherein the breach sensing element (<NUM>) is responsive to barrier damage;
wherein the breach sensor (<NUM>) includes a light sensor and the breach sensing element (<NUM>) includes a light sensing element configured to generate power in response to barrier damage; and
wherein the integrated circuit is coupled to receive the power generated by the light sensor;
the breach sensor (<NUM>) being characterized in that the integrated circuit is arranged so that detect, alert and avert circuits are powered by the light sensing element (<NUM>) even if the integrated circuit is disconnected from a power source.