Patent Description:
In industrial environments, embedded devices like control units, industrial PCs, IoT and edge devices assume important tasks such as, for instance, controlling or monitoring of technical processes, and in doing so often carry out critical functions, in particular with reference to data and information security.

In addition, the devices are increasingly being networked, e.g., for remote control, or for diagnosis and analysis as a basis for subsequent optimization of a process. In industrial systems, field use of embedded devices often extends over long periods, for instance <NUM>-<NUM> years, or sometimes even <NUM> or <NUM> years, during which periods the devices are exposed to ever changing circumstances and potential security attacks.

Special passive and invasive attacks, such as side-channel attacks/probing, fault injection, depackaging and delayering of integrated circuits, on the hardware of such devices may result in security-critical functions and data being compromised.

Typical counteractive measures for detection and prevention of such attacks like, for instance, drilling protection (wire meshes), overmoulding of dies/packages using epoxy resin, use of security fuses, use of tamper sensors (detecting security-critical changes in temperature, voltage levels, clock signal properties, light, and/or radiation), monitoring of a current consumption or electromagnetic emission, or use of physical unclonable functions, PUF, typically protect individual integrated circuits or dies only.

<NPL>) discloses CMOS processors with integrated security primitives involving physical unclonable functions. <CIT>discloses a circuit for defending against attacks on ring oscillator-based physically unclonable functions. <CIT> discloses a silicon integrated circuit comprising a physically unclonable function.

In view of the above, there is a need in the art for detection of tampering of a topological arrangement of semiconductor dies to one another. This equally relates to die arrangements within a same integrated circuit, IC, package, e.g., multi-chip modules, MCM, or system-in-package, SiP, to discrete die arrangements on printed circuit boards, PCB, or to combinations thereof.

These underlying objects of the invention are each solved by a die arrangement and a method of monitoring the same as defined by the independent claims. Preferred embodiments of the invention are set forth in the dependent claims.

According to a first aspect, a die arrangement is provided. The die arrangement comprises a plurality of dies; a physical interconnection structure extending between and traversing the plurality of dies, and being arranged for imparting unpredictable, yet reproducible properties to a digital signal being carried on the physical interconnection structure; and a monitoring logic for monitoring the properties of the digital signal.

The physical interconnection structure may comprise an electrically conducting structure.

The monitoring logic may be arranged for monitoring the properties of the digital signal against characteristic reference data of the digital signal.

The monitoring logic may be arranged for monitoring semantic properties of the digital signal.

The monitoring logic may be arranged for monitoring an eye opening of the digital signal.

The physical interconnection structure may form a ring oscillator, RO, structure; and the monitoring logic may be arranged for monitoring an oscillation frequency of the digital signal.

The characteristic reference data may be machine-learned.

The characteristic reference data may be determined using hard-coded rules.

The characteristic reference data may be determined while reducing time-varying environmental factors.

The monitoring logic may comprise storage means for the characteristic reference data.

The storage means may comprise at least one of a protected memory area and one or more chip fuses.

The monitoring logic may comprise an internal logic structure of at least one of the plurality of dies.

The monitoring logic may be arranged for generating a tamper event upon a breach of signal integrity.

According to a second aspect, a method of monitoring a die arrangement is provided. The underlying die arrangement comprises a plurality of dies and a physical interconnection structure extending between and traversing the plurality of dies. The method comprises a step of carrying a digital signal on the physical interconnection structure, wherein the physical interconnection structure is arranged for imparting unpredictable, yet reproducible properties to the digital signal. The method further comprises a step of monitoring the properties of the digital signal.

The method is performed for monitoring the die arrangement of various embodiments.

Embodiments of the invention will be described with reference to the accompanying drawings, in which the same or similar reference numerals designate the same or similar elements.

Exemplary embodiments of the invention will now be described with reference to the drawings. While some embodiments will be described in the context of specific fields of application, the embodiments are not limited to this field of application. Further, the features of the various embodiments may be combined with each other unless specifically stated otherwise.

<FIG> illustrate examples of schematically arranged die arrangements <NUM>, <NUM> according to embodiments of the invention.

The die arrangement <NUM> of <FIG> comprises a plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n, and a physical interconnection structure <NUM> extending between and traversing the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n.

A "die" is a section of semiconducting material on which a logic structure/circuit or a mixed-signal structure/circuit or an analog structure/circuit having a particular function has been established.

The physical interconnection structure <NUM> comprises an electrically conducting structure extending between and traversing the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n.

An "electrically conducting structure" as used herein may relate to a waveguide, a wire, a through-silicon via (TSV) and the like, made of metal or metal alloy.

The physical interconnection structure <NUM> may alternatively or additionally comprise an optically conducting structure.

An "optically conducting structure" as used herein may relate to a waveguide or fiber made of a material facilitating conductance of light signals.

The physical interconnection structure <NUM> is arranged for imparting unpredictable, yet reproducible properties to a digital signal being carried on the physical interconnection structure <NUM>.

These properties particularly relate to physical variations occurring naturally during semiconductor manufacture and enabling differentiation between otherwise identical semiconductors. Such random physical factors introduced during manufacturing may, for instance, result in small geometric variations in terms of waveguide lengths, widths, cross-sectional areas, and the like, which in turn result in variations in signal delays, signal attenuation, circuit capacities, and so forth.

The physical interconnection structure <NUM> may be part of a physical unclonable function, PUF, unit.

A "physical unclonable function" or "PUF" as used herein may typically relate to a digital/mixed signal circuit element being arranged to impart the above-mentioned unpredictable, yet reproducible properties to a digital signal being carried on a physical interconnection structure, and to amplify such properties.

A "PUF unit" as used herein may relate to a circuit member/structure comprising a PUF and being arranged for imparting, in response to an input (challenge) and using the PUF, the above-mentioned unpredictable, yet reproducible properties, to a corresponding output (response). For instance, a PUF may turn a digital signal (challenge) into a delayed and/or attenuated digital signal (response), and a change of round-trip delay or differential propagation delays may be monitored. Examples of PUF units comprise oscillator PUFs, sum PUFs and arbiter PUFs. A PUF unit is less susceptible to disturbances than single RO structures, but requires more chip resources.

In the non-limiting example of <FIG>, the respective die <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n comprises a monitoring logic <NUM> for monitoring the above-mentioned properties of the digital signal, in particular against characteristic reference data of the digital signal. In this embodiment, the respective die <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n further comprises storage means <NUM> for the characteristic reference data. The respective die <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n may be provided with a monitoring logic <NUM> and corresponding storage means <NUM> as necessary. For instance, this may not be the case if the die has no security-critical function.

"Monitoring against" as used herein may relate to observing and evaluating quantities and/or qualities over a period of time, for instance continuously, with reference to (i.e., against) reference quantities and/or qualities.

"Characteristic reference data" as used herein may relate to data determined in and representing a non-tampered state of the underlying die arrangement <NUM>, <NUM>. Accordingly, monitored properties of the digital signal corresponding to the characteristic reference data indicate that the underlying die arrangement <NUM>, <NUM> is in a non-tampered state. The characteristic reference data may preferably denote one or more value ranges for particular properties of the digital signal and/or for distinction in terms of criticality of any deviation from the non-tampered state (see below).

Modification of a topology of the die arrangement <NUM>, <NUM>, be it by separating/desoldering individual dies for reverse engineering, by attachment of additional probes, or by modification of temperature, supply voltage or other global parameters, results in a corresponding modificationof the above-mentioned properties of the digital signal being monitored. This entails a possibility of detecting a tampering of the die arrangement <NUM>, <NUM>, in particular by monitoring these properties and comparing them against characteristic reference data of the digital signal. Only few chip resources are needed for tamper detection in the arrangement <NUM>, <NUM>. In addition, the above die arrangement <NUM>, <NUM> may be combined with known approaches of tamper detection or tamper hardening. In general, the arrangement <NUM>, <NUM> further complicates tampering or reverse engineering.

The respective monitoring logic <NUM> may be arranged for monitoring semantic properties of the digital signal. For instance, known communication protocols may be used for semantic monitoring of the digital signal, as these communication protocols define the contents/semantics of the digital signal being carried on the physical interconnection structure <NUM>. For instance, the digital signal may be captured for subsequent monitoring of cyclic signal patterns or values.

The respective monitoring logic <NUM> may alternatively or additionally be arranged for monitoring statistic properties of the digital signal. The statistic properties may affect timing properties within a time window. For example, the number of changes from low to high and from high to low within a time window can be determined, or the relation between time periods within the time window in which the signal is high and time periods within the time window in which the signal is low. Furthermore, statistical properties between multiple signals may be determined, e.g., a cross-correlation.

The respective monitoring logic <NUM> may alternatively or additionally be arranged for monitoring an eye opening of the digital signal.

An "eye opening" as used herein may relate to a vertical height, horizontal width and/or a shape/contour of an interior of an eye diagram. An eye diagram is generated by superimposing positive and negative pulses of a sampled digital signal such that the superimposed pulses are horizontally centered between their leading and trailing edges. The resulting diagram resembles an opening of an eye, and a vertical height, a horizontal width as well as a shape/contour of which provide indications of an average instantaneous attenuation and an average instantaneous delay affecting the sampled digital signal, respectively. Upon tampering of the physical interconnection structure <NUM>, for instance by moving one of the dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n further away from the others, variations of the instantaneous attenuation and/or instantaneous delay of the digital signal being carried on the physical interconnection structure <NUM> may be expected, such that the vertical height and/or horizontal width of the interior of the corresponding eye diagram, or simply the eye opening, is varied.

The physical interconnection structure <NUM> shown in <FIG> forms a ring oscillator, RO, structure. This entails the use of a minimum of chip/interconnection resources. Accordingly, the monitoring logic <NUM> is arranged for monitoring an oscillation frequency of the digital signal being carried on the physical interconnection structure <NUM>. For instance, the RO structure may comprise a number of logic gates/circuits implementing a feedback loop having a round-trip delay. An oscillation frequency of a digital signal being carried on such a structure depends on the above-mentioned random physical factors introduced during manufacturing. The RO-structure may be self-oscillating, or merely be excited on demand, which entails power energy savings. Alternatively to a RO structure, also linear structures on which oscillations or delays may set in are conceivable.

The characteristic reference data may be machine-learned. For instance, an artificial neural network and known methods of training the same may be used to realize machine learning of the characteristic reference data. This entails a monitoring against automatically learned characteristic reference data without requiring an explicit instance thereof, so that even complex nonlinear properties of the digital data may be monitored and mapped to a non-tampered state or any different state.

In such case, the monitoring logic <NUM> may, for instance, comprise a tensor processing unit, TPU, for monitoring and evaluating the properties of the digital signal against the machine-learned characteristic reference data. This entails a highly accelerated execution of the machine-learning-based monitoring.

A "tensor processing unit" or "TPU" is an application-specific integrated circuit, ASIC, developed specifically for accelerating neural network machine learning.

Alternatively or additionally, the characteristic reference data may be determined using hard-coded rules. For instance, heuristics may be used to provide the characteristic reference data. This entails a simple and comprehensible way of determining the characteristic reference data.

The characteristic reference data may be determined while reducing time-varying environmental factors. It may particularly be recommendable to eliminate an impact of temperature variations on the die arrangement <NUM>, <NUM>. This entails an improved reliability of the monitoring against the characteristic reference data.

The characteristic reference data may be determined in a provisioning phase during manufacturing of the die arrangement <NUM>, <NUM>. This entails a high amount of flexibility for determining the characteristic reference data.

"Provisioning" as used herein may relate to an act, step or state of being prepared before active service or field use.

Alternatively or additionally, the characteristic reference data may be determined in a provisioning phase during commissioning of the die arrangement <NUM>, <NUM>.

"Commissioning" as used herein may relate to an act, step or state of configuration, after manufacturing and before active service or field use, at the service site, in field, or a comparable environment.

This ensures that the provisioning and the active service or field use are based on comparable environmental factors.

Alternatively or additionally, the characteristic reference data may be determined during use of the die arrangement <NUM>, <NUM>, i.e. during the above-mentioned active service or field use. This entails a capability of the die arrangement <NUM>, <NUM> of self-calibration or self-recalibration upon variation of the environmental factors or at the request of the device operator.

The storage means <NUM> of the respective die of the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n comprises at least one of a protected memory area and one or more chip fuses. For instance, a protected memory area may comprise an access-restricted static memory area. Storage means <NUM> based on one or more chip fuses, which are usually put in place for manufacturer configuration of the die, may also be arranged next to the respective die and statically store binary values/digits depending on their presence or absence. For instance, one or more chip fuses may be used to enable and/or address a particular protected memory area, or permanently store hard-coded characteristic reference data.

In <FIG>, the monitoring logic <NUM> of the respective die of the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n comprises an internal logic structure of the respective die. This entails that a new die arrangement <NUM> may be tamper-hardened using the built-in monitoring logic <NUM>.

By contrast, in the die arrangement <NUM> illustrated in <FIG>, an external/separate security IC <NUM> comprises the monitoring logic <NUM> in combination with a corresponding storage means <NUM> for the characteristic reference data. This entails that an existing die arrangement <NUM> may be tamper-hardened using external monitoring logic <NUM> as implied by the separate security IC <NUM> in <FIG>. An external monitoring logic <NUM> is connected to the physical interconnection structure <NUM> at interfaces between the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n, see <FIG>.

In any case, the monitoring logic <NUM> is arranged for generating a tamper event upon a detected breach of signal integrity.

A "tamper event" as used herein may relate to any kind of communication or notification that the properties of the digital signal as monitored by the monitoring logic <NUM> are not in conformity with the characteristic reference data of the digital signal as stored by its corresponding storage means <NUM>, where non-conformity denotes a breach of signal integrity.

Depending on a type of the physical interconnection structure <NUM>, a breach of signal integrity may, for instance, result from non-conformity of a monitored oscillation frequency, of a monitored eye opening (or corresponding eye opening penalty), or of a monitored PUF-response (e.g. an excessive Hamming distance), and the like.

For instance, a tamper event may comprise setting at least one bit in a particular hardware register or memory location to a defined value, triggering interrupt handling by a processor, or setting an external signal to a defined value, such that a response to such a tamper event may be handled or triggered by another logic member. For instance, a cryptographic key store may lock access to or delete a stored security key in response to the detection of a tamper event generated by the monitoring logic <NUM>, or security-critical logic functions may be deactivated.

The monitoring logic <NUM> may be arranged for logging and/or classifying the tamper event, in particular if the tamper event is passed on to a higher software layer. For instance, depending on a location of tampering, or on a type and/or extent of distortion of an eye diagram, or on an extent of detuning of a RO structure, a tamper event may be classified in terms of its location (e.g. "between dies <NUM> and <NUM>") and/or criticality. This entails a response at a scale being adequate for and in conformity with the assigned class. The classification may be encoded in the tamper event. This allows classifying the tamper event at a higher level (e.g., in software).

<FIG> and <FIG> illustrate examples of topologically arranged die arrangements <NUM>, <NUM> according to embodiments of the invention.

The die arrangement <NUM> of <FIG> comprises a system-on-chip, SoC, i.e. a monolithic-integrated arrangement of the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n in a common package. According to the example of <FIG>, the SoC is arranged and soldered on a PCB <NUM> using package bumps.

The die arrangement <NUM> of <FIG> further comprises a discretely arranged security IC <NUM>, which may or may not be seen as belonging to the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n, and which is embedded in a PCB <NUM>. The security IC <NUM> is similar to the one already mentioned in connection with <FIG> and may, for instance, comprise a cryptographic key store and be used by the SoC as a cryptographic key store module.

If the physical interconnection structure <NUM> merely extends between and traverses the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n on the SoC, this entails additional tamper protection by monitoring the integrated die arrangement <NUM> of the SoC.

If the physical interconnection structure <NUM> extends between and traverses the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n including the security IC <NUM>, as depicted in <FIG>, then the security IC <NUM> may be seen as belonging to the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n as already mentioned. This entails additional tamper protection by monitoring the partially integrated die arrangement <NUM> comprising the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n of the SoC and of the security IC <NUM>.

The die arrangement <NUM>, <NUM> of <FIG> comprises a hybrid-integrated arrangement of the dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n in a package <NUM>, denoting a system-in-package, SiP, and including a common substrate <NUM> arranged and soldered on a PCB <NUM> using package bumps.

Unlike 2D packaging, in which the hybrid-integrated dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n would be directly connected to the common substrate <NUM>, the die arrangement <NUM> of <FIG> further comprises a silicon interposer <NUM> having through-silicon vias, TSVs, through which the hybrid-integrated die <NUM>-n is connected to the common substrate <NUM>, as in <NUM>. 5D packaging. The silicon interposer <NUM> is arranged and soldered on the common substrate <NUM> using flip-chip bumps, and the hybrid-integrated die <NUM>-n is arranged and soldered on the silicon interposer <NUM> using micro bumps.

In the die arrangement <NUM>, <NUM> of <FIG>, the hybrid-integrated die <NUM>-<NUM> of the hybrid-integrated dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n additionally has TSVs on its part, through which the hybrid-integrated die <NUM>-<NUM> is connected to the common substrate <NUM>, as in 3D packaging. The hybrid-integrated dies <NUM>-<NUM>, <NUM>-<NUM> are arranged and soldered on the respective underlying TSV-providing component <NUM>-<NUM>, <NUM> using micro bumps.

In the embodiment of <FIG>, the physical interconnection structure <NUM> extends between and traverses the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n as well as the silicon interposer <NUM> within the 3D package <NUM>.

In <FIG>, the monitoring logic <NUM> of the die arrangement <NUM>, <NUM> is omitted for reasons of improved visibility, but the die arrangement <NUM>, <NUM> nevertheless comprises an internal logic structure as in <FIG> and/or a separate logic structure as in <FIG> as the monitoring logic <NUM>. This entails additional tamper protection of the integrated die arrangement <NUM>, <NUM>.

In summary, the topological die arrangement <NUM>, <NUM> may be monitored in any conceivable die arrangement having any conceivable packaging variant.

<FIG> illustrates a method <NUM> of an embodiment of the invention, the method <NUM> being for monitoring a die arrangement <NUM>, <NUM> of various embodiments.

The die arrangement <NUM>, <NUM> underlying the method <NUM> comprises a plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n and a physical interconnection structure <NUM> extending between and traversing the plurality of dies <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n.

In step <NUM>, a digital signal is carried <NUM> on the physical interconnection structure <NUM>, during which the physical interconnection structure <NUM> is arranged for imparting unpredictable, yet reproducible properties to the digital signal.

In step <NUM>, the properties of the digital signal are monitored <NUM>.

The method <NUM> may be performed for monitoring the die arrangement <NUM>, <NUM> of various embodiments.

The technical effects and advantages described above in relation with the die arrangement of various embodiments equally apply to the corresponding method for monitoring the die arrangement having corresponding features.

Claim 1:
A die arrangement (<NUM>, <NUM>), comprising
a plurality of dies (<NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n);
a physical interconnection structure (<NUM>) extending between and traversing the plurality of dies (<NUM>-<NUM>, <NUM>-<NUM>, <NUM>-n), and being arranged for imparting unpredictable, yet reproducible properties to a digital signal being carried on the physical interconnection structure (<NUM>); and
a monitoring logic (<NUM>) for monitoring the properties of the digital signal,
the monitoring logic (<NUM>) being arranged for monitoring the properties of the digital signal against characteristic reference data of the digital signal, wherein
the die arrangement (<NUM>, <NUM>) comprises storage means (<NUM>) comprising at least one of a protected memory area for the characteristic reference data and wherein non-conformity of the digital signal as monitored by the monitoring logic (<NUM>) with the characteristic reference data denotes a breach of signal integrity of the digital signal.