Patent Description:
Integrated circuits (ICs) used in a number of embedded devices such as smartcards can contain a secret security key and carry out secret data. The IC needs to be secure against attacks from the outside.

Integrated circuits can be vulnerable to attacks on the physical structure of the integrated circuit device (such as a chip, semiconductor device, etc.).

Microelectronic technologies used to manufacture integrated circuits rely on a layer-based manufacturing process. During such process, material is deposited and etched to form stacked geometries which correspond to transistors, wires and layer-to-layer interconnections (also known as vias). Because this layered process relies on a silicon substrate to create the transistors, the first layers are always used to etch and deposit material related to transistor creation.

There exist different types of attacks against integrated circuits relying on physical modification of the integrated circuits. Such attacks are intended to gain information stored in the integrated circuit and/or to change the operating characteristics of the integrated circuits into other characteristics which can be exploited by the attacker.

ICs may be subject to front-side attacks. Because of the intrinsic structure of the IC manufacturing process, the first layers that are accessible to an attacker performing invasive attacks from the front side are the metal interconnect layers. Such metal interconnect layers form indeed a sensitive resource that an attacker may try to probe, modify or force to a specific value because they are responsible for transmitting valuable information from transistor to transistor.

Front-side attacks may consist of opening of packaged IC devices, and recording electrical signals from the IC device with external probes. To counteract front-side attacks, it is known to use a protection shield to prevent such attacks, as disclosed for example in <CIT>. The protection shield can be.

Passive shields can be used to prevent viewing of the circuit and making attacks more time-consuming. Passive shields may be removed without affecting the operation of the device. Passive shields are generally constituted of an upper layer of metal interconnects in a multi-layer circuit. However, a breach in the shield is not detected in passive shields.

Active shields are similar to passive shields. However, a breach in an active shield can disable the integrated circuit. Circumventing an active shield is possible theoretically but this is both complex and time-consuming while being limited to a small number of areas of the integrated circuit under attack.

The protection shield used to protect the IC front-side generally consists of metal structures on the top metal layers to prevent front-side invasive attacks. These structures involve designing a dense mesh that the attacker will need to cut through in order to access the sensitive information. Because of the microscopic nature of the devices, such operation involves additional costs for the attacker.

However, new forms of attacks, referred to as "backside attacks", are emerging whereby the attack is not made through a front surface of the IC but through the silicon substrate via a back surface of the IC. Backside invasive intrusions that attempt to access valuable structures up from the silicon substrate were disclosed recently in "<NPL>". Backside attacks constitute serious threats.

Common shielding techniques are not adapted to prevent these types of attacks.

Backside attacks were elaborated to make circuit modifications to flip-chip devices or on lower metal layers of a multi-layer stacked IC device. These techniques are generally used in combination with invasive attacks such as wafer thinning, laser cutting and heating, focused ion beam (FIB) techniques.

As IC device designs comprise several layers, backside attacks try to reach a lower metal layer, for example, via the back surface rather than passing through many layers of interconnects from the front surface.

The conventional active shield used conventionally is arranged on the front surface of the IC device and is not adapted to prevent attacks conducted through the back surface via the substrate.

There is accordingly a need for improved methods and devices for protecting integrated circuits against backside attacks.

In order to address these and other problems, the invention provides a system for protecting an integrated circuit (IC) device from attacks according to independent claim <NUM>. Preferred embodiments are defined in dependent claims <NUM> - <NUM>.

The invention also provides a method for protecting an integrated circuit device from attacks as defined in independent claim <NUM>.

Accordingly, during a backside attack, an attacker will be likely to damage either the added or the functional circuitries, or both, making the probability of a successful attack much smaller.

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate various embodiments of the invention and, together with the general description of the invention given above, and the detailed description of the embodiments given below, serve to explain the embodiments of the invention.

It is noted that the drawings of the invention are not necessarily to scale. The drawings are merely schematic representations. The drawings are intended to depict only typical embodiments of the invention, and therefore should not be considered as limiting the scope of the invention.

Embodiments of the invention provide a system and a method for protecting an Integrated Circuit (IC) device from backside attacks.

<FIG> represents a cross-sectional view of an example of an IC device <NUM> not in accordance with the invention as defined in the claims but useful for understanding it.

The IC device <NUM> may be any IC device incorporating secret data, such as a smartcard.

The IC device <NUM> comprises a front-side part <NUM> and a substrate <NUM>.

As used herein, the "front-side" of an IC device is defined as the side of the IC device on which circuitry is provided.

The substrate <NUM> may consist of a semiconductor material, such as, for example, a substrate of monocrystalline silicon of undoped or doped P-type.

The substrate <NUM> includes a front surface <NUM> on which is arranged the front side part <NUM> comprising a stack of layers, and a back surface <NUM>. The substrate <NUM> may further comprise doping areas <NUM>, <NUM> which implement the source/drain of transistors <NUM> and polysilicon for implementing the gate of the transistors. Both doped (or "active") areas and polysilicon are conductive. More specifically, the IC circuit <NUM> may include N-type doped regions <NUM> and P-type doped regions <NUM> extending into the substrate <NUM> from the front surface <NUM>. The areas <NUM> and <NUM> may be laterally separated from each other by an insulating region also formed in the substrate <NUM>, for example by a deep trench isolation process. The IC device <NUM> may further comprise one or more wells, such as the N-well <NUM>. Electrical components may be provided at the chambers formed by the doped areas <NUM> and <NUM>, such as transistors <NUM> (e.g. P-channel transistor, N channel transistor, etc.). Each transistor <NUM> may comprise an insulating portion <NUM> covering the substrate <NUM> and forming the gate insulator of the transistor (for example in a polysilicon layer), a portion <NUM> of a semiconductor material covering the insulating portion <NUM> and forming the gate of transistor, spacers (not shown) surrounding the gate <NUM> and the doped regions (<NUM>, <NUM>) disposed on either side of the gate <NUM> (source and drain regions of the transistor).

The front-side part <NUM> of the IC device comprises a stack of layers arranged on the substrate <NUM> including insulating layers <NUM>, the transistors <NUM> created using the substrate <NUM> during the manufacturing process and wires carrying sensitive data <NUM>. The interconnections between the layers (layer-to-layer interconnections) may be performed using "vias" <NUM>. The layer-to-layer interconnections may be formed in the upper layers by metal interconnects <NUM> interconnecting the transistors <NUM>. The metal used for the layer-to-layer interconnects may be conductive, and may have a much smaller resistivity than active and polysilicon.

There is provided a protection system <NUM> arranged in the lowest technological layers of the Integrated Circuit (IC) device to protect the IC device <NUM> from backside attacks, such as a focused ion beam (FIB) backside attack, which may be performed through the silicon substrate via a back surface <NUM> of the substrate <NUM>. The protection system <NUM> comprises an internal shield <NUM> arranged in the front-side part <NUM> of the IC device in the vicinity of the front surface <NUM> of the substrate <NUM>. In certain embodiments, a front-side shield <NUM> may be further arranged in the front surface <NUM> of the front-side part <NUM> to prevent from front-side attacks.

The internal shield <NUM> is arranged at the lowest technological layers of the backside part <NUM> of the IC device (lowest technological layers of the IC device). This allows protecting sensitive data carried by metal wires <NUM> against tampering and probing from the backside (as represented for example by backside attack <NUM>).

The lowest technological layers in which the internal shield <NUM> is inserted may include the low conductive layers such as the active zones (doped silicon), the polysilicon layers, the metal layers or a combination of these layers with layer to layer connections (vias).

The internal shield <NUM> forms a physical structure including "mesh" lines inside the lowest level layers of the IC device <NUM> (metal, polysilicon or active area such as doped silicon) which are close to the front surface <NUM> of the substrate <NUM>. The routing of the internal shield <NUM> is configured to fit the empty areas of the lowest layers of the IC device (not filled with other circuit elements), while bypassing the components arranged in these layers, such as transistors <NUM>. The internal shield <NUM> forms a structure that may have a repeated routing pattern, rectilinear or not. For example, a repeated routing pattern may consist in rectilinear lines routed in the same direction, each line being parallel to the others.

The internal shield <NUM> prevents invasive intrusions from entering from the circuit's backside surface <NUM> (backside attacks) which conventionally caused potential damages, for example on the system's security.

It should be noted that although the lowest layers of the IC device <NUM> are usually heavily used for transistor to transistor construction and interconnection, the proposed meshing of the internal shield <NUM> is adapted to such small and scarce empty areas while guarantying a protection against backside attacks.

The internal shield <NUM> also allows to protect the interconnect <NUM> between the transistors <NUM> (e. g between the gates) which is particularly crucial as a backside attack may try to probe a metal wire from the backside surface when the active layers are empty or unused for transistor construction. This makes it possible to protect the metal lines which are sensitive resources that can be probed.

In one example, as represented in <FIG>, the internal shield <NUM> may be implemented in a low metal layer of the front-side part <NUM> (portion of the backside shield are represented in <FIG> with strip boxes), for example in empty areas between the wires carrying sensitive data and the transistors <NUM>.

In still other examples, the internal shield <NUM> may be arranged above areas that are not occupied by standard cells such standard cells containing transistors in the front part side <NUM>. This compensates for the absence of standard cells which conventionally create empty areas that are vulnerable to backside attacks, as no active structure have to be damaged.

As represented in <FIG>, the internal shield <NUM> may be also implemented in the empty areas of the layer arranged on the front surface <NUM> of the substrate <NUM> in the form of a substrate-level shield, for example by using the polysilicon layer used to implement the transistor's gates. The configuration of the mesh lines of the internal shield <NUM> are such that the mesh lines in the empty areas cover the front surface <NUM> of the substrate <NUM> while shifting the routing vertically to bypass the components (e.g. transistors <NUM>) arranged on the front surface <NUM>. As used herein a "vertical" direction refers to the stacking direction of the layers of the IC device <NUM> as represented by the arrow <NUM> at the right of the IC device <NUM>. Similarly, as used herein the expression "low", "top" "upper", "front", "back" are used with reference to the front surface of the IC device <NUM> (top direction) and to the back surface <NUM> of the substrate (down direction). Accordingly, lower layers are the layers of the IC device which are closer to the back surface <NUM> of the substrate while the upper or top layers are the layers of the IC device which are close to the front surface <NUM>.

According to the invention, the internal shield <NUM> is implemented into the substrate <NUM>.

<FIG> represent a cross-sectional view of the IC device <NUM>, according to such embodiments forming part of the present invention.

As shown in <FIG>, the internal shield <NUM> is implemented in one or more doped areas in the substrate <NUM>, such as N-type doped areas <NUM>. While <FIG> shows an internal shield implemented on N-type doped areas, the skilled person will readily understand that alternatively the internal shield may be implemented on P-type doped areas. In such embodiments, the mesh lines are routed using active layers. Routing of active layer mesh lines can be achieved in areas without active devices (transistors).

In yet another embodiment represented in <FIG>, the internal shield <NUM> may be implemented in one or more wells in the substrate <NUM>, such as in P-doped regions <NUM> included in a N-well <NUM> (or conversely in N-doped regions included in a P-well).

Advantageously, using active layers for mesh routing allows for the creation of a very low level mesh. Therefore, more backside attacks protected resources (metal layers, polysilicon) may be available above the shield to the designer for routing sensitive signals.

In the embodiments where the internal shield <NUM> is arranged in the lower layers of the front side part of the IC device <NUM>, the backside shield may be arranged by redrawing standard cells so that a higher metal layer (for example only metal-<NUM>) and above are used in their routing, instead of using the lowest available routing layer (for example metal-<NUM>). In such exemplary implementation, the backside shield mesh can be routed below the standard cells metal interconnect by routing around vias when necessary.

Alternatively, a secure standard cells library may be designed specifically to embed the internal shield <NUM>. This provides great shield coverage with very low implementation costs for the user/hardware designer. In this embodiment, the mesh is directly embedded in the standard cells layout. By using the protected standard cells in the design, the circuit may be intrinsically secured by the embedded backside shield mesh lines.

In an application of the invention to a 3D transistor stacking process such as a FD-SOI (Fully Depleted Silicon On Insulator) based process for example, it is possible to use routing resources available below active areas of transistors of upper stacking layers. In these processes, the density of interconnections (vias) from the upper stacking layers to the lower stacking layers allows the design of a densely routed internal shield below transistors active area for maximum security.

According to another feature of the present invention, the protection system <NUM> further comprises a verification circuit <NUM> connected to the internal shield <NUM> to control the integrity of the IC device (which encompasses the integrity of the interconnect structure's integrity or electrical connectivity) by measuring a circuit invariant. This allows detecting a backside attack conducted to damage the protection system <NUM> and/or the functional circuitries. Accordingly, the probability of a successful backside attack is highly reduced with respect to the prior art.

Even if the low conductive materials (e.g. polysilicon) of the lowest layers in which the verification circuit is implemented have a higher resistivity than metal, thereby making conducting signals through these materials slow and more power consuming, the verification circuit may have a frequency and a speed that are relatively slow to adapt to this constraint while efficiently ensuring the integrity check.

The verification circuit <NUM> is configured to generate an input test value to be propagated inside the internal shield routing and check the integrity of the test value at the output of the backside shield routing.

In particular, the verification circuit <NUM> is configured to send signals over a route in the internal shield <NUM> from a start point of the IC device and check that the signals arrived in an unaltered form at the arrival point.

The verification circuit <NUM> is arranged in the vicinity of sensitive components of the device or interleaved with sensitive components of the device.

<FIG> is a block diagram of the verification circuit <NUM>. The verification circuit <NUM> is configured to control a routing <NUM> of the backside shield <NUM> between a start point <NUM> and an arrival point <NUM>.

The verification circuit <NUM> comprises a computation unit <NUM> configured to compute the value to be transmitted over the routing <NUM> (also referred to hereinafter as the "expected value" or "target value"), and a comparison unit <NUM> configured to receive the data transmitted over the backside shield routing <NUM> and determine if the received value is equal to the expected value computed by the computation unit <NUM>. The frequency of the verification may depend on a system clock. In addition, if the comparison implemented by the computation unit fails, an error reporting unit <NUM> may generate an error notification which may trigger an alarm. In <FIG>, the received value may be the node corresponding to the backside shield equipotential.

In order to make reversing the structure more complex for an attacker, according to the present invention, the verification circuit <NUM> is implemented in the form of a dummy operations circuit. According to the invention, the computation unit <NUM> of verification circuit <NUM> implement arithmetic operations, ciphering operations, or Cyclic Redundancy Check (CRC) computations. The comparison unit <NUM> then checks against the expected values to ensure integrity of the verification circuit <NUM>.

According to the present invention, in order to thwart replay attacks, the input data used by the verification circuit <NUM> is generated by a random number generator. Alternatively, the input data used by the verification circuit <NUM> is derived from a random seed. The random seed may be used to initialize a pseudo random number generator such as a stream cipher or a block cipher, for example. In another embodiment, the input data used by the verification circuit may be generated using a method ensuring backward and forward secrecy. Backward and forward secrecy ensure that while some values are known, these values do not enable an attacker to guess previous or future values. The test vectors used by the verification circuit may be advantageously random or pseudo-random, unpredictable values.

Input data and target data may also be derived from a seed value, usually chosen randomly and renewed for every iteration of the verification, by using a function "f". Advantageously, the function f can be a one-way function. Examples of such one-way functions comprise cryptographic hash functions, stream cipher or block cipher. For example, the seed value may be used at the input key of a block cipher, the plaintext data of the block cipher being set to a known initial value or initialization vector, or alternatively being also randomly chosen.

According to the present invention, the verification circuit <NUM> is implemented by filling the low-density placement areas of the front-side part <NUM> with dummy computation circuitry configured to check the integrity of the IC device <NUM> by comparing the outputs of the dummy computation circuitry with predetermined expected outputs values. Predetermined output values may be stored in memory, or derived by an additional dummy computation logic performing functionally equivalent computations with possibly different implementations. One advantage of such embodiment is that this provides added security. In addition, the dummy computations circuitry may provide fault injection detection capabilities.

In certain embodiments, the dummy computation circuitry for the internal shield <NUM> may be a digital fault injection detection device.

<FIG> is a flowchart depicting the operations of the verification circuit <NUM>.

In step <NUM>, the target value to be transmitted over the routing <NUM> is computed. The target value is computed using protection operations such as arithmetic operations, ciphering operations, or Cyclic Redundancy Check, etc..

In step <NUM>, the data transmitted over the internal shield routing <NUM> are received and checked according to a predefined frequency and depending on a condition.

In step <NUM>, it is determined if a condition between the value received in step <NUM> and the target value is satisfied (in particular an equality condition between the received value and the target value).

If the condition is not satisfied, an error is detected in step <NUM>. The error may be reported by triggering an alarm. Otherwise, steps <NUM> to <NUM> are iterated.

<FIG> is a flowchart depicting the IC device design flow. In <FIG>, the internal shield <NUM> is referred to as the "backside shield".

The process of fabricating an Integrated circuit comprises a plurality of successive phases including the following preliminary phases:.

The netlist may be used to place the standard cell instances on a design floorplan and perform a routing to place wire segment objects on the design floor plan based upon connection information that connect the standard cell instances (floorplan step <NUM>). As used herein a design floorplan of an integrated circuit refers to a schematic representation of tentative placement of its major functional blocks (e.g., flip-flops, NAND gates, etc.). As discussed herein, wire segment objects are objects placed on a design floor plan, and wire segments are the metal placed on a semiconductor wafer corresponding to the wire segment objects. The design floorplan may include object placement information for multiple masks to generate multiple "layers" on the semiconductor wafer of the IC device. Semiconductor wafers may include several metal layers for routing wire segments, one of the metal layers including power rails running parallel to each other and providing power to standard cell circuitry.

Following the logic synthesis, a computer file (<NUM>) corresponding to the structural description may be obtained in step <NUM> in a chosen format such as Verilog, VHDL, EDIF. This file represents the instantiation of the gates from the library and their interconnection, representing the electronic circuit (netlist). Such a representation comprises only Boolean variables each represented by <NUM> bit. The circuit can then be fabricated in a factory.

The IC device <NUM> design flow may be adapted to implement the mesh related to the internal shield <NUM> and the verification circuit <NUM>.

In one embodiment, the verification circuit logic may be inserted into the circuit netlist in step <NUM>. Then, prior to performing standard cells placement, in the floorplanning step (<NUM>) of the logic synthesis phase, the internal shield logic may be placed in the design and the mesh of the internal shield <NUM> may be routed to cover routing areas. The standard cells are then placed in the available spaces and standard placement of cell and routing is performed.

Advantageously, insertion of the internal shield logic and mesh routing may be integrated in computer-assisted design tools to facilitate the deployment of the technology.

Exemplary embedded internal shield routing is illustrated with reference to <FIG>, examples not forming part of the claimed invention but useful to understand it.

In particular, <FIG> shows an inverter standard cell with standard routing. <FIG>, <FIG>, <FIG> illustrate possible internal shield routing within the inverter standard cell. <FIG> illustrates another example of internal shield mesh line connection by standard cell abutment.

In certain embodiments, in order to further raise the cost of the possible attack on transistors such as an attack consisting in removing or probing transistors, a transistor backside attack mitigation method may be used in addition.

<FIG> represents an IC device comprising a protection system <NUM> implementing the backside attack mitigation method according to certain embodiments. As shown, the IC device <NUM> comprises a set of auxiliary transistors <NUM> (also referred to hereinafter as "dummy transistors") inserted in the circuit. The dummy transistors <NUM> may be placed close to or in the vicinity of security-critical transistors <NUM> in order to further optimize the mitigation.

The dummy transistors <NUM> may be used to perform redundant functions so that if a critical transistor <NUM> is removed, the dummy transistor <NUM> (corresponding to the redundant transistor) still performs the desired operations as a backup transistor. This renders the circuit more resilient to transistor removal. As an attacker will need to reverse the chip structure or proceed with trial, an error will be detected before attack success which subsequently raises the cost of the attack. <FIG> represents an exemplary embodiment of the invention using redundant dummy transistors.

The dummy transistors may be implemented in the doped areas of the substrate <NUM>. The dummy transistors may be also implemented using the same layers as the functional transistors <NUM>.

In addition a transistor control <NUM> unit may be implemented to control the dummy transistors to trigger the redundant mode if removal of a critical transistor associated with the redundant transistor is detected. Alternatively, the transistor control unit may be implemented to verify that the dummy transistors are present and check whether they are working properly. If the verification fails, the dummy transistors or the interconnect may have been damaged and the transistor control unit may optionally raise an alarm. The transistor control unit may also trigger other actions such as destroying security critical keys or valuable information.

The dummy transistors <NUM> may be inserted directly in the standard cells layout.

In particular, the internal signals of the standard cells in which the dummy transistors are inserted may use different sets of transistors while still retaining the same functionality. In such an embodiment, standard cells may provide more transistors than required to create the desired functionality. It is therefore possible to generate multiple functionally equivalent standard cells by selecting a subgroup of transistors among the available transistors and connecting them properly. Using functionally equivalent standard cells implemented using different sets of transistors allows rendering an attack more difficult. Examples of such functionally equivalent standard cells are represented in <FIG> and <FIG>.

In some embodiments, at least some of the dummy transistors <NUM> may be used to route portions of the internal shield <NUM>. <FIG> represents an example of such implementation. In the implementation of <FIG>, the dummy transistors <NUM> are used to route a shield mesh line of the internal shield, thereby making the attack much more complex. It should be noted that the internal shield mesh line uses a combination of multiple layers and layer to layer vias, including in this example metal-<NUM>, polysilicon and active layers.

Advantageously, the input and output pins of the standard cells may retain the same geometry across different implementations. This allows the standard cells to be easily swapped in the chip layout.

<FIG> represents another embodiment using dummy transistors implemented as a thin circuit component such as an inverter gate for example. Its output capacity may be weak while being strong enough to amplify a scan chain or a backside shield mesh line.

Claim 1:
A system for protecting an integrated circuit (IC) device from attacks, the IC device (<NUM>) comprising a substrate (<NUM>) having a front surface (<NUM>) and a back surface (<NUM>), the IC device further comprising a front side part (<NUM>) arranged above the front surface of the substrate (<NUM>) and comprising stacked layers, at least one of said layers comprising a data layer comprising wire (<NUM>) carrying data, the front side part having a front surface (<NUM>), wherein the system comprises an internal shield (<NUM>) arranged into the substrate, said internal shield comprising a mesh of lines arranged in empty areas of the one or more layers in which the internal shield (<NUM>) is arranged, the internal shield (<NUM>) forming a structure that has a repeated routing pattern comprising rectilinear lines, the routing of the internal shield being configured to fit said empty areas in said substrate, the system further comprising a verification circuit (<NUM>) configured to check integrity of a routing portion of the internal shield, said verification circuit being arranged in the vicinity of sensitive components of the device or interleaved with sensitive components of the IC device, said verification circuit being configured to propagate input data inside said routing portion of internal shield and check the integrity of said input data at the output of said routing portion of the internal shield, wherein the verification unit comprises a computation unit (<NUM>) for computing a target value to be sent through said routing portion of the internal shield and a comparison unit (<NUM>) to check if a condition is satisfied between an output value received at the output of said routing portion and said input data, said verification circuit being implemented in the form of a dummy computation circuitry, by filling low-density placement areas of the front-side part (<NUM>) with said dummy computation circuitry the frequency of the verification circuit depending on a system clock, the input data being generated by a random number generator or being derived from a random seed, and wherein said computation unit is configured to implement an operation to compute said target value, said operation being selected in the group consisting of an arithmetic operation, a ciphering operation, or a Cyclic Redundancy Check (CRC) computations.