HK1149365B - Embedded package security tamper mesh - Google Patents

Description

Embedded package tamper-resistant mesh

Technical Field

The present invention relates to security protection of integrated circuit devices, and more particularly to physical protection of integrated circuit devices.

Background

Some types of devices are often vulnerable to attack. For example, chips storing keys or other secure data or chips handling secure transactions (e.g., credit card transactions) are of particular interest to attackers. One type of physical attack, known as a fence attack, is to pierce the device's encapsulating enclosure, physically entering the device. In this type of physical attack, the encapsulant is opened and the molding compound is removed or etched away. The attacker then uses the probe to access the interior of the chip or device. In this way, an attacker can detect and/or control chip internal signals.

Therefore, there is a need for a package level security protection scheme that combines logic protection, embedded physical security protection measures, and tamper detection of important data and signals.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description, serve to explain the principles of the invention and to provide a further understanding of the invention. In the drawings:

FIG. 1 is a schematic diagram of package protection typical in the prior art;

fig. 2 is a cross-sectional view of a package with wire bond package security protection in accordance with a preferred embodiment of the present invention;

FIG. 3 is a top view of a partial package according to a preferred embodiment of the present invention;

FIG. 4 is a top view of adjacent staggered pads according to the preferred embodiment of the present invention;

FIG. 5 is a schematic diagram of a package with multiple tamper detection circuits in accordance with a preferred embodiment of the present invention;

FIG. 6 is a schematic diagram of a wafer with a detection grid disposed over a portion of the wafer according to a preferred embodiment of the invention;

FIG. 7 is a cross-sectional view of a safety area of a chip according to a preferred embodiment of the invention;

FIG. 8 is a schematic view of a protection grid pattern according to a preferred embodiment of the present invention;

FIG. 9 is a schematic view of another protection grid pattern according to the preferred embodiment of the present invention;

FIG. 10 is a schematic view of a single layer protective netting in accordance with a preferred embodiment of the present invention;

FIGS. 11 and 12 are schematic views of stacked wafer (die) embodiments with only mechanical security protection;

FIGS. 13 and 14 are schematic diagrams of stacked wafer protection embodiments according to preferred embodiments of the present invention;

fig. 15 and 16 are schematic diagrams of package-on-package implementations in accordance with preferred embodiments of the present invention.

The invention will be further explained with reference to the drawings. In the drawings, like reference numbers can indicate identical or functionally similar elements.

Detailed Description

1.0 general description

A significant component of a chip or device may be subject to attack from the top, sides, or bottom of the package. The conventional technique is to construct a protective box outside one or more chips, but this can only protect chips or devices from physical attack, and cannot provide logic protection for important signals. Fig. 1 is a schematic diagram illustrating an exemplary conventional technique for package protection. As shown in fig. 1, the package 100 has a top circuit board 102, a first side circuit board 104 mounted at 90 degrees to the top circuit board 102, a second side circuit board 106 also mounted at 90 degrees to the top circuit board 102, and a bottom circuit board 108. The grid extends through the circuit board enclosure (enclosure). The enclosure encloses all of the protected components (called "chips"). This solution makes the manufacture of the product difficult and costly.

Embodiments of the present invention provide a protection scheme against top, side, or bottom attacks from a package. The wire bond protection embodiment described in section 2 provides a protection scheme to protect and detect side-edge attacks from the package. Top protection embodiments (e.g., stacked die and package stack) provide a protection scheme to protect against and detect attacks on the top of the package, as will be described in section 4. The embodiment of the package stack described in section 4 also provides physical protection against side attacks. Protection from bottom attacks is achieved by a board level mesh provided in the substrate on which the wafer is mounted. The plate-level mesh may be implemented using conventional fabrication techniques.

2.0 Wire Protection (Bond Wire Protection)

Fig. 2 is a cross-sectional view of a package 200 with wire bond package security protection in accordance with a preferred embodiment of the present invention. Wire bonding encapsulation protection effectively builds a wire cage or grid that protects the wire bonds around the wire bonds that carry sensitive (reactive) chip signals. Such a shielded wire cage increases the difficulty of using probes to detect the undetected shielded signal.

Package 200 includes one or more Integrated Circuit (IC) die 202 mounted on a substrate 204. In one embodiment, wafer 202 is an integrated secure processor with an embedded system and a plurality of peripheral devices on a chip processor. For example, the wafer may include sensitive signal input/output devices such as magnetic stripe readers, smart card input/output, credit card readers, secure keyboards, and or touch screens. In one embodiment, the substrate of the package is a multi-layer board (e.g., 4 layers) for routing wire bond signals to the package solder balls 206.

In one embodiment, package 200 uses staggered pads (stacked pads) in an I/O pad ring of the device. Pads for sensitive (or protected) signals (also referred to as "signal pads") are arranged on the stagger (stagger-out) pads (not shown in the figure). The staggered pads are located at the furthest edge of the wafer. The protective wire mesh is arranged on a staggered-in pad, and the staggered-in pad is adjacent to a staggered-out pad. The staggered pad (not shown) is located behind the staggered pad and the staggered (or "signal") bond wire 250 (beyond). The miswire (also referred to as "protection wire") 240 is shaped to be higher than the miswire in the vertical direction. Thus, the protective bond wires provide protection in both the vertical and horizontal directions for the alien (sensitive signal) pads and the bond wires 250. The sensitive signal is transmitted into the substrate before leaving the protective cage formed by the protective bonding wires. As shown in fig. 2, in this design, a protection cage formed by protection bonding wires surrounds and protects sensitive signals.

The error protection pads (not shown) are constructed by wire pads (not shown). The bonding wire bonding pad is not connected with the substrate or the power supply layer of the adjacent bonding pad. The guard pads are connected only to the insulated metal and insulated vias (vias) on the wafer. In one embodiment, the protection bond wires 240 are connected into one or more protection circuits. A tamper signal (tamper signal) flows through each protection circuit to the detection circuit. For better protection, the drive pads of the protection circuitry may be driven from a protected safe area of wafer 202 (as described in section 3 below). The detection circuit may be configured to be able to detect an open or short circuit occurring in the protection circuit. The detection circuit may also be configured to protect against changes in other characteristics in the circuit, such as changes in capacitance or resistance.

Signals off-chip (via signal bond wires 250) may be logically protected using encryption or authentication techniques. The package 200 may also include integrated physical protection including frequency monitoring, voltage tv, temperature sensing and sensor networks for protecting the chips in certain sensitive areas.

As is known to those skilled in the art, the solder balls 206 are arranged in a plurality of rows. In an embodiment, the security sensitive signal is arranged at least two rows deep from an outer edge of the array of solder balls. The less sensitive signals may be arranged at least one row deep from the outside of the package.

Fig. 3 is a top view of a portion of a package 300 according to a preferred embodiment of the invention. Package 300 includes a plurality of pads 302a-p on a wafer (e.g., wafer 202 in fig. 2). In an embodiment, pads 302, are arranged in a ring-like fashion (note that only a portion of the ring is shown in FIG. 3). Pad 302 generally includes a pad contact 304. A set of pads 302 are used for wire bond protection (referred to as "guard pads"). The remaining pads 302 (shaded in fig. 3) may be used for chip functions. For example, pads 302c, e, g, j, 1, and n are chip function (out-of-fault) pads, and the remaining pads are guard (in-fault) pads.

Although shown as staggered pads, the grid connection pads may alternatively be staggered or staggered. The staggered configuration of the bond pads allows for higher pin density, thereby allowing the protective bond wires to be placed closer together, enhancing physical protection of the enclosed signal bond wires. In addition, the mesh gate connection pad may be an in-line pad. Also, as shown in fig. 3, the pads may alternatively overlap.

Fig. 3 also shows a portion of the package substrate for providing routing for the package. In one embodiment, routing is provided by a small Printed Circuit Board (PCB) on the substrate. As shown in FIG. 3, the package substrate includes a set of outer contacts 316a-h and a set of inner contacts 314 a-h. The bond pad pads 304 on the wafer may be connected to substrate connection points by wire bonds. The substrate connection points are typically connected to solder balls 206 (shown in fig. 2).

Protective bonding wires 340a-n are typically connected to the set of outer connection points 316. The bond wires carrying the physical protection signals, such as signal 380a, typically have a protection bond wire on each side. The effective vertical grid pitch 318 between the substrate external connection points for these guard bond wires is determined by the minimum pitch between the guard (in-fault) pads and the signal (out-fault) pads. In the example shown in fig. 3, the first physical protection signal 380a is transmitted from the pad connection point 304c to the substrate interconnection point 314a through the signal bonding wire 350 a. To access (or access) the substrate interconnect 314a, an attacker must precisely penetrate between 340c of the protection bond wires 340 b. Thus, the smaller the vertical network spacing, the closer the protection bond wires are, and the more physically protected the signal 380 a. The vertical grid pitch may also be reduced by increasing the horizontal pitch 319 between the substrate outer connection points 316 and the substrate inner connection points 314.

FIG. 4 is a top view of adjacent staggered pads according to a preferred embodiment of the present invention. Staggered pad 402c is a sensitive signal (out-of-order) pad and receives a guard signal (e.g., signal 308 a). Staggered pads 402b and 402d are guard (staggered) pads. In the embodiment shown in FIG. 4, the staggered pads 402b-d do not overlap. The protection wire bonds 440b and 440c are vertically higher than the signal wire bond 450 a. In one embodiment, staggered pads 402 are 30 μm wide and the protection and signal bond wires are 0.9 mils (thousandths of an inch) thick, creating an effective wire spacing 418 of 37.14 μm between the two protection bond wires. In this example, the horizontal pitch is only 7.14 μm.

As shown in fig. 3, the protection (in-error) bond wires (e.g., bond wires 340b and 340c) protect the signal bond wires (e.g., signal bond wire 350a), the signal pad contacts (e.g., 304c), and the signal traces (trace) of the sensitive signal (out-of-error) pads. In addition, the circuitry between the guard (in-fault) pads on the wafer is connected to cover the signal traces of the out-fault pads. In one embodiment, the connections may form a pattern (e.g., a serpentine shape), such as connection 390 a. The use of patterned traces can provide additional physical protection for sensitive signal traces on the wafer.

In the exemplary package 300, a set of signals 380a-d are specified to require physical protection. The other set of signals 385 are designated as not requiring additional physical protection. These signals may be protected by logical safeguards and or considered as not requiring additional physical safeguards. As shown in FIG. 3, a protection circuit is built around one or more physical protection signals 380 a-d. The protection circuit in fig. 3 forms a meander pattern, seen from the top down.

In the protection circuit shown in fig. 3, a driver (e.g., an external mesh gate driving circuit) is connected to the driving pad 302 a. An exemplary mesh gate drive circuit is described in U.S. patent application No. 12/210013 entitled "mesh gate protection," which is incorporated herein by reference in its entirety. The driving pads 302a may be driven from an external mesh driving circuit located in a safe area on the wafer. The driver pad 302a may be always active regardless of the state (charged or uncharged) of the protected signal.

The driving pad 302a may serve as the only connection line between the driving pad 302a and the inspection pad 302 p. This line is formed using wire bonds to connect drive pad 302a (via pad contact 304a) to substrate connection point 316 a. The substrate connection point 316a is connected to the substrate connection point 316b via a connection in the package substrate. The protection wire is connected to the substrate connection point 316b to protect the bonding pad 302b on the wafer. In one embodiment, the pads 302b are analog pads (analog pads) that are not fixed to the substrate. The use of analog pads in the protection circuit enables the use of two different voltage levels. With this configuration, the protection/tamper detection circuitry remains active when the rest of the chip is powered down.

The land 304b is connected to the land 304d with a metal connection (e.g., a connection trace) on the wafer. As described above, this metal connection provides additional physical security to the signal trace carrying protected signal 380 a. Signal pad 302c between protection pads 302b and d physically receives protected signal 380 a. One wire bond connects the guard pad 302d to the substrate connection point 316c (which is connected to the substrate connection point 316 d). As such, the protection circuit effectively bypasses the unprotected signal 385. One wire bond connects substrate connection point 316d to guard pad 302i, and guard pad 302i is connected to guard pad 302k with a metal connector, and guard pad 302k is then die bonded off the wire bond to substrate connection point 316 e. The signal bond wires used to physically transmit protected signal 380b are surrounded by protection bond wires 340d and 340 e. This meander pattern continues until the last off-substrate connection point 316h is connected to the detection pad 302p, thereby constructing a tamper detection circuit. Signals from sense pad 304p are routed to external sense circuitry. An exemplary external detection circuit is described in U.S. patent application No. 12/210013. In this embodiment, the meandering mesh pattern extends to cover the entire wafer.

The pad ring (a portion of which is shown in fig. 3) has one or more spaces. The spacing may be used to isolate one or a group of pads. For example, pad 302a and pad 302b are separated by a pad space and do not communicate with each other. In this embodiment, pad 302a and pad 302b are at different power planes. Alternatively, a pad spacing with connectivity may be provided, such as being continuous in the spacing between pad 302h and pad 302 i.

Fig. 3 shows a single protection circuit for providing protection for a plurality of physically protected signals. Multiple protection circuits may also be used on a chip, as will be appreciated by those skilled in the art. For example, a user may wish to tamper-monitor around each sensitive signal. This configuration enables detection of an attacker attempting to access (or access) one device/function (e.g., a magnetic stripe reader) instead of another device/function (e.g., a secure keyboard). Note that in other embodiments, the chip may be protected by only a single protection circuit for the entire chip.

Fig. 5 is a schematic diagram of a portion of a package 500 with multiple tamper detection circuits in accordance with a preferred embodiment of the present invention. Fig. 5 particularly shows the connections between the protection pads using two drivers of different polarities. The connections with the first polarity are indicated by solid lines. The connection with the second polarity is indicated by a dashed line.

Package 500 includes two driver pads 502a, b (one driver pad for one polarity) and two sense pads 502x, y (one sense pad for one polarity). The detection circuitry is used to provide wire detection protection for the sensitive signals 580 a-f.

Because there are two separate tamper detection circuits (all wire bonds), an even number of on/off pads 590 are required around the protected signal area shown in fig. 5. In one embodiment, the last pad of a signal area may be routed back to the wafer to protect long signal traces from one protected pad area to the next.

Further, the two tamper detection circuits may be routed on the package alternately from being disposed internally to being disposed externally to connect the next wire bond. This configuration prevents an attacker from shorting out signals at the package base layer. The metal connections on the wafer may also be similarly alternated. The opposite tamper detection circuit polarity further can be aligned at the wafer and package level, making it difficult to bypass the signal (or bypass the signal).

3.0 wafer grid Protection (Die Mesh Protection)

The wafer, such as wafer 202 shown in FIG. 2, may also include various internal grid protections. FIG. 6 is a diagram of a wafer 602 with a sensing grid disposed over a portion of the wafer according to a preferred embodiment of the invention. Die 602 includes device logic 670, optional erase battery backup ram (bbram)672, and grid 680 on the corners of die 602. The mesh 680 covers the safe area of the wafer. The grid provides at least a double layer of sensing grid. The placement of the corner locations makes it difficult for an attacker to etch back (etch back) the package without damaging the BBRAM power supply bond wires. In addition, if the safe area of the wafer includes a temperature monitor, placement away from the dynamic logic of the device provides thermal isolation. As will be appreciated by those skilled in the art, the grid 680 (and its associated safety zone) may be located anywhere on the wafer.

Wafer 602 may also include a single or double layer metal mesh above the active wafer area. The added metal layer may be driven by a tamper detection signal from tamper logic located in a secure area of the wafer.

FIG. 7 is a cross-sectional view of a safety area 700 of a wafer according to a preferred embodiment of the invention. Secure area 700 includes RDL layer 740, M6 layer 730, M5 layer 720, and base layer 710. Secure region 700 is protected by a metal layer 6(M6)730 mesh, where connections to the mesh are made in M5 layer 720. The grid connection is always under the protection grid. RDL layer 740 provides a ground plane that is above the active mesh of layer 730 of M6. The ground plane provides a physical barrier (physical ground) and a short path to ground that is detectable by the M6 layer grid.

Fig. 8 is a diagram illustrating a protection grid pattern 800 according to a preferred embodiment of the present invention. The protection grid pattern 800 uses meander lines (or zigzag lines) between opposite polarities. Fig. 9 is a diagram illustrating another protection grid pattern 900 according to a preferred embodiment of the present invention. This pattern makes use of the extra polarity, increasing the difficulty for hackers to successfully bypass the grid. Adding an additional layer to the grid shown in fig. 9, where P2 and P4 are placed on the minimally spaced P1 and P3 signals, and the pattern repeats but is offset, further increases the difficulty of the attacker attack process (jumper process).

Fig. 10 is a schematic view of a single layer protective netting 1000 according to a preferred embodiment of the invention. The grid 1000 is made up of multiple complex patterns, making it more difficult to bypass. In one embodiment, the mesh grid 1000 is disposed in the RDL. In this embodiment, bond pads are connected at the M6 level to drive and detect a tamper circuit made up of mesh grid wires. Alternatively, the single layer mesh 1000 is programmed by adding a via layer (a via layer) between the M6 driver and the sense pads, using M7 as the connection layer and RDL as the mesh.

In addition, a dual layer mesh can be used to provide an upper layer mesh to protect the underlying network connections. Ideally, the upper grid connections are protected by the lower grid.

4.0 Package Level Protection (Package Level Protection)

The wire bond protection described previously can prevent attacks on the package from the sides or corners (at angles). However, attacks may also be initiated from the top (e.g., tapping the inside of the wafer). There is therefore a need for a technique that can increase the difficulty of such attacks, as well as being able to detect top attacks, taking protective measures such as erasing sensitive information (e.g., encryption keying material).

Fig. 11-16 illustrate package level protection according to embodiments of the present invention. Package level protection may be used in conjunction with wire bond protection and/or die grid protection as previously described. Alternatively, package level protection may be used alone. Package level protection may be implemented using a stacked-die scheme (as described in section 4.1) or using a package-on-package (package-on-package) scheme (as described in section 4.2).

Typically, protection and detection of attacks on the top of the package is achieved through a mesh grid located on the wafer. The limitation of these internal wafer grid technologies is that grid protection is made in every wafer whether or not the customer needs it. The embodiment of fig. 13-16 achieves mesh protection separate from the wafer. In these embodiments, the grid protection is external to the die as part of the package

4.1 stacked wafer protocol

Fig. 11 and 12 are schematic views of stacked wafer (die) embodiments with only mechanical security protection. Package 1100 in fig. 11 includes dummy die 1140 having an area equal to or greater than the area of die 1102. A spacer die 1150 separates the dummy die 1140 from the wafer 1102. Thus, to access wafer 1102, an attacker must physically remove all or part of dummy wafer 1140 and spacer wafer 1140. Package 1200 shown in fig. 12 includes a dummy die 1240 having an area equal to or greater than the area of die 1202. A dummy wafer 1240 is stacked directly above the wafer 1202. That is, package 1200 does not include spacer die. The embodiments of fig. 11 and 12 provide only physical protection. Thus, the security of these packages may be compromised without detection. These embodiments mainly increase the difficulty of the top attack.

Fig. 13 and 14 are schematic diagrams of stacked wafer protection implementations in accordance with preferred embodiments of the present invention. Packages 1300 and 1400 include a mesh wafer 1360, 1460 having an area equal to or greater than the area of wafers 1302, 1402. In this manner, the grid wafers 1360, 1460 provide a multi-layer protective grid for the entire lower wafer 1302, 1402. In the embodiment shown in fig. 13, spacer wafer 1350 separates grid wafer 1360 from wafer 1302. In the embodiment shown in fig. 14, mesh wafer 1460 is stacked directly on wafer 1402. In one embodiment, the mesh wafers 1360, 1460 include mesh gates. Wire bonds 1320, 1420 in packages 1300 and 1400, respectively, wrap around the entire die and provide connections between the substrate and the mesh die. Wire bonds 1320, 1420 provide greater protection than the solder ball wrap (as described below in connection with fig. 15, 16) because they are spaced closer together than the solder balls.

The stacked wafers in the embodiment of fig. 13 and 14 use the top grid wafer 1360, 1460 as the grid to provide protection throughout the wafer. In these embodiments, the mesh can be driven from the protected lower level wafer 1302, 1402 using external mesh drive circuitry. In an embodiment, additional functionality (e.g., memory) may be provided in the top gate die 1360, 1460.

42. Package-on-Package (PACK) scheme

Fig. 15 and 16 are schematic diagrams of package-on-package implementations in accordance with preferred embodiments of the present invention. In these embodiments, a mesh substrate with a mesh grid is used to protect the wafers 1502, 1602. In package 1500, die 1502 is surrounded by an array of solder balls connected to a grid substrate 1570. In addition, the wafer 1502 is encapsulated in a mold compound 1506. The molding compound 1506 is also surrounded by an array of solder balls. As is known to those skilled in the art, to mold a plastic molding material, a custom plastic cap is required. The height of the solder balls in the solder ball array must be greater than the height of the molding compound. A grid substrate 1570 is stacked on the solder ball array. The mesh substrate 1570 completely covers the wafer 1502.

In package 1600, no custom molded molding compound is required. Instead, the solder ball array of the mesh substrate 1670 is connected to the spacer layer in the layer of molding compound on the lower substrate 1604. In this embodiment, the height of the solder ball array is not as great a function of the height of the wafer or molding layer.

The package stack embodiment of fig. 15 and 16 uses a top package mesh substrate to cover the mesh over the entire wafer. Thus, in these embodiments, no additional wafers are required. In these embodiments, the multi-layer mesh can be driven from the protected underlying wafer using external mesh drive circuitry located in the wafer safe area. The connection to the upper grid substrate is achieved using solder balls between the packages. In one embodiment, the solder balls are arranged on four sides of the package with a minimum solder ball pitch and alternating polarity. This arrangement of solder balls provides additional protection against side attacks. Thus, the embodiment of fig. 15 and 16 may be used without the wire bond protection embodiments described previously.

5.0 concluding remark

While the invention has been described with reference to several embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted without departing from the scope of the invention. In addition, many modifications may be made to adapt a particular situation or material to the teachings of the invention without departing from its scope. Therefore, it is intended that the invention not be limited to the particular embodiment disclosed, but that the invention will include all embodiments falling within the scope of the appended claims.

Claims (6)

1. An integrated circuit package, comprising:

a wafer, comprising:

a first set of wafer pads disposed on an upper surface of the wafer, each wafer pad of the first set of wafer pads for receiving a wafer signal, an

A second set of wafer pads disposed on an upper surface of the wafer, the second set of wafer pads being insulated from the first set of wafer pads; and

a substrate having a set of external connection points disposed on an upper surface of the substrate and a set of internal connection points disposed on the upper surface of the substrate,

wherein each die pad of the first set of die pads is connected to an interconnect pad of the set of interconnect pads via a signal bond wire, an

Wherein each die pad of said second set of die pads is connected to an outer connection point of said set of outer connection points via a protective wire bond, thereby creating a wire bond cage around said signal wire bond;

the first group of wafer bonding pads and the second group of wafer bonding pads are arranged in a staggered mode;

the protection bonding wire is formed to be higher than the signal bonding wire in the vertical direction;

a plurality of wafer bonding pads in the second group of wafer bonding pads and a plurality of outer connection points in the group of outer connection points are connected to form a tamper protection circuit;

a signal wire of the plurality of signal wires carrying a protected signal;

the first protection bonding wire is adjacent to the first side of the protected signal bonding wire, and the second protection bonding wire is adjacent to the second side of the protected signal bonding wire;

the outer connection point associated with the first protective wire and the outer connection point associated with the second protective wire are separated by a minimum vertical grid spacing;

a die pad associated with the protected signal bond wire includes a protected signal trace;

a first die pad associated with the first protective bond wire and a second die pad associated with the second protective bond wire are connected via a connecting wire disposed over a protected signal trace;

the pattern formed by the connecting lines covers a part of the signal traces.

2. The integrated circuit package of claim 1, wherein the plurality of die pads in the second set of die pads comprise an actuation pad and a sense pad.

3. The integrated circuit package of claim 2, wherein the driver pads are connected to an external grid driver circuit and the detection pads are connected to an external tamper detection circuit.

4. The integrated circuit package of claim 3, wherein the die further comprises: a secure area.

5. The integrated circuit package of claim 4, wherein the external mesh drive circuit and the external tamper detection circuit are included in the die safe area.

6. The integrated circuit package of claim 3, wherein the external mesh drive circuit and the external tamper detection circuit are included in the same logic circuit.