DE10252329A1 - Security chip, especially for a chip card, has a protection arrangement that is triggered by an applied pressure that causes two chemical reagents to come into contact thus directly or indirectly destroying secret memory contents - Google Patents

Abstract

Security chip (1), e.g. for a chip card, has a data store, especially a key memory and a protection arrangement (15-19) for detecting an attempt to access the memory, and where such an attempt is detected to delete the memory contents. The protection arrangement comprises at least one hollow space, with a change in state of the hollow space causing deletion of the key memory contents. To prevent a change in state in one of the hollow spaces from accidentally triggering memory deletion, a balancing circuit is connected to one or more sensors to balance out measurement value drift. The memory contents are destroyed by a chemical reaction or the heat generated by it. The chemical reaction is caused when a pressure change causes a valve separating two chemical reagents to open, thus allowing them to mix and react.

Description

The invention relates to a security chip one against spying secured data storage, in particular key storage, comprising a Security device for detecting an attempt to access the data memory and, in the case of such detection, for deletion of the data storage.

Security chips in the sense of the present invention are electronic chips with security-related structures, in particular those with a data memory on which security-relevant data is stored , such as an individual cryptographic key, are one PIN or other secret data. Preferred chips can be found, for example in all types of chip cards. The security-relevant data storage are a preferred spy target and must therefore be particularly protected inside the chip against external attacks. There is a risk, for example, that the data memory is transferred to the Chip drilled holes contacted and the data from memory be read out.

To secure the chip against spying security-relevant Numerous measures have already been proposed for data.

Object of the present invention is an alternative to protecting a data store within of a chip to propose a physical attack on the Detect the chip and delete the data storage in good time can.

This task is done through a security chip with the characteristics of the independent Claim solved. Dependent on it Are claims Advantageous refinements and developments of the invention are given.

Accordingly, there are one or several cavities intended. The interior of the cavity is characterized by a characteristic state change due to an external attack is monitored. Becomes such a change detected, it is immediately the deletion against spying prompted to be backed up data storage. Preferably, the change itself, without additional measures and especially without the use of additional energy, the extinguishing or even the destruction of the data storage.

The securing cavities are preferably round provided around the data storage to be backed up, but at least lie directly above and / or under and / or next to the data storage device to provide a direct physical access to the data storage, for example by Drill to detect.

Placing the cavity above and / or below The data storage is particularly useful if the security chip one of several, electronically connected chip layers existing chip stack is. The security-relevant structures then lie in a central layer in the chip stack, and individual ones or all security cavities lie in the substrate material of those adjacent to the relevant layer Chip layers over and under the data store.

If the external attack attempt that affects the cavity state not easily deleted or destruction of memory, but a previous evaluation of actual changes in measured values required, it is also advantageous to have the necessary evaluation electronics to be placed on a level below or between the securing cavities. This prevents a cavity level from the one below it lying level to be secured can be separated without a such attempt to delete already of the data storage leads.

Several evaluation devices can also be used in different chip layers for the evaluation of detected changes in state be provided in the same cavity. The respective evaluation results should be identical under normal circumstances his. A deviation of the evaluation results concerning the same cavity indicates an attack. Is the deviation so serious that to an external attack must be closed, the data memory to be protected is deleted immediately.

To prevent changes in state, not on an external attack are attributable the deletion process trigger the data storage, can one or more sensors and an equalization circuit are provided to compensate for a measured value drift.

For example, the cavity one under pressure or contain fluid under pressure. The pressure is by means of monitored by a pressure sensor. In the event of or falling below a predetermined limit, the reacts Evaluation circuit and causes the data storage to be deleted or destroyed. This happens, for example, if the cavity is drilled and thereby pressure equalization with the environment occurs. The evaluation circuit can now be set up so that in the event of slow pressure changes, how they occur due to temperature does not respond. Instead can also be an additional one Temperature sensor arranged in the cavity and a compensation circuit is provided be to computational temperature-related pressure fluctuations Ways to consider.

There are numerous ways to detect changes in the state of the cavity. Depending on which property or which parameter of the cavity is monitored, different sensors are again available for detecting the respective property. The sensors can be designed in such a way that they directly lead to the deletion or destruction of the data memory, or that they merely deliver a signal which is first evaluated electronically before the Data storage is deleted or destroyed.

Interesting verifiable properties of the cavity interior are, for example, electrical, material, acoustic, optical, dimensional and printing properties. The interior of the cavity must of course be like this be set to attack the cavity, in particular drilling into the cavity to change the property checked leads, by, for example, a change in pressure or a mass transfer or an opening of the Cavity to a change an electrical, material, acoustic, optical or other Property of the cavity interior leads.

The invention is explained below of embodiments, partially explained in more detail with reference to the accompanying drawings. In this demonstrate.

1 a chip stack with three layers and two. Voids ,.

2 a chip stack with two chip layers and a membrane pressure sensor, and

3 a dielectric cavity sensor,

4 a chip stack with three chip layers and a chemically reacting liquid sensor.

1 shows three chip layers 2 . 3 . 4 a stack of chips 1 , which in the usual way by means of vias 5 are electrically connected to each other. Every chip layer 2 . 3 . 4 comprises a silicon substrate 6 with a metallization 7 , In the metallization 7 the middle chip position 3 the security-relevant structures including a key storage to be secured are implemented. The key storage is, for example, directly below the cavity 9 the top chip layer 4 , The cavities 8th . 9 are designed as sensors or have sensors by means of which changes in the cavity or changes affecting the cavity interior can be detected. If an attack on the key memory from a surface of the chip stack 1 is carried out, for example by drilling the chip stack, such an attack is recognized as soon as the intermediate cavity is drilled.

The cavity 9 in the upper chip layer 4 can include, for example, a pressure sensor that detects the pressure within the cavity 9 located gas measures. This can be an overpressure or a vacuum. Now becomes the cavity 9 drilled, a pressure equilibrium is established with the atmospheric pressure of the environment. The pressure sensor detects this pressure change, so that the deletion or destruction of the key memory can be initiated immediately before the key memory is contacted and read out.

For example, the pressure sensor can be designed in such a way that it delivers discrete pressure measurement values to evaluation electronics which actively delete the key memory when the predetermined limit value is exceeded. This evaluation electronics is preferably not in the chip position 4 , otherwise there would be a risk that the chip position 4 with the cavity sensor from the chip stack 1 be separated and access to the key memory in the chip layer 3 could release. Therefore, the evaluation circuit for pressure measurement is preferably located in the middle chip position together with the data memory to be protected 3 below the cavity 9 the top chip layer 4 ,

A membrane pressure sensor for chip integration that is suitable for this purpose and can be mass-produced has been developed, for example, by the Fraunhofer Institute for Microelectronic Circuits and Systems (IMS). Such a sensor could be adjacent to the cavity 9 will be realized. This is a vacuum gap capacitor, the capacity of which changes due to pressure-related displacement of the membrane (Fraunhofer Institute for Microelectronic Circuits and Systems, Duisburg - Dresden, IMS-APS "Absolute Pressure Sensor Family", 5/97 and 06/98).

2 shows an alternative embodiment for realizing a pressure sensor. The top two chip layers are shown 3 . 4 a stack of chips. In this case the cavity is in two cavity chambers 9a . 9b divided by a membrane 10 are separated from each other. The cavity 9a contains a liquid and borders on the metallization 7 the the key store 11 containing chip layer 7 on. However, the membrane covers 10 the key store 11 under normal conditions compared to that in the cavity 9a contained liquid. For this purpose, the cavity 9b filled with a pressurized fluid. Now the cavity is under pressure 9b Open from the outside, there is a pressure equalization with the environment, which ultimately floods the key storage 11 with the one in the cavity 9a contained liquid leads. Depending on the type of this liquid, the flooding can have various consequences. For example, it can be a destructive, in particular caustic, liquid, through which the key memory is physically destroyed. Instead of a liquid can be in the cavity 9a also contain a gas with a corresponding effect.

Instead of directly monitoring the Cavity pressure can also indirectly determine its integrity the electrical properties of the cavity interior, such as dielectric properties or electrical conductivity.

For example, the cavity can be filled with an electrolyte and contain one or more different sensors that detect the presence of the electrolyte based on the electrical conductivity of the interior of the cavity. If the cavity is destroyed in the event of an attack on the chip, the electrolyte flows out and the electrical one Conductivity is lost. The evaluation device will then cause the data memory to be deleted.

On the other hand, the cavity as Capacitor may be formed, the cavity interior being the dielectric forms. The cavity is for this purpose with a special gas or a special liquid filled, or else evacuated so that due to the special dielectric properties the capacity of the capacitor is specified. Such dielectric gas or liquid sensors are known in chip technology as interdigital capacitors. For example, the cavity can be filled with heteropolysyloxane.

In the simplest version, such a dielectric gas or liquid sensor is designed as a plate capacitor. This variant is very easy to implement by using the cavity 9 only on the two metallizations 7 of the two adjacent chip layers 3 . 4 needs to border. The metallizations 7 are accordingly implemented as capacitor plates in the area adjacent to the cavity. The metallization layers are preferably structured in a meandering manner.

Instead of providing the capacitor plates parallel to a chip plane, they can also be implemented perpendicular to them, for example as trenches. In 3 shows a special embodiment of such a dielectric sensor, which can be integrated into a cavity of the chip. The integration can take place horizontally parallel to a chip level or vertically. In this particular embodiment, the capacitor plates form 12 . 13 a meandering space 14 , which is filled, for example, with the aforementioned heteropolysyloxane.

It is also possible to check the integrity of the cavity to monitor by detecting which substance is in the cavity. Such a test can affect the type of void filler and / or the amount the void filler, in the case of a liquid extend to the level, for example. It can also refer to whether there is a foreign body, for example in the event of a drilling attack, the drill tip is located in the cavity.

The type of void filler let yourself by means of appropriate sensors, in particular gas sensors for detection of a certain gas. In the event of an attack a mass exchange with the environment take place. This is from the sensor detected.

The type of void filler let yourself also check optoelectronically, for example by the refractive index and / or the color of the gaseous or liquid filler is detected. You can do this, for example fiber optic light sensors used in an optoelectronic structure become. Such light sensors require their own light source.

The fill level of the cavity can also be optoelectronic monitor using your own light source. Using light sensors dimensional properties, for example the cavity wall distances, can also be determined Distance measurements, monitor. Even a foreign body can enter the cavity monitor using light sensors using your own light source, if namely the light sensors are designed as light barriers. In the three aforementioned cases it is also irrelevant which specific substance is in the cavity located.

Some have already been mentioned above Examples called as special properties of the cavity interior Detectable optoelectronically using its own light source are. However, it is advantageous if the use of a light source can be dispensed with. An alternative version therefore provides for a simple one Integrate light sensors into the cavity. As soon as in an attack light falls on the chip, the light sensor sends in Signal to the evaluation electronics for deleting the data memory. However, it protects This measure not before an attack in the dark. The combination of several different ones Sensors, be it light sensors or sensors of another kind, is therefore meaningful.

Even the acoustics of the interior of the cavity can be used as a criterion for verification become. The acoustics change among other things in the event of a change of the cavity pressure. Acoustic sensors can be used, for example, in a vacuum operated mechanical resonators are used, as in Accelerometers for Airbags are used. These sensors are operated in resonance, and their amplitude is monitored, which by a change of the vacuum is strongly influenced. To implement this variant the cavity must be evacuated. In the event of an attack in which the Cavity opened pressure equalization takes place directly from the acoustic sensor is detected and for deletion of the data storage leads.

From the aforementioned examples it follows that the cavity is filled with a special fluid in almost all cases. The special feature is that the fluid contains a different pressure (overpressure or underpressure) and / or a different substance (liquid or special gas) compared to the atmosphere. An attack on the chip violating the cavity leads to pressure equalization and / or mass transfer with the surroundings. This pressure equalization or mass transfer can be detected by means of one or different sensors based on a wide variety of physical phenomena. The only exceptions are the variants in which light sensors are used to detect incidence of light or foreign bodies in the cavity or where the cavity dimensions or the fill level are monitored using light sensors. In these cases, pressure conditions and / or material properties are not important.

The aforementioned embodiments each require an evaluation circuit via which the key memory actively deleted in the event of an attack becomes. This in turn requires the use of additional energy. That energy to delete of the data storage usually comes from from an external voltage source. Will this external voltage source interrupted, the key store in the Not deleted in the event of an attack become. The following are exemplary embodiments explains where to delete an external voltage source is not required. Rather, in these cases the voltage source integrated in the security chip.

According to a first variant between two cavities a piezo membrane. Alternatively, a cavity through a piezo membrane be divided into two cavity chambers. The piezo membrane is covered by an overpressure or a negative pressure in a cavity or a cavity chamber biased. Due to the flexibility of the piezo membrane, it turns out the same or negative pressure in the other cavity or the other cavity chamber on. If one of the cavities or Cavity chambers damaged, so there is a pressure equalization with the surrounding atmosphere. Thereby the membrane suddenly relaxes and emits an energy surge that to delete or To destroy of the data storage is used immediately. Evaluation electronics is not applicable in this variant.

According to a second variant, can the energy to extinguish or destroy of the data storage can be obtained electrolytically. To do this itself in closely adjacent cavities or two electrolytes in adjacent cavity chambers, who react when they come into contact with each other and via an appropriate electronic Circuit lead to a current flow. This current flow is in turn used to delete the key memory.

The way the two of them Electrolytes come into contact in the event of an attack can, is diverse. For example the cavities or cavity chambers through a meandering or comb-like partition be separated from each other, so that this partition in the case of a Inevitable drilling attack hit and disturbed becomes.

As an alternative to this, pressure equalization can again be used, for example, to establish a fluid connection between the two chambers. Referring to 2 could, for example, the left and right chamber sections of the cavity chamber 9a filled with different electrolytes and due to the overpressure in the cavity 9b prestressed membrane 10 be separated from each other. With pressure equalization in the cavity chamber 9b the two electrolytes will mix and lead to a current flow that will erase the data storage 11 can be used.

Instead of the energy generated inside the chip to delete of data storage, it can also be used for physical destruction of the data storage can be used. For example, by means of an active switchable valve become a destructive Fluids on the key storage area to pump. This can be, for example, a caustic liquid act with the etchable Structures of the to be deleted key store be destroyed.

Alternatively, the energy to open a Valve between two cavities be used with two substances that react violently with one another filled are and who, at least after opening the Valve, in contact with the key storage area come. The two substances can react chemically with release of energy, so that the key store is chemically and / or thermally destroyed. The switch to open the Valve can also be a passive switch, for example a pressure sensitive switch. In this case there would be a change in pressure in one of the two cavities for opening of the cavities connecting valve.

This is in 4 shown. Again, three chip layers are shown 2 . 3 . 4 of a multilayer chip 1 with a key storage area 17 in the inner chip layer 3 , Immediately above and below the key storage area 17 there are cavities 15 . 16 that are filled with different liquids. The cavity pressure of each of these two cavities 15 . 16 differs from the ambient pressure. The cavities 15 . 16 are through a connecting line 19 connected with each other. A valve 18 in the connecting line 19 however prevents contact between the two cavities 15 . 16 contained liquid. With the valve 18 it is a passive, pressure-sensitive valve that opens as soon as in one of the two adjacent cavities 15 . 16 pressure equalization with the atmosphere occurs. After opening the valve 18 the two liquids get inside the connecting line 19 in contact and react chemically with each other. This reaction can release energy. The one on the connecting line 19 adjacent key storage area 17 can be destroyed chemically and / or thermally.

Claims (20)

Security chip ( 1 ) with a data storage ( 11 ; 17 ), especially key storage, and one Safety device ( 8th . 9 ; 12-14 ; 15 . 16 . 18 . 19 ) to detect an attempt to access the data memory and, in the case of such detection, to delete the data memory, characterized in that the security device has at least one cavity ( 8th . 9 ; 9a . 9b ; 15 . 16 ) and includes a sensor system which, due to a characteristic change in state in the cavity, deletes the data memory. Security chip according to claim 1, characterized in that the at least one cavity is directly above and / or below and / or is next to the data store. Security chip according to claim 1 or 2, characterized in that the security chip ( 1 ) from a chip stack with two or more chip layers that are electrically connected to one another and one above the other ( 2 . 3 . 4 ) consists. Security chip according to claim 3, characterized in that at least one cavity in another chip layer ( 4 ) lies as the data storage ( 11 ; 17 ). Security chip according to claim 3 or 4, characterized in that that the sensor system in at least two chip layers, one each electronic evaluation device for evaluating the current state or a change of state in the cavity and also has a comparative device, with the evaluation results of the at least two evaluation devices be compared. Security chip according to one of claims 1 to 5, characterized in that an electronic evaluation device of the sensor system for evaluating the current status or one change in condition in the cavity directly above and / or under which at least one cavity is located. Security chip according to one of claims 1 to 6, characterized in that the sensor system at least one Sensor for detecting one or more properties of the cavity interior, selected from the following group of properties: - electrical Properties such as dieelectricity or electrical conductivity, - material Properties, such as type of cavity filler, Amount of void filler, level or foreign body in the cavity, - printing properties, such as overpressure or Negative pressure compared to atmospheric pressure, - optical Properties such as brightness, refractive index or Colour, - acoustic Properties, such as resonance properties, and - dimensional properties, such as wall distances. Security chip according to claim 7, characterized by at least one further sensor and a compensation circuit for Detection of the ambient conditions, in particular the atmospheric temperature, and to compensate for a measured value drift of the at least one sensor. Security chip according to one of claims 1 to 8, characterized in that the cavity is filled with a fluid. Security chip according to claim 9, characterized in that the fluid has a higher or is subject to lower pressure. Security chip according to claim 9 or 10, characterized characterized in that the fluid differs from ambient air by its nature distinguishes in a characteristic way. Security chip according to one of claims 1 to 7, characterized in that the sensor system is a device to delete or destroy the Data storage without feed encompassed by external energy. Security chip according to claim 12, characterized in that the sensor system comprises a piezo membrane, which has two chambers separates the at least one cavity from one another and in the event of a sudden change their voltage state emits an energy surge that can be deleted or To destroy of the data storage serves. Security chip according to claim 12, characterized in that two adjacent cavities ( 9a ; 15 . 16 ) each contain a substance that, in the event of a characteristic change in state, in at least one of the two cavities or in a third cavity ( 10 ) come into contact with each other and react with each other, which causes deletion or destruction of the data storage. Security chip according to claim 14, characterized in that the two cavities by a pressure-sensitive mechanism ( 10 ; 18 ) which are separated from one another in the event of a pressure change in at least one of the cavities ( 9b ; 15 . 16 ) creates a connection between the two cavities. Security chip according to claim 14, characterized in that the two cavities by a meandering or comb-like wall are separated from each other. Security chip according to one of Claims 14 to 16, characterized in that the two cavities ( 9a ; 15 . 16 ) each contain an electrolyte which, when in contact, leads to a current flow which serves to erase or destroy the data memory. Security chip according to one of claims 14 to 17, characterized in that contained in the two cavities Substances react chemically or exothermically and the data storage thereby being chemically or thermally destroyed. Security chip according to claim 12, characterized in that the sensor system comprises a membrane ( 10 ) which comprises two chambers ( 9a . 9b ) of the cavity from each other and from the data storage ( 11 ) separates, with a pressure change at least in one of the chambers ( 9b ) means that the data storage with one chamber ( 9a ) comes into contact, whereby the data storage ( 11 ) is flooded by the substance it contains. Chip card comprising a security chip according to a of claims 1 to 19.