CN105391542A - Detection method and detector applied to integrated circuit for detecting electromagnetic fault injection attack - Google Patents

Abstract

The invention relates to information security, cryptography and encryption circuits, provides detection of electromagnetic fault injection attacks for integrated circuits related to information security such as encryption circuits, and ensures timely response when attacks occur. For this reason, the technical solution adopted by the present invention is to be used for integrated circuit detection electromagnetic fault injection attack detector, the structure is: A1, A2, A3, A4, A5 are 5 inverters, cascaded to form a ring oscillator, ring The oscillation signal output by the oscillator after being buffered by the inverter B is directly input to the combination logic delay comparison structure Detector1, and the other way is input to another combination logic delay comparison structure Detector2 after the reverse of the inverter C; The input signals of the two Detectors are output to the trigger clock input end of the Detector through the combinational logic of the Detector. The invention is mainly applied to integrated circuit safety design.

Description

Electromagnetic fault injection attack detection method and detector for integrated circuit detection

technical field

The invention relates to information security, cryptography and encryption circuits, in particular, to a detector for detecting electromagnetic fault injection attacks in integrated circuits.

technical background

With the development of information society, people pay more and more attention to information security. Cryptography and encryption circuits are an important guarantee for modern information security, which can prevent unauthorized access and illegal information acquisition, and at the current level of technology, it is theoretically impossible to crack through mathematical analysis and violent means. However, the implementation of the encryption algorithm is inseparable from the actual chip circuit. For example, side-channel attacks using side-channel information such as power consumption and electromagnetics generated during the encryption process, or attacks using faults that occur during the encryption process can be further analyzed through subsequent mathematical analysis. Obtain sensitive information such as keys [1].

Fault injection attack is an active side-channel attack method. There are many ways to cause circuit errors, such as electromagnetic pulse, laser irradiation, clock glitch, voltage glitch, etc. It has become the most effective means of attacking security chips. [2]. This attack method is based on the encryption algorithm used by the known encryption circuit, through specific interference to the encryption circuit in operation, so that an operation error occurs at a specific moment, and then the attacker uses the collected wrong encryption result Or record and analyze the performance of the circuit after the operation error, and finally obtain the key and other information of the encryption circuit through differential fault analysis and other means.

Electromagnetic fault injection attack, as a local high-precision attack method [3], has attracted widespread attention due to its advantages such as relatively simple operation, high attack success rate, and small circuit influence range. This attack method places an electric field probe or a magnetic field probe near the encryption circuit [4], triggers the circuit at a certain point in operation, and generates a pulse signal through the probe, thereby causing electromagnetic interference inside the chip, and the changing electromagnetic field is coupled to the The power line or key signal line of the chip makes the circuit run wrong.

The security of the encryption circuit is mainly to protect the security of the key in the circuit. In recent years, the electromagnetic fault injection attack technology has been proposed, which has caused a great threat to information security. Therefore, it is necessary to carry out defense measures against electromagnetic fault injection. In this regard, some researchers have conducted research on algorithm improvement, and some have conducted research on changing the circuit structure [5]. After searching relevant literature and patents, there are few studies on the detection of electromagnetic fault injection attack structures, and there is no effective detection method yet. The combined logic delay-based structure proposed in this patent cooperates with the ring oscillator as an embedded detection structure to detect attacks in time and generate early warning signals.

references

1. Liu Huizhi, Zhao Dongyan, Zhang Haifeng, et al. Application of Near Infrared Laser Fault Injection System in Cryptographic Chip Attack[J]. Science Technology and Engineering, 2014,14(22):225-230.DOI:10.3969/j. issn.1671-1815.2014.22.043.

2、ZhouYB,FengDG,ZhouYB,etal.Side-ChannelAttacks:TenYearsAfterItsPublicationandtheImpactsonCryptographicModuleSecurityTesting.[J].CryptologyEprintArchive,2005,2005.3、Dehbaoui,A,Dutertre,J.-M,Robisson,B,etal.ElectromagneticTransientFaultsInjectiononaHardwareandaSoftwareImplementationsofAES[C]//2013WorkshoponFaultDiagnosisandToleranceinCryptography .IEEE,2012:7-15.

4. OmarouayacheR, RaoultJ, JarrixS, et al. Magnetic microprobe design for EMfault attack [C] // Electromagnetic Compatibility (EMCEUROPE), 2013 International Symposium on. IEEE, 2013: 949-954.

5. Moro N, Heydemann K, Dehbaoui A, et al. Experimental evaluation of two software counter measures against fault attacks [C] // Hardware-Oriented Security and Trust (HOST), 2014 IEEE International Symposium on. IEEE, 2014: 112-117.

Contents of the invention

In order to overcome the deficiencies of existing technologies, the detection of electromagnetic fault injection attacks is provided for information security-related integrated circuits such as encryption circuits, so as to ensure timely response when attacks occur. For this reason, the technical solution adopted by the present invention is to be used for integrated circuit detection electromagnetic fault injection attack detector, the structure is: A1, A2, A3, A4, A5 are 5 inverters, cascaded to form a ring oscillator, ring The oscillation signal output by the oscillator after being buffered by the inverter B is directly input to the combination logic delay comparison structure Detector1, and the other way is input to another combination logic delay comparison structure Detector2 after the reverse of the inverter C; Combination logic D1 and trigger E1 to realize the delay function constitute Detector1, combination logic D2 and trigger E2 constitute Detector2; the input signals of the two Detectors are connected to the trigger input terminals of the Detector; the input signals of the two Detectors pass through The combined logic of the Detector is output to the trigger clock input of the Detector; the outputs of the two Detectors pass through an OR gate F to obtain the final alarm signal Alarm.

The sensitivity is improved by increasing the channel width W _eff of the transistor in the inverter in the ring oscillator and reducing the transistor number N of the inverter.

The method for detecting electromagnetic fault injection attack detection for integrated circuits is realized by means of the aforementioned detectors, and includes the following steps,

Firstly, debug the combined logic delay modules D1 and D2 of the detector so that the delay is equal to 3/4 of the cycle of the ring oscillator output signal; then, according to the circuit area and safety requirements, a certain number of detectors are embedded in integrated circuits that need to be protected.

For the core sensitive module in the integrated circuit that needs to be protected, the layout of the detector is relatively dense, and for the rest of the circuit, the layout of the detector is relatively loose.

Features and beneficial effects of the present invention are:

Utilizing the injection attack structure of the present invention, the occurrence of electromagnetic fault injection attack can be effectively detected. The structure is simple and easy to use, and has a small area. Different numbers of detection structures can be selected and arranged in different positions according to the needs of the circuit. varying degrees of protection.

Description of drawings:

Fig. 1 Architecture for detecting electromagnetic fault injection attacks.

Fig. 2 Schematic diagram 1 of combinational logic delay comparison structure principle.

Fig. 3 Schematic diagram 2 of combinational logic delay comparison structure principle.

Fig. 4 Schematic diagram of combinational logic delay comparison structure principle III.

Fig. 5 Schematic diagram 4 of combinational logic delay comparison structure principle.

Figure 6 is a schematic diagram of the overall detection structure.

detailed description

The invention provides information security-related integrated circuits such as encryption circuits with the detection of electromagnetic fault injection attacks, and can change the number and position of the detection structures according to the needs of the circuit area, and can be well integrated with the original circuit to ensure that the attack can be detected when the attack occurs. Respond promptly.

The present invention uses a combined logic delay-based structure and a ring oscillator as an embedded detection structure, and designs a structure that can detect electromagnetic fault injection attacks for security chips such as encryption circuits.

1. The structure for detecting electromagnetic fault injection attacks proposed by the present invention takes the combinational logic delay comparison structure and the ring oscillator as the core, and embeds them in the original circuit to form the final structure.

As shown in Figure 1, it is a structural diagram of a detection electromagnetic fault injection attack detector (hereinafter referred to as an electromagnetic attack detector). A1, A2, A3, A4, and A5 are five inverters, which are cascaded to form a ring oscillator. Inverter B acts as a buffer, and the output oscillating signal is directly input to the combinational logic delay comparison structure Detector1, and the other way is input to another combinational logic delay comparison structure Detector2 through the reverse of inverter C. . Combination logic D1 and flip-flop E1 that realize the delay function form Detector1, and combination logic D2 and flip-flop E2 form Detector2. The output of the two Detectors passes through an OR gate F to obtain the final alarm signal Alarm.

2. The principle of the influence of electromagnetic fault injection on the circuit

Electromagnetic fault injection generally utilizes a pulse current with a rising edge of nanosecond level in the coil. Under the excitation of the pulse current, an induced pulse magnetic field is generated in the coil, and the magnetic field propagates outward in the form of medium magnetization, thereby affecting the circuit chip near the coil. make an impact. When a steady current is passed through the coil, according to Biot Savart's law, any point Q is taken on the coil, and the current density is (unit A/m ² ), then the magnetic field at any point P in space:

$\stackrel{<span\; class="notranslate">\; \&Right\; Arrow;</span>}{\mathrm{<span\; class="notranslate">\; B</span>}}<span\; class="notranslate">\; =</span>\frac{{\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}}{\mathrm{<span\; class="notranslate">\; 4</span>}\mathrm{<span\; class="notranslate">\; \&pi;</span>}}<span\; class="notranslate">\; \&Integral;</span>\frac{\stackrel{<span\; class="notranslate">\; \&Right\; Arrow;</span>}{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; \&times;</span>\stackrel{<span\; class="notranslate">\; \&Right\; Arrow;</span>}{\mathrm{<span\; class="notranslate">\; Q</span>}\mathrm{<span\; class="notranslate">\; P</span>}}}{<span\; class="notranslate">\; |</span>\stackrel{<span\; class="notranslate">\; \&Right\; Arrow;</span>}{\mathrm{<span\; class="notranslate">\; Q</span>}\mathrm{<span\; class="notranslate">\; P</span>}}<span\; class="notranslate">\; |</span>}{\mathrm{<span\; class="notranslate">\; U</span>}}_{\mathrm{<span\; class="notranslate">\; Q</span>}}$

in is the magnetic induction intensity (unit T), μ ₀ is the vacuum magnetic permeability, its value is 4π×10 ^-7 H/m, dU _Q is the differential of the coil at point Q, is the distance vector from Q to P. Although the pulse current is injected during fault injection, the magnetic field of DC excitation can represent the situation when the pulse excitation is stable. The magnetic field at the center of the coil is:

$\stackrel{<span\; class="notranslate">\; \&Right\; Arrow;</span>}{\mathrm{<span\; class="notranslate">\; B</span>}}<span\; class="notranslate">\; =</span>\frac{{\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}}{\mathrm{<span\; class="notranslate">\; 2</span>}}\frac{{\mathrm{<span\; class="notranslate">\; a</span>}}^{\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; I</span>}}{{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; a</span>}}^{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; z</span>}}^{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; )</span>}^{\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; /</span>\mathrm{<span\; class="notranslate">\; 2</span>}}}$

in And μ ₀ is the same as above, a is the radius of the coil (unit m), I is the current (unit A) when the pulse is stable, and z is the length (unit m) from the center of the coil.

It can be seen from the above formula that when the current flows through the coil, the magnetic induction in the coil is proportional to the current. Therefore, the equation and waveform of the current and the equation and waveform of the magnetic field are only different by a proportional factor. The scale factor is only related to the structure of the coil, when the coil is fixed, this factor is a constant. Therefore, the magnetic field is a non-periodic pulse waveform.

Any conductor exposed to an electromagnetic field can induce a voltage. When a circuit chip is placed in such an electromagnetic environment, the electromagnetic field energy coupled to the circuit will cause a large voltage or current pulse, and the loop formed by the power supply line in the chip is the part that is mainly affected by electromagnetic waves. A magnetic field probe for near-field fault injection is essentially a coaxial line, which is inductive and has a low series resistance. The inductive coupling between a magnetic field probe and a circuit can be expressed in terms of mutual inductance:

${\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; 12</span>}}<span\; class="notranslate">\; =</span>{\frac{{\mathrm{<span\; class="notranslate">\; \&phi;</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}}{{\mathrm{<span\; class="notranslate">\; I</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}}}_{{\mathrm{<span\; class="notranslate">\; I</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; \&mu;</span>}<span\; class="notranslate">\; \&CenterDot;</span>\underset{\mathrm{<span\; class="notranslate">\; S</span>}}{<span\; class="notranslate">\; \&Integral;</span>}\stackrel{<span\; class="notranslate">\; \&Right\; Arrow;</span>}{{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; \&CenterDot;</span>\mathrm{<span\; class="notranslate">\; d</span>}\stackrel{<span\; class="notranslate">\; \&Right\; Arrow;</span>}{\mathrm{<span\; class="notranslate">\; S</span>}}}{{\mathrm{<span\; class="notranslate">\; I</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}}$

In the above formula, M12 is the mutual inductance coefficient (unit H), φ2 is the magnetic flux passing through conductor ₂ (unit Wb), I1 is the current of conductor 1 (unit A), I2 is the current of conductor 2 (unit A), μ is Magnetic permeability (unit H/m), is the magnetic field strength component (unit H) perpendicular to the conductor 2, is the panel differential of conductor 2.

Assuming that it is coupled to the power line, it will cause the output to jump between high and low, which will cause the entire functional module to fail to output correct information. Here, the concept of "coupling" refers to the electrical energy connection between circuits, equipment, systems and other circuits, equipment, systems, coupling plays the role of "transmitting" electromagnetic energy from one circuit, equipment, system to another circuit, The role of equipment and systems. The power network in the circuit is the most susceptible part to electromagnetic interference, and they also act as antennas to receive the magnetic flux generated by the coil, which will induce an electromotive force on the power network. Such a solenoid creates a voltage drop (IRdrop) in the circuit.

In addition, when the voltage or current generated by the electromagnetic pulse through different coupling channels reaches a certain level at the input end of the chip, the logic value of the output end will change, that is, from 1 to 0 or vice versa, resulting in bit errors.

3. Ring oscillator detection electromagnetic attack principle

For a single-ended CMOS ring oscillator composed of N inverters, assuming that the channel lengths of NMOS and PMOS are the same and the absolute value of the threshold voltage is the same, the oscillation frequency is:

${\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; =</span>\frac{{\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; f</span>}\mathrm{<span\; class="notranslate">\; f</span>}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; f</span>}\mathrm{<span\; class="notranslate">\; f</span>}}{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; x</span>}}<span\; class="notranslate">\; (</span>\frac{{\mathrm{<span\; class="notranslate">\; V</span>}}_{\mathrm{<span\; class="notranslate">\; D.</span>}\mathrm{<span\; class="notranslate">\; D.</span>}}}{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; V</span>}}_{\mathrm{<span\; class="notranslate">\; T</span>}}<span\; class="notranslate">\; )</span>}{\mathrm{<span\; class="notranslate">\; 8</span>}{\mathrm{<span\; class="notranslate">\; \&eta;NLq</span>}}_{\mathrm{<span\; class="notranslate">\; max</span>}}}$

Where Cox is the capacitance of the gate oxide layer per unit area (unit F/m ₂ ), VDD is the power supply voltage (unit V), VT is the threshold voltage of the transistor (unit V), L is the channel length of the transistor (unit m), q _max is the total charge received by the node during the transistor on-off transition (unit C), N is the number of inverters that make up the ring oscillator (unit is dimensionless), η is a constant approximately equal to 1 (unit is dimensionless ), W _eff is the equivalent channel width (unit m), the expression is:

W _eff =W _n +W _p

Where Wn is the channel width (unit m) of the NMOS transistor, and Wp is the channel width (unit m) of the PMOS transistor. μ _eff is the equivalent carrier mobility (unit m ² /V·s), the expression is:

${\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; f</span>}\mathrm{<span\; class="notranslate">\; f</span>}}<span\; class="notranslate">\; =</span>\frac{{\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; p</span>}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; p</span>}}}{{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; p</span>}}}$

Where μ _n is electron mobility (unit m ² /V·s), μ _p is hole mobility (unit m ² /V·s).

Electromagnetic fault injection mainly affects the power supply network of the integrated circuit, which will lead to an increase in the supply voltage, and then produce a series of effects, such as reducing the delay of the CMOS gate circuit. According to this principle, during the short time affected by the pulse, the frequency of the ring oscillator changes due to electromagnetic fault injection.

In addition, the place with the strongest electromagnetic radiation is often the place most sensitive to electromagnetic interference (for example, the position where metal wires cross each other to form a ring is equivalent to a probe that receives electromagnetic signals). The ring oscillator will radiate a strong electromagnetic signal with the same frequency as the oscillation signal, so the ring oscillator is designed to detect the impact of electromagnetic fault injection attacks.

4. Working principle of combinational logic delay comparison structure

The above-mentioned ring oscillator, or because the electromagnetic pulse is coupled to the power line, causes the voltage to change, which in turn causes the output waveform to change; or because the electromagnetic pulse is directly coupled to the output terminal, a signal with the same frequency as the interference signal is superimposed on the output signal . This change is reflected in the form of glitches, which can be detected by the delay comparison structure based on combinational logic in the present invention.

Assuming that the circuit works normally and is not under attack, the output frequency of the ring oscillator is f0, so its period is 1/f ₀ . Adjust the delay of combinational logic D1 and D2 in Fig. 1 to be 3/4 of the period, that is, 3/4f ₀ . Therefore, when the circuit chip is not attacked, for Detector1, the clock of the D flip-flop is 3/4 delay of the input signal, so the data sampled by the rising edge of the clock signal are all low level, and the output of the D flip-flop is low level. For Detector2, in the same way, the output is also low. Therefore, after passing through the OR gate F, the alarm signal Alarm is also at a low level. The circuit detects this signal and takes no action.

Then assume that electromagnetic fault injection has occurred, due to the aforementioned two reasons, it will cause glitches in the output signal. Due to the different attack times, the relative positions of the generated burrs to the original oscillating signal will be different. Figure 2 shows the situation where the glitch is located in the first half of the low level of the original oscillation signal. In the figure, D1 is the input data signal of the D flip-flop of Detector1, C1 is the input clock signal of the D flip-flop of Detector1, and D2 is the D flip-flop of Detector2. The input data signal of C2 is the input clock signal of D flip-flop of Detector2. Unless otherwise specified below, this notation is used.

It can be seen from Figure 2 that for the case where the burr is located in the first half of the low level of the original oscillation signal, as shown by the dotted line in the figure, the rising edge of C1 can pick up the high level of the D1 signal, so Detector1 can detect it, and the C2’s The D1 signals collected on the rising edge are all low level, so Detector2 cannot detect them.

It can be seen from Figure 3 that for the case where the glitch is located in the second half of the low level of the original oscillation signal, as shown by the dotted line in the figure, the D1 signal collected by the rising edge of C1 is all low level, so Detector1 cannot detect it, and The rising edge of C2 can pick up the high level of the D1 signal, so Detector2 can detect it.

It can be seen from Figure 4 that for the case where the glitch is located in the first half of the high level of the original oscillation signal, as shown by the dotted line in the figure, the D1 signal collected by the rising edge of C1 is all low level, so Detector1 cannot detect it, and C2 The rising edge of the D1 signal can be taken to the high level, so Detector2 can detect it.

It can be seen from Figure 5 that for the case where the burr is located in the second half of the high level of the original oscillation signal, as shown by the dotted line in the figure, the rising edge of C1 can pick up the high level of the D1 signal, so Detector1 can detect it, and C2 The D1 signals collected by the rising edge of the signal are all low level, so Detector2 cannot detect it.

To sum up, for the two cases where the glitch is located in the first half of the low level of the original oscillation signal and the second half of the high level, Detector1 can detect it, but Detector2 cannot detect it; for the glitch located in the second half of the original low level of the oscillation signal Part and the first half of the high level, Detector2 can detect it, but Detector1 cannot detect it. Therefore, Detector1 and Detector2 are used in the electromagnetic attack detector at the same time, and their output signals are ORed to obtain the final alarm signal, so that all the glitches at different relative positions to the original oscillation signal can be detected, ensuring the detection rate. .

5. Sensitivity of detection structure in practical use

According to the analysis of the above principles, in order to improve the sensitivity of the detection structure in actual use, it is necessary that when the power supply voltage changes due to electromagnetic fault injection attacks, the greater the change in the output frequency of the ring oscillator, the better, so that the output oscillation signal A burr is generated to facilitate detection by the combinational logic delay comparison structure later. According to the frequency formula of the ring oscillator output signal, the change of frequency relative to the supply voltage is:

$\frac{{\mathrm{<span\; class="notranslate">\; \&Delta;f</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}}{{\mathrm{<span\; class="notranslate">\; \&Delta;V</span>}}_{\mathrm{<span\; class="notranslate">\; D.</span>}\mathrm{<span\; class="notranslate">\; D.</span>}}}<span\; class="notranslate">\; =</span>\frac{{\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; f</span>}\mathrm{<span\; class="notranslate">\; f</span>}}{\mathrm{<span\; class="notranslate">\; W</span>}}_{\mathrm{<span\; class="notranslate">\; e</span>}\mathrm{<span\; class="notranslate">\; f</span>}\mathrm{<span\; class="notranslate">\; f</span>}}{\mathrm{<span\; class="notranslate">\; C</span>}}_{\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; x</span>}}}{\mathrm{<span\; class="notranslate">\; 16</span>}{\mathrm{<span\; class="notranslate">\; \&eta;NLq</span>}}_{\mathrm{<span\; class="notranslate">\; max</span>}}}$

Therefore, in actual use, the sensitivity can be improved by increasing the channel width W _eff of the transistor and reducing the number N of transistors of the inverter.

If the electromagnetic interference signal is weak, so that the change of the power supply voltage is small enough to be detected by the detector, since the attack at this time also cannot cause circuit operation errors, it is not necessary to consider this situation.

6. Use the core detection structure to build the overall detection structure of the circuit

As shown in Figure 6, it is a schematic diagram of the final detection structure realized by embedding the core detection structure (electromagnetic attack detector) in the original circuit.

The outermost box in the figure represents the entire circuit chip, the hollow box in the lower right corner represents the core sensitive unit in the circuit (such as the S box of the AES encryption module), and the remaining black solid boxes represent the above-mentioned electromagnetic attack detectors. Before use, it is first necessary to debug the combined logic delay modules D1 and D2 of the detector so that the delay is equal to 3/4 of the period of the ring oscillator output signal. Then, according to the circuit area and safety requirements, a certain number of the detectors are embedded in the original circuit. For example, when the area of the circuit chip is sufficient and the safety requirements are high, a certain number of detectors can be embedded.

In order to achieve the best effect, it is necessary to keep the area small and have enough safety, so that the detector layout can be selectively carried out. For the core sensitive module, the layout of the detector is relatively dense, and for the rest of the circuit, the layout of the detector can be relatively loose.

A specific example of the present invention is shown in Figure 6, before using, determine the core sensitive unit of the circuit (the location where the attacker is most likely to attack), and then according to these three parameters of the overall circuit area, the circuit vacant area and the required chip security degree Determine the number of required electromagnetic attack detectors, distribute them evenly in the original circuit, and then appropriately increase a certain number of electromagnetic attack detectors to be embedded in the core sensitive unit. The scope of protection of the present invention is not limited to the above-mentioned embodiments, and equivalent modifications or changes made by those skilled in the art based on the content disclosed in the present invention should be included in the scope of protection.

Claims (4)

1. A detector for integrated circuit detection electromagnetic fault injection attack is characterized in that the structure is: A1, A2, A3, A4, A5 are 5 inverters, cascaded to form a ring oscillator, and the ring oscillator is passed through One way of the oscillation signal buffered by the inverter B is directly input to the combinational logic delay comparison structure Detector1, and the other way is input to another combinational logic delay comparison structure Detector2 through the reverse of the inverter C; to realize the delay Functional combinational logic D1 and trigger E1 form Detector1, combinational logic D2 and trigger E2 form Detector2; the input signals of the two Detectors are connected to the trigger input of the Detector; the input signals of the two Detectors pass through the Detector The combinational logic is output to the trigger clock input of the Detector; the outputs of the two Detectors pass through an OR gate F to obtain the final alarm signal Alarm. 2. be used for integrated circuit detection electromagnetic fault injection attack detector as claimed in claim 1, it is characterized in that, by increasing the channel width W _eff of the transistor in the inverter in the ring oscillator, reduce the frequency of the inverter Transistor number N to increase sensitivity. 3. A detection method for integrated circuit detection electromagnetic fault injection attack, characterized in that, for integrated circuit detection electromagnetic fault injection attack detection method, realized by means of the aforementioned detector, and includes the following steps, at first to the combined logic of the detector The delay modules D1 and D2 are debugged so that the delay is equal to 3/4 of the cycle of the ring oscillator output signal; then according to the circuit area and safety requirements, a certain number of detectors are embedded between the integrated circuits to be protected middle. 4. The method for detecting electromagnetic fault injection attack detection for integrated circuits as claimed in claim 3, characterized in that, for the core sensitive modules in the integrated circuits that need to be protected, the layout of the detectors is relatively dense, and for the rest of the circuit, the detection The layout of the device is relatively loose.