CN107818271A - Direct fault location analysis method and system based on chip layout - Google Patents
Direct fault location analysis method and system based on chip layout Download PDFInfo
- Publication number
- CN107818271A CN107818271A CN201610826655.3A CN201610826655A CN107818271A CN 107818271 A CN107818271 A CN 107818271A CN 201610826655 A CN201610826655 A CN 201610826655A CN 107818271 A CN107818271 A CN 107818271A
- Authority
- CN
- China
- Prior art keywords
- chip
- fault location
- measured
- direct fault
- susceptibility
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000004458 analytical method Methods 0.000 title claims abstract description 50
- 230000001235 sensitizing effect Effects 0.000 claims abstract description 56
- 238000007405 data analysis Methods 0.000 claims abstract description 7
- 238000000034 method Methods 0.000 claims abstract description 5
- 238000002347 injection Methods 0.000 claims description 13
- 239000007924 injection Substances 0.000 claims description 13
- 239000000463 material Substances 0.000 claims description 6
- 230000004069 differentiation Effects 0.000 claims description 4
- 239000003550 marker Substances 0.000 claims description 4
- 238000010586 diagram Methods 0.000 description 6
- 239000000523 sample Substances 0.000 description 5
- 230000035945 sensitivity Effects 0.000 description 5
- 230000004888 barrier function Effects 0.000 description 3
- 230000005855 radiation Effects 0.000 description 3
- CSCPPACGZOOCGX-UHFFFAOYSA-N Acetone Chemical compound CC(C)=O CSCPPACGZOOCGX-UHFFFAOYSA-N 0.000 description 2
- NBIIXXVUZAFLBC-UHFFFAOYSA-N Phosphoric acid Chemical compound OP(O)(O)=O NBIIXXVUZAFLBC-UHFFFAOYSA-N 0.000 description 2
- 230000002159 abnormal effect Effects 0.000 description 2
- 230000008859 change Effects 0.000 description 2
- 230000005684 electric field Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000007613 environmental effect Effects 0.000 description 2
- 239000003822 epoxy resin Substances 0.000 description 2
- 230000007257 malfunction Effects 0.000 description 2
- 230000036651 mood Effects 0.000 description 2
- 229920000647 polyepoxide Polymers 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- GRYLNZFGIOXLOG-UHFFFAOYSA-N Nitric acid Chemical compound O[N+]([O-])=O GRYLNZFGIOXLOG-UHFFFAOYSA-N 0.000 description 1
- 229910000147 aluminium phosphate Inorganic materials 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000006243 chemical reaction Methods 0.000 description 1
- 230000001010 compromised effect Effects 0.000 description 1
- 238000012938 design process Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000005611 electricity Effects 0.000 description 1
- 238000005538 encapsulation Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 230000002045 lasting effect Effects 0.000 description 1
- 229910017604 nitric acid Inorganic materials 0.000 description 1
- 238000002161 passivation Methods 0.000 description 1
- 238000002360 preparation method Methods 0.000 description 1
- 230000009993 protective function Effects 0.000 description 1
- 238000007619 statistical method Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
- G06F21/77—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in smart cards
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F30/00—Computer-aided design [CAD]
- G06F30/30—Circuit design
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
- Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
- Y02P90/30—Computing systems specially adapted for manufacturing
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Evolutionary Computation (AREA)
- Geometry (AREA)
- Tests Of Electronic Circuits (AREA)
Abstract
The invention discloses a kind of direct fault location analysis method and system based on chip layout.This method includes：Obtain the chip layout of chip to be measured；Selection area on chip to be measured carries out direct fault location；Service data of the chip to be measured under direct fault location state is acquired；According to the state of the Operational Data Analysis of collection chip to be measured, and then judge susceptibility of the selection area to direct fault location；Corresponding region making a distinction mark according to susceptibility to chip layout.Through the above way, layout analysis is combined with direct fault location analysis, and to the susceptibility difference of direct fault location, the making a distinction on domain marks according to different chip areas, and then being capable of preferably fast positioning sensitizing range, and guiding assessment intuitively can be carried out to chip protection Design.
Description
Technical field
The present invention relates to chip secure field, more particularly to a kind of direct fault location analysis method based on chip layout and it is
System.
Background technology
As EMV migrated, the lasting propulsion of domestic Golden Card Program, financial IC card (bank IC card, financial social security card etc.) are put
Amount and the popularization of mobile payment, market is increasing to the demand of intelligent card chip, and intelligent card chip industry enters quick increase
For a long time.However, becoming increasingly popular with smart card, is also developing for the various attack technologies of smart card.For financial IC card
For, security is a vital ring, how in chip checking stage accurate positioning chip sensitizing range, so as to ensure
Key protection when chip designs, ensures that the sensitive information of chip is not compromised, is to need emphasis in financial IC chip design process
The problem of consideration.
In cryptanalysis, channelization codes analysis in side for safety chip with including three kinds of attack patterns：Non-intrusion type is attacked
Hit, half intrusive mood attack and intrusive mood attack, it can be implemented effectively to attack and crack.
Direct fault location is a kind of half invasive attack, and its Attack Theory is by changing the ambient parameter (electrical property of chip
To change with the change in the magnetic field of different voltage, temperature, light, ionising radiation and surrounding), to attempt the journey in chip
Some misdeeds are introduced in sequence logic, bring chip into a uncertain running status, program circuit is such as upset or makes calculation
Method result malfunctions, and in this state chip is implemented to attack.The implementation cost of direct fault location is not high, but success attack rate
It is higher, great security threat is constituted to chip.Conventional direct fault location means have a lot, including abnormal voltage, frequency,
The environmental factors such as temperature, radiation, light, vortex flow, also including voltage glitch attack, local light attack, electromagnetically-operated attack etc..
In safety chip at this stage, maximally effective fault injection attacks means are injected for laser, are noted for laser fault
Enter to say, chip does positive protection relatively easily, can easier protect the front of chip to be attacked, but be directed to
The attack of chip back but protects difficulty very big, and on the premise of considering cost, this requires designer to be protected in design
How targetedly key protection during scheme, accomplish sensitizing range key protection, it is necessary to which in the chip checking stage, prepare to orient
The sensitizing range of chip, so as to avoid the redundancy of protectiving scheme.
In view of this, there is an urgent need to a kind of side for the sensitizing range and de-militarized zone that can effectively distinguish chip in the industry
Case.
The content of the invention
The present invention provides a kind of direct fault location analysis method and system based on chip layout, to realize the difference to chip
The fast positioning of sensitivity regions.
In order to solve the above technical problems, one aspect of the present invention is to provide a kind of event based on chip layout
Barrier injection analysis method, including：Obtain the chip layout of chip to be measured；Selection area on chip to be measured carries out failure note
Enter；Service data of the chip to be measured under direct fault location state is acquired；According to the Operational Data Analysis of collection core to be measured
The state of piece, and then judge susceptibility of the selection area to direct fault location；The corresponding region of chip layout is entered according to susceptibility
Row area differentiation marker.
Wherein, before the step of selection area on chip to be measured carries out direct fault location, further comprise：To core to be measured
Service data of the piece under fault-free injection state is acquired, to obtain the operation curve of chip to be measured；According to operation curve
Determine the operation material time point of chip to be measured；The step being acquired to service data of the chip to be measured under direct fault location state
Suddenly include：Service data of the chip to be measured under direct fault location state is acquired in operation material time point.
Wherein, the step of being marked according to susceptibility to the making a distinction of corresponding region of chip layout includes：According to sensitivity
The sensitizing range of chip to be measured is marked on chip layout for degree.
Wherein, included according to susceptibility the sensitizing range of chip to be measured is marked on chip layout the step of：
The sensitive parameter of the sensitizing range of chip to be measured is marked on chip layout.
Wherein, included according to susceptibility the sensitizing range of chip to be measured is marked on chip layout the step of：Root
Different the making a distinction of sensitizing range of chip to be measured are marked on chip layout according to susceptibility.
Wherein, different sensitizing ranges include at least two combination in error region, reset region and alarm region.
Wherein, the step of being marked according to susceptibility to the making a distinction of corresponding region of chip layout further comprises：Root
According to susceptibility the de-militarized zone of chip to be measured is marked on chip layout, wherein de-militarized zone and sensitizing range
Mark is different.
Wherein, chip layout is the back side domain of chip to be measured, and the selection area on chip to be measured carries out direct fault location
The step of include：Selection area on the back side of chip to be measured carries out direct fault location.
In order to solve the above technical problems, one aspect of the present invention is to provide a kind of event based on chip layout
Barrier injection analysis system, including：Work station, for obtaining and showing the chip layout of chip to be measured；Direct fault location platform, is used for
Selection area on chip to be measured carries out direct fault location；Data acquisition device, for chip to be measured in direct fault location state
Under service data be acquired；Work station judges selected according to the state of the Operational Data Analysis chip to be measured of collection
Region is to the susceptibility of direct fault location, further corresponding region the making a distinction mark according to susceptibility to chip layout of work station
Note.
Wherein, further the sensitizing range of chip to be measured is marked on chip layout according to susceptibility for work station.
Wherein, further the sensitive parameter of the sensitizing range of chip to be measured is marked in chip layout for work station.
Wherein, work station further according to susceptibility on chip layout to the different sensitizing range carry out areas of chip to be measured
Differentiation marker.
Wherein, different sensitizing ranges include at least two combination in error region, reset region and alarm region.
Wherein, work station further enters rower on chip layout according to susceptibility to the de-militarized zone of chip to be measured
Note, wherein de-militarized zone are different with the mark of sensitizing range.
Wherein, chip layout be chip to be measured back side domain, choosing of the direct fault location platform on the back side of chip to be measured
Determine region and carry out direct fault location.
The beneficial effect of direct fault location analysis method and system provided by the invention based on chip layout includes：By domain
Analysis is combined with direct fault location analysis, and the susceptibility difference of direct fault location is carried out on domain according to different chip areas
Area's differentiation marker, and then being capable of preferably fast positioning sensitizing range, and intuitively can instructing chip protection Design
Property assess.The region different to susceptibility carries out the different protection of intensity, avoids the burden addition in chip non-sensitive positions anti-
The drawbacks of protective function, reduce cost.
Brief description of the drawings
Technical scheme in order to illustrate the embodiments of the present invention more clearly, make required in being described below to embodiment
Accompanying drawing is briefly described, it should be apparent that, drawings in the following description are only some embodiments of the present invention, for
For those of ordinary skill in the art, on the premise of not paying creative work, other can also be obtained according to these accompanying drawings
Accompanying drawing, wherein：
Fig. 1 is the flow chart according to the direct fault location analysis method of the first embodiment of the present invention；
Fig. 2 is the schematic diagram of chip layout used in direct fault location analysis method shown in Fig. 1；
Fig. 3 is the schematic diagram of the first mark mode of the chip layout shown in Fig. 2；
Fig. 4 is the schematic diagram of second of mark mode of the chip layout shown in Fig. 2；
Fig. 5 is the schematic diagram of the third mark mode of the chip layout shown in Fig. 2；
Fig. 6 is the schematic block diagram according to the direct fault location analysis system of the second embodiment of the present invention.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out clear, complete
Site preparation describes, it is clear that described embodiment is only the part of the embodiment of the present invention, rather than whole embodiments.It is based on
Embodiment in the present invention, those of ordinary skill in the art are obtained every other under the premise of creative work is not made
Embodiment, belong to the scope of protection of the invention.
Embodiments of the invention are discussed in detail below in conjunction with the accompanying drawings.
Reference picture 1, Fig. 1 are the flow chart according to the direct fault location analysis method of the first embodiment of the present invention.This implementation
The direct fault location analysis method of example comprises the following steps：
Step 101, the chip layout of chip to be measured is obtained；
Step 102, the selection area on chip to be measured carries out direct fault location；
Step 103, service data of the chip to be measured under direct fault location state is acquired；
Step 104, according to the state of the Operational Data Analysis chip to be measured of collection, and then judge that selection area is noted to failure
The susceptibility entered；
Step 105, corresponding region the making a distinction mark according to susceptibility to chip layout；
Step 106, judge whether that analysis finishes, if analysis finishes, into step 107, finish, enter if not analyzing
Step 108；
Step 107, analysis process is terminated；
Step 108, other direct fault location regions, and return to step 102 are selected, is achieved in multiple regions of chip
Analysis.
By the above-mentioned means, layout analysis is combined with direct fault location analysis, and according to different chip areas to failure
The susceptibility difference of injection making a distinction on domain marks, so can more preferable fast positioning sensitizing range, and can be with
Guiding assessment intuitively is carried out to chip protection Design.
Above-mentioned steps are described in detail below in conjunction with specific embodiment, it is notable that in subsequent embodiment
In be described in detail by taking chip back as an example, i.e., chip layout selection for chip to be measured back side domain, while in core to be measured
Selection area on the back side of piece carries out direct fault location.But those skilled in the art after reading the present invention by being fully contemplated that
Above-mentioned analysis method is applied to the other positions of chip.
In a step 101, to obtain the back side domain of chip, it is necessary to carry out back side process to chip, i.e., chip is carried out
Encapsulation operation is gone, processing of delaminating is carried out to chip back.In preferable processing mode, chip is dropped in the concentrated nitric acid of heat first
The back side corresponds to the region of epoxy resin surface, and epoxy resin is corroded, and exposes nude film (die)；Then, nude film is removed with hot phosphoric acid
The passivation layer on surface；Then, with acetone rinsing residue, and chip is cleaned with ultrasonic wave, and then completes processing of delaminating.
Subsequently, the chip layout after processing of delaminating further is obtained, and domain processing is carried out to chip layout.For example, will
The original chip domain of acquisition carries out gray processing processing, forms gray scale chip layout, specifically can be as shown in Figure 2.
In a step 102, conventional direct fault location means have a lot, including abnormal voltage, frequency, temperature, radiation,
The environmental factors such as light, vortex flow, also including voltage glitch attack, local light attack, electromagnetically-operated attack etc..In subsequent embodiment
In, it is described in detail so that laser fault injects as an example, but those skilled in the art by that can think completely after reading the present invention
Direct fault location is realized to using any one direct fault location means above-mentioned or well known in the art or combination.
In step 103, outer meeting resistance, probe, coil etc. are preferably coordinated by wave filter or other data acquisition devices
Sensor is acquired to service data of the chip to be measured under direct fault location state.The data gathered can be with electric current, electricity
Any data that can reflect chip running status such as pressure, electric field, magnetic field.Wherein, when use probe mode carries out data acquisition
When, the common-denominator target cabling of chip internal to be measured can be directly detected (for example, power branch cabling and cryptochannel using probe
Signal lead) on service data.For example, by setting opening that probe is overlapped on into common-denominator target cabling on chip to be measured
To obtain voltage or current signal, or probe believed close to chip surface to obtain electric field on common-denominator target cabling or magnetic field
Number.
In addition, in a preferred embodiment, before step 103, in advance to chip to be measured under fault-free injection state
Service data be acquired, to obtain the operation curve of chip to be measured (for example, power curve), and determined according to operation curve
The operation material time point of chip to be measured.Thus, in step 103, it is only necessary in above-mentioned operation material time point to chip to be measured
Service data under direct fault location state is acquired.
At step 104, to judge whether chip occurs running under direct fault location state according to the service data of collection different
Often, if there is operation exception, then it is assumed that direct fault location region is sensitizing range, and if chip remains to normal operation, for failure
Injection zone is de-militarized zone.In a preferred embodiment, can during direct fault location, by changing direct fault location parameter,
And multigroup service data of different faults injection parameter is obtained to carry out statistical analysis, and finally determine the quick of direct fault location region
Sensitivity.If for example, under multiple direct fault location parameters, chip remains to normal operation, then is non-sensitive area for direct fault location region
Domain, and under a certain or several specific fault injection parameters, there is operation exception in chip, then it is assumed that direct fault location region is sensitivity
Region.Now, the sensitive parameter in direct fault location region is preferably recorded, i.e., the failure effectively attacked is realized to direct fault location region
Injection parameter (for example, laser power etc.).
In addition, can occur the type of operation exception according to chip to the further division in sensitizing range, such as operation exception can
So that chip reset and alarm etc. are malfunctioned, occurred including operation result, now sensitizing range can be further divided into the area that malfunctions
Domain, reset region and alarm region.
In step 105, preferably according to direct fault location region to the susceptibility of direct fault location on chip layout to be measured
The sensitizing range of chip is marked.Specifically, when in step 104, if judging, exception occurs in chip operation, in chip version
Figure Shang pair position corresponding with current failure injection zone is marked.And then carried out with the circulation of above-mentioned flow, can be in core
Multiple similar marks are shown on piece domain, the sensitizing range of chip to be measured thus can intuitively be presented by chip layout, specifically
As shown in Figure 3.Wherein, " △ " mark represents the sensitizing range of chip to be measured.It is, of course, also possible to to be measured on chip layout
The sensitive parameter of the sensitizing range of chip is marked, and thus technical staff can also intuitively be obtained each quick by chip layout
Effective attack meanses corresponding to sensillary area domain.
Further, different sensitizing ranges can effectively be distinguished according to the running status of chip in step 104
In the case of, different the making a distinction of sensitizing range of chip to be measured can also be marked in chip layout, that is, utilize different marks
Remember to represent different sensitizing ranges, it is specific as shown in Figure 4.The sensitizing range that chip layout is marked can with it is above-described go out
At least two combination in wrong region, reset region and alarm region.For example, in Fig. 4, " △ " mark represents core to be measured
The error region of piece, "○" mark represent the reset region of chip to be measured, and " ▽ " mark represents the alarm region of chip to be measured.
Further, it is also possible to the de-militarized zone of chip to be measured is marked on chip layout according to susceptibility, and it is non-
Sensitizing range is different with the mark of sensitizing range, specific as shown in Figure 5.For example, in Figure 5, " △ " mark represents chip to be measured
Error region, "○" mark represents the reset region of chip to be measured, and " ▽ " mark represents the alarm region of chip to be measured, above-mentioned
Three kinds of marks are corresponding to the sensitizing range of chip to be measured, the de-militarized zone of " " mark expression chip to be measured.
By the above-mentioned means, technical staff can intuitively distinguish sensitizing range and the Fei Min of chip to be measured by chip layout
Sensillary area domain, or even it is to discriminate between different sensitizing ranges so that follow-up attack and protection Design can shoot the arrow at the target.
In step 106, judge whether to have stepped through the whole back side or the presumptive area of chip to be measured, treated if having stepped through
Survey the whole back side or the presumptive area of chip, then it is assumed that analysis finishes, and enters step 107, if non-detection zone also be present,
Into step 108, and then reselect direct fault location region and re-execute above-mentioned flow.
Reference picture 6, Fig. 6 are the schematic block diagram according to the direct fault location analysis system of the second embodiment of the present invention.This reality
Applying the direct fault location analysis system of example includes work station 61, direct fault location platform 62 and data acquisition device 63.
In the present embodiment, work station 61 is used to obtain and show the chip layout of chip 60 to be measured, direct fault location platform
62 selection areas being used on chip 60 to be measured carry out direct fault location, and data acquisition device 63 is used for chip 60 to be measured in event
Service data under barrier injection state is acquired.Its work station 61 is according to the shape of the Operational Data Analysis chip 60 to be measured of collection
State, and then judge susceptibility of the selection area to direct fault location, further pair according to susceptibility to chip layout of work station 61
Answer region making a distinction mark.In a preferred embodiment, chip layout can be the back side domain of chip 60 to be measured, failure
Inject selection area of the platform 62 on the back side of chip 60 to be measured and carry out direct fault location.But those skilled in the art pass through reading
It is fully contemplated that carrying out direct fault location analysis to the other positions of chip using said system after the present invention.
In a preferred embodiment, work station 61 enters according to susceptibility on chip layout to the sensitizing range of chip to be measured
Line flag, and preferably further the sensitive parameter of the sensitizing range of chip to be measured is marked in chip layout for work station 61.
In another preferred embodiment, work station 61 further according to susceptibility on chip layout to chip to be measured
Different making a distinction of sensitizing range marks.The different sensitizing ranges are included in error region, reset region and alarm region
At least two combination.
In another preferred embodiment, work station 61 further according to susceptibility on chip layout to chip to be measured
De-militarized zone is marked, and wherein de-militarized zone is different with the mark of sensitizing range.
The concrete operations flow and specific implementation of said elements combination Fig. 1 above direct fault location analysis
It is described in detail, will not be repeated here in method.
Layout analysis is combined by the embodiment of the present invention with direct fault location analysis, and failure is noted according to different chip areas
The susceptibility difference entered making a distinction on domain marks, and then being capable of preferably fast positioning sensitizing range, and can be straight
That sees carries out guiding assessment to chip protection Design.For example, the region different to sensitivity carries out the different protection of intensity,
Burdensome the drawbacks of adding safeguard function in chip non-sensitive positions is avoided, reduces cost.In addition, further marked on domain
The sensitive parameter of the sensitizing range of chip, sensitizing range can be not only shown in layout analysis, and can shown most effective
Attack parameter, display analysis is carried out to attack parameter, the parameter of efficiently selected direct fault location.In addition, under black box attack, pass through
Above-mentioned direct fault location analysis method and system, the sensitizing range related to algorithm operating can be positioned with high probability, inversely goes out chip
Main functional areas (such as physical location of the physical location of algoritic module, CPU physical location and memory cell etc. letter
Breath).
Embodiments of the invention are the foregoing is only, are not intended to limit the scope of the invention, it is every to utilize this hair
The equivalent structure or equivalent flow conversion that bright specification and accompanying drawing content are made, or directly or indirectly it is used in other related skills
Art field, is included within the scope of the present invention.
Claims (15)
1. a kind of direct fault location analysis method based on chip layout, it is characterised in that methods described includes：
Obtain the chip layout of chip to be measured；
Selection area on the chip to be measured carries out direct fault location；
Service data of the chip to be measured under direct fault location state is acquired；
The state of chip to be measured according to the Operational Data Analysis of collection, and then judge the selection area to direct fault location
Susceptibility；
Corresponding region making a distinction mark according to susceptibility to the chip layout.
2. direct fault location analysis method according to claim 1, it is characterised in that the choosing on the chip to be measured
Before determining the step of region carries out direct fault location, further comprise：
Service data of the chip to be measured under fault-free injection state is acquired, to obtain the fortune of the chip to be measured
Row curve；
The operation material time point of the chip to be measured is determined according to the operation curve；
Described the step of being acquired to service data of the chip to be measured under direct fault location state, includes：
Service data of the chip to be measured under direct fault location state is acquired in the operation material time point.
3. direct fault location analysis method according to claim 1, it is characterised in that it is described according to susceptibility to the chip
The step of corresponding region making a distinction mark of domain, includes：
The sensitizing range of the chip to be measured is marked on the chip layout according to the susceptibility.
4. direct fault location analysis method according to claim 3, it is characterised in that it is described according to the susceptibility described
The step of sensitizing range of the chip to be measured is marked on chip layout includes：
The sensitive parameter of the sensitizing range of the chip to be measured is marked on the chip layout.
5. direct fault location analysis method according to claim 3, it is characterised in that it is described according to the susceptibility described
The step of sensitizing range of the chip to be measured is marked on chip layout includes：
Different the making a distinction of sensitizing range of the chip to be measured are marked on the chip layout according to the susceptibility.
6. direct fault location analysis method according to claim 5, it is characterised in that the different sensitizing ranges include error
At least two combination in region, reset region and alarm region.
7. direct fault location analysis method according to claim 3, it is characterised in that it is described according to susceptibility to the chip
The step of corresponding region making a distinction mark of domain, further comprises：
The de-militarized zone of the chip to be measured is marked on the chip layout according to the susceptibility, wherein described
De-militarized zone is different with the mark of the sensitizing range.
8. direct fault location analysis method according to claim 1, it is characterised in that the chip layout is the core to be measured
The back side domain of piece, it is described to include in the step of selection area progress direct fault location on the chip to be measured：Described to be measured
Selection area on the back side of chip carries out direct fault location.
9. a kind of direct fault location analysis system based on chip layout, it is characterised in that the system includes：
Work station, for obtaining and showing the chip layout of chip to be measured；
Direct fault location platform, direct fault location is carried out for the selection area on the chip to be measured；
Data acquisition device, for being acquired to service data of the chip to be measured under direct fault location state；
Wherein, the state of work station chip to be measured according to the Operational Data Analysis of collection, and then judge described selected
Region is to the susceptibility of direct fault location, and the work station is further according to corresponding region progress of the susceptibility to the chip layout
Area's differentiation marker.
10. direct fault location analysis system according to claim 9, it is characterised in that the work station is further according to institute
Susceptibility is stated the sensitizing range of the chip to be measured is marked on the chip layout.
11. direct fault location analysis system according to claim 10, it is characterised in that the work station is further described
The sensitive parameter of the sensitizing range of the chip to be measured is marked chip layout.
12. direct fault location analysis system according to claim 10, it is characterised in that the work station is further according to institute
Susceptibility is stated to mark different the making a distinction of sensitizing range of the chip to be measured on the chip layout.
13. direct fault location analysis system according to claim 12, it is characterised in that the different sensitizing ranges include
At least two combination in wrong region, reset region and alarm region.
14. direct fault location analysis system according to claim 10, it is characterised in that the work station is further according to institute
State susceptibility the de-militarized zone of the chip to be measured is marked on the chip layout, wherein the de-militarized zone
It is different with the mark of the sensitizing range.
15. direct fault location analysis system according to claim 9, it is characterised in that the chip layout is described to be measured
The back side domain of chip, selection area of the direct fault location platform on the back side of the chip to be measured carry out direct fault location.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610826655.3A CN107818271B (en) | 2016-09-14 | 2016-09-14 | Fault injection analysis method and system based on chip layout |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610826655.3A CN107818271B (en) | 2016-09-14 | 2016-09-14 | Fault injection analysis method and system based on chip layout |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107818271A true CN107818271A (en) | 2018-03-20 |
| CN107818271B CN107818271B (en) | 2023-08-29 |
Family
ID=61600796
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610826655.3A Active CN107818271B (en) | 2016-09-14 | 2016-09-14 | Fault injection analysis method and system based on chip layout |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107818271B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116681015A (en) * | 2023-08-03 | 2023-09-01 | 苏州国芯科技股份有限公司 | Chip design method, device, equipment and storage medium |
| CN119199484A (en) * | 2024-11-21 | 2024-12-27 | 北京智慧云测设备技术有限公司 | A Fault Sensitivity Calculation Method Based on Voltage Glitch |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6484276B1 (en) * | 1999-10-25 | 2002-11-19 | Lucent Technologies Inc. | Method and apparatus for providing extensible object-oriented fault injection |
| JP2006120793A (en) * | 2004-10-20 | 2006-05-11 | Iwate Toshiba Electronics Co Ltd | Wafer marking system and failure chip marking method |
| CN102222032A (en) * | 2011-05-20 | 2011-10-19 | 哈尔滨工业大学 | Device and method for fault injection of 1394 bus |
| CN102750216A (en) * | 2012-03-01 | 2012-10-24 | 浙江吉利汽车研究院有限公司 | Fault injection system for intelligent bus |
| CN203141798U (en) * | 2012-12-30 | 2013-08-21 | 宁波弘讯科技股份有限公司 | Fault early warning system of injection molding machine |
| US20150108606A1 (en) * | 2013-10-22 | 2015-04-23 | Commissariat A L'energie Atomique Et Aux Ene Alt | Electronic chip with means of protecting its back face |
| CN104881618A (en) * | 2014-12-31 | 2015-09-02 | 中国科学院深圳先进技术研究院 | Method and system for quantitatively evaluating safety of safety chips |
| CN105095750A (en) * | 2014-05-15 | 2015-11-25 | 国民技术股份有限公司 | Method and device for analyzing attack on smart card chip |
-
2016
- 2016-09-14 CN CN201610826655.3A patent/CN107818271B/en active Active
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6484276B1 (en) * | 1999-10-25 | 2002-11-19 | Lucent Technologies Inc. | Method and apparatus for providing extensible object-oriented fault injection |
| JP2006120793A (en) * | 2004-10-20 | 2006-05-11 | Iwate Toshiba Electronics Co Ltd | Wafer marking system and failure chip marking method |
| CN102222032A (en) * | 2011-05-20 | 2011-10-19 | 哈尔滨工业大学 | Device and method for fault injection of 1394 bus |
| CN102750216A (en) * | 2012-03-01 | 2012-10-24 | 浙江吉利汽车研究院有限公司 | Fault injection system for intelligent bus |
| CN203141798U (en) * | 2012-12-30 | 2013-08-21 | 宁波弘讯科技股份有限公司 | Fault early warning system of injection molding machine |
| US20150108606A1 (en) * | 2013-10-22 | 2015-04-23 | Commissariat A L'energie Atomique Et Aux Ene Alt | Electronic chip with means of protecting its back face |
| CN105095750A (en) * | 2014-05-15 | 2015-11-25 | 国民技术股份有限公司 | Method and device for analyzing attack on smart card chip |
| CN104881618A (en) * | 2014-12-31 | 2015-09-02 | 中国科学院深圳先进技术研究院 | Method and system for quantitatively evaluating safety of safety chips |
Non-Patent Citations (1)
| Title |
|---|
| 张英武;袁国顺;: "微处理器故障注入工具与故障敏感度分析", 半导体技术, no. 07, pages 42 - 44 * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116681015A (en) * | 2023-08-03 | 2023-09-01 | 苏州国芯科技股份有限公司 | Chip design method, device, equipment and storage medium |
| CN116681015B (en) * | 2023-08-03 | 2023-12-22 | 苏州国芯科技股份有限公司 | Chip design method, device, equipment and storage medium |
| CN119199484A (en) * | 2024-11-21 | 2024-12-27 | 北京智慧云测设备技术有限公司 | A Fault Sensitivity Calculation Method Based on Voltage Glitch |
| CN119199484B (en) * | 2024-11-21 | 2025-03-07 | 北京智慧云测设备技术有限公司 | Fault sensitivity calculation method based on voltage glitch |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107818271B (en) | 2023-08-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Wang et al. | Probing attacks on integrated circuits: Challenges and research opportunities | |
| Rahman et al. | The key is left under the mat: On the inappropriate security assumption of logic locking schemes | |
| CN104391784B (en) | Method and device for fault injection attack based on simulation | |
| Van Woudenberg et al. | Practical optical fault injection on secure microcontrollers | |
| CN102375941B (en) | Method and system for validating chip validity by utilizing graphical chip | |
| CN101512660B (en) | Circuit device and circuit | |
| CN112818422B (en) | Integrated circuit with electromagnetic fault injection protection | |
| Asadizanjani et al. | Physical assurance | |
| KR20100053501A (en) | Integrated circuit protection and detection grid | |
| US10135239B2 (en) | Integrated circuit chip protection against physical and/or electrical alterations | |
| CN101950332A (en) | Chip protecting method and system | |
| CN1617654A (en) | An anti-interference circuit board design and related programs and storage media | |
| CN107818271A (en) | Direct fault location analysis method and system based on chip layout | |
| CN106095462A (en) | A kind of embedded distribution system program configuration version management method | |
| JP4462903B2 (en) | Semiconductor wafer | |
| CN105160274A (en) | User data protection method and terminal | |
| Thomas-Brans et al. | New diagnostic forensic protocol for damaged secure digital memory cards | |
| CN105023912B (en) | Semiconductor wafer and its method of testing | |
| Asadizanjani et al. | Physical inspection and attacks: An overview | |
| CN114928500B (en) | Attack detection method and device for data injection enabled power grid network parameters | |
| CN103839322B (en) | Intelligent card, verification data output method, operation request response method and system | |
| Tanjidur Rahman et al. | Failure Analysis for Hardware Assurance and Security | |
| CN104865270A (en) | Method for detecting hardware trojan based on passive optical watermark | |
| CN104217330A (en) | Anti-attack PIN (Personal Identification Number) code protection method | |
| CN1333316C (en) | Multi layer gridding detector of chip, and method for anti attack |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |