Method for detecting a differential fault analysis attack and a thinning of the substrate in an integrated circuit, and associated integrated circuit

Abstract

An integrated circuit includes a semiconductor substrate having a rear face. A first semiconductor well within the substrate includes circuit components. A second semiconductor well within the substrate is insulated from the first semiconductor well and the rest of the substrate. The second semiconductor well provides a detection device that is configurable and designed, in a first configuration, to detect a thinning of the substrate via its rear face, and in a second configuration, to detect a DFA attack by fault injection into the integrated circuit.

Claims

1. A method for detecting an attack on an integrated circuit, where the integrated circuit includes: a first semiconductor well within a semiconductor substrate having a rear face, the first semiconductor well comprising circuit components; and a second semiconductor well within said semiconductor substrate, the second semiconductor well insulated from the first semiconductor well and from a rest of the semiconductor substrate; wherein the second semiconductor well includes a PN junction; the method comprising: detecting of a thinning of the semiconductor substrate via the rear face by a detection of an absence of a current flowing in the second semiconductor well in response to an applied bias, and detecting a Differential Fault Analysis (DFA) attack initiated by application of a laser radiation to the semiconductor substrate, where there is no detection of the thinning of the semiconductor substrate, by a detection of a photocurrent flowing in the second semiconductor well, wherein said photocurrent is generated by said PN junction in response to said laser radiation and in the absence of the applied bias.

2. The method of claim 1, wherein the method comprises applying the bias between two terminals at the second semiconductor well and sensing current flow between the two terminals for purposes of detecting the thinning.

3. The method of claim 2, wherein method further comprises terminating application of the applied bias and sensing photocurrent flow at one of the two terminals for purposes of detecting the DFA attack.

4. An integrated circuit, comprising: a semiconductor substrate having a rear face; a first semiconductor well in the semiconductor substrate, the first semiconductor well including circuit components; a second semiconductor well in the semiconductor substrate, the second semiconductor well insulated from the first semiconductor well and from a rest of the semiconductor substrate; wherein the second semiconductor well includes a PN junction; wherein the second semiconductor well comprises a detection device that is configurable to operate, in a first configuration, to detect a thinning of the semiconductor substrate via a rear face by a detection of an absence of a current flowing in the second semiconductor well in response to an applied bias, and to operate, in a second configuration, to detect a Differential Fault Analysis (DFA) attack initiated by application of a laser radiation to the semiconductor substrate, where there is no detection of the thinning of the semiconductor substrate, through detection of a photocurrent flowing in the second semiconductor well in the absence of the applied bias, wherein said photocurrent is generate by said PN junction in response to the laser radiation.

5. The integrated circuit according to claim 4, wherein the semiconductor substrate has a front face opposite to the rear face and the detecting device comprises: a first isolation trench extending into the second semiconductor well between two locations on a periphery of the second semiconductor well, said first isolation trench having a depth from the front face that is separated by a distance from a bottom of the second semiconductor well; and a detection circuit operating in the first configuration to measure a physical quantity representative of an electrical resistance of the second semiconductor well between two contact areas respectively situated on opposite sides of the first trench, and operating in the second configuration to detect the presence of said photocurrent flowing between the two contact areas.

6. The integrated circuit according to claim 5, wherein the detection circuit comprises: a biasing circuit configured to apply a potential difference between the two contact areas; and a comparing circuit configured to measure the current flowing between the two contact areas in response to the applied potential difference.

7. The integrated circuit according to claim 6, wherein the detection circuit comprises a control circuit configured to initially place the detection device in the first configuration by enabling the biasing circuit, and to subsequently switch from the first configuration to the second configuration after a detection of a non-thinning of the semiconductor substrate.

8. The integrated circuit according to claim 7, wherein the switch comprises disabling the biasing circuit and using the comparing circuit to measure said photocurrent in the second configuration.

9. The integrated circuit according to claim 5, wherein the semiconductor substrate has a first type of conductivity, the first semiconductor well has a second type of conductivity, and the second semiconductor well has the first type of conductivity.

10. The integrated circuit according to claim 9, wherein the second semiconductor well is isolated from the first semiconductor well by a first isolation region comprising at least one isolation trench extending from the front face of the semiconductor substrate up to a first distance from the bottom of the second semiconductor well; and by the PN junction formed by the first semiconductor well and second semiconductor well.

11. The integrated circuit according to claim 9, wherein the second semiconductor well is isolated from the rest of the semiconductor substrate by a semiconductor layer of the second type of conductivity buried in the semiconductor substrate under the first semiconductor well and under the second semiconductor well; and by a second isolation region comprising: the first isolation trench; and an additional isolation trench configured for providing a continuity of electrical isolation between the isolation trench and the buried semiconductor layer.

12. The integrated circuit according to claim 5, wherein the semiconductor substrate has a first type of conductivity, the first semiconductor well has a second type of conductivity, and the second semiconductor well has the second type of conductivity.

13. The integrated circuit according to claim 12, wherein the second semiconductor well is isolated from the first semiconductor well by a first isolation region comprising: at least one isolation trench extending from the front face of the semiconductor substrate up to a first distance from the bottom of the second semiconductor well; and an additional isolation trench configured for providing a continuity of electrical isolation between the isolation trench and the bottom of the second semiconductor well.

14. The integrated circuit according to claim 13, wherein the second semiconductor well is isolated from the rest of the semiconductor substrate by a second isolation region comprising the at least one isolation trench; and by a further PN junction between the second semiconductor well and the rest of the semiconductor substrate.

15. The integrated circuit according to claim 5, wherein the first isolation trench comprises a trench filled with an insulating material.

16. The integrated circuit according to claim 5, wherein the first isolation trench comprises a trench with a central semiconductor region and an insulating envelope, said trench extending transversally within the second semiconductor well.

17. The integrated circuit according to claim 4, wherein the first semiconductor well comprises a plurality of semiconductor wells where each semiconductor well is associated with the second semiconductor well.

18. The integrated circuit according to claim 17, wherein the detection device comprises a plurality of detection devices coupled in series so as to form a chain of detection devices, wherein an input contact area of a first detection device of the chain forms a chain input contact area and an output contact area of a last detection device of the chain forms a chain output contact area.

19. The integrated circuit according to claim 18, further comprising a detection circuit operating in the first configuration to measure a physical quantity representative of an electrical resistance of the plurality of semiconductor wells between the input contact area and the output contact area, and operating in the second configuration to detect the presence of said photocurrent flowing between the chain contact area and the output contact area.

20. The integrated circuit according to claim 4, wherein the circuit components are memory circuits.

21. The integrated circuit according to claim 20, wherein the memory circuits are components of a smartcard.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) Other advantages and features of the invention will become apparent upon examining the detailed description of non-limiting embodiments of the invention, and from the appended drawings in which:

(2) FIGS. 1, 2 and 3 show different views of an integrated circuit;

(3) FIG. 4 illustrates a partial thinning of the substrate;

(4) FIGS. 5, 6 and 7 show different views of an integrated circuit;

(5) FIG. 8 illustrates a modification of the trench structure in FIGS. 5, 6 and 7;

(6) FIGS. 9, 10 and 11 show different views of an integrated circuit;

(7) FIGS. 12, 13 and 14 show different views of an integrated circuit;

(8) FIG. 15 shows an alternative implementation for the semiconductor wells; and

(9) FIG. 16 schematically shows a smart card which can incorporate the circuits of FIGS. 1-15.

DETAILED DESCRIPTION

(10) In FIG. 1, where FIG. 2 is a cross-sectional view along the line of cross-section II-II of FIG. 1, and where FIG. 3 is a cross-sectional view along the line of cross-section III-III of FIG. 1, the reference CI denotes an integrated circuit comprising a semiconductor substrate S in which several semiconductor wells are formed isolated from the rest of the substrate, of which a first well C1 and a second well C2 are shown.

(11) The substrate S has a first type of conductivity, here for example a conductivity of the P type, and the first well C1 has a second type of conductivity, here therefore for example a conductivity of the N type. The second well C2 is of the first type of conductivity, here P.

(12) The first well C1 is electrically isolated from the rest of the substrate by an isolation trench 2, bounding the edges of the first well C1 according to a rectangular shape and extending from the front face Fv of the substrate up to a first distance d1 from the bottom of the first well C1, thus defining a region 7 between the group G of at least a first trench and the bottom of the first well C1 and by the PN junction between the first well and the rest of the substrate.

(13) A buried semiconductor layer 1 of the second type of conductivity, more highly doped than the first well C1, is formed in the substrate, under the first well C1 and under the second well C2.

(14) By way of example, the buried semiconductor layer 1 here has a doping level twice as high as that of the first well C1.

(15) It would however be possible for the buried semiconductor layer 1 to be less highly doped than the first semiconductor well C1, for example half as doped.

(16) The first semiconductor well C1 comprises, for example, a plurality of transistors whose gate lines extend longitudinally over the first well, at least some of which form memory cells, and at least some of which are configured for performing encryption operations.

(17) The second well C2 is next to the first semiconductor well C1.

(18) The second well C2 is isolated from the first well C1 by a first isolation region R1 comprising a first part 21 of the isolation trench 2, and by the PN junction between the second well and the first well, and is isolated from the rest of the substrate by a second isolation region R2, and by the buried semiconductor layer 1.

(19) The second isolation region R2 comprises the first part 21 of the isolation trench 2 which bounds the edges of the second well C2, and an additional isolation trench 3 formed through the first part 21 of the isolation trench, bounding the edges of the second well C2 according to a rectangular shape, and which extends from the front face Fv as far as the buried semiconductor layer 1, in such a manner as to provide a continuity of electrical isolation between the isolation trench 2 and the buried semiconductor layer 1.

(20) The additional isolation trench 3 comprises an insulating wall 31, for example made of silicon oxide, and is filled with a semiconductor material 30, for example here polysilicon.

(21) The additional isolation trench 3 therefore here has the aspect of an isolated vertical electrode. Although it is not used as such, the formation of this electrode is particularly advantageous from the point of view of the fabrication process.

(22) This is because, since the integrated circuit CI comprises memory cells, isolated vertical electrodes used as such are formed within the integrated circuit CI, for example in the first well C1, and allow the selection of the memory cells during the normal operation of the integrated circuit CI.

(23) Thus, forming the additional isolation trench 3 according to the same method of fabrication as the isolated vertical electrodes allows the implementation of a specific fabrication step to be obviated, which would allow for example the formation of additional trenches with a different aspect.

(24) It would furthermore be possible to form a second isolation region R2 comprising only one isolation trench 2 extending more deeply into the substrate, in such a manner as to come into contact with the buried isolation layer. However, the formation of such an isolation trench would require specific fabrication steps.

(25) The integrated circuit CI furthermore comprises a detection device DIS, which allows, in a first configuration, a detection of a thinning of the substrate S via its rear face Fr, and in a second configuration a detection of DFA attack.

(26) The device DIS here is formed in the second well C2, and comprises a group G of at least a first trench, the first trench here comprising the first part 21 of the isolation trench 2 which extends longitudinally within the second well C2 occupying the entire surface area of the second well C2 on the front face Fv of the substrate.

(27) The second well C2 comprises an input contact area Ze, formed at a first end of the part 2 of the trench by conventional doping and silicidation methods, on top of a first cavity passing through the isolation trench 2, and on which is formed an electrical contact.

(28) The second well C2 comprises an output contact area Zs, formed at a second end of the part 2 of the trench by conventional doping and silicidation methods, on top of a second cavity passing through the isolation trench 2, and on which an electrical contact is formed.

(29) Thus, since the isolation trench 2 only extends up to the first distance d1 from the buried semiconductor layer 1, the input contact area Ze and the output contact area Zs are electrically coupled (or connected).

(30) The device DIS furthermore comprises detection circuit D coupled between the input contact area Ze and the output contact area Zs, configured for, in a first configuration, measuring an electrical quantity representative of the electrical resistance of the second well C2, and in a second configuration, detecting a current flowing between the input contact area Ze and the output contact area Zs.

(31) The detection circuit D comprises a control circuit MCM, for example a logical circuit, which allows the detection circuit to be placed in the first configuration or in the second configuration.

(32) Upon initialization of the integrated circuit, the detection circuit D is in the first configuration, then, if no thinning of the substrate is detected, or in other words, if a non-thinning of the substrate is detected, the control circuit MCM switches the detection circuit D into the second configuration and the integrated circuit is enabled according to its normal operation.

(33) In the first configuration, if the substrate S has been thinned beyond the buried semiconductor layer 1, the electrical resistance of the second well will increase in proportion to the decrease in thickness of the region 7 of the second well C2 situated under the isolation trench 2 until it becomes virtually infinite when the thinning has reached the lower end of the isolation trench 2, in other words when the region 7 has been totally thinned.

(34) For this purpose, the detection circuit D may comprise a biasing circuit MPL configured for applying a potential difference between the two contact areas Ze and Zs, for example by applying a positive voltage to the input contact area Ze and by connecting the output contact area Zs to ground. The control circuit D may also comprise a comparing circuit CMP configured for comparing the value of the current flowing between the two contact areas Ze and Zs with a reference value corresponding to the value of the current in the absence of a thinning of the well.

(35) For example, here, the comparing circuit CMP is configured for generating a first value if the value of the current is lower than the reference value, and for generating a second value if the value of the current is higher than or equal to the reference value.

(36) The detection circuit D further comprises a control unit UC for the integrated circuit CI configured for, in this first configuration, upon receiving the first value, resetting or disabling the integrated circuit CI.

(37) If a DFA attack is carried out, conventionally by means of a laser, a photo-current is generated in the second well C2, at the P-N junctions which then behave as photodiodes.

(38) Thus, in this respect, in the second configuration, the control unit UC is configured for resetting the integrated circuit upon receiving the second value, in other words if a current, or photo-current, is detected in the semiconductor well C2.

(39) The control circuit MCM switches the device DIS from the first configuration to the second configuration by disabling the biasing circuit.

(40) The isolation of the second well C2 advantageously prevents any interference of the transistors of the first well C1 with the device DIS, and hence obviates the need to provide a disabling circuit for the transistors of the first well C1.

(41) The absence of the need to implement a disabling circuit advantageously allows a gain in surface area.

(42) FIG. 4 illustrates the integrated circuit CI, in which the substrate has been partially thinned. Following this thinning, the substrate S comprises a cavity Cv, extending from the rear face Fr of the substrate as far as into the second semiconductor well C2, in such a manner as to reach the lower end of the group G of at least a first trench.

(43) The cavity Cv therefore passes through the semiconductor layer 1 and the region 7, and the coupling between the two contact areas Ze and Zs is no longer guaranteed.

(44) By way of example, the cavity extends over a surface area of around twenty-five square micrometers, i.e. a surface area greater than the surface area of the semiconductor layer 1 situated under the first well, which here is around nine square micrometers.

(45) Thus, even if the biasing circuit MPL applies a potential difference between the two contact areas Ze and Zs, no current can flow between the two contact areas Ze and Zs, and the comparing circuit CMP generates the first value.

(46) Upon receiving the first value, the control unit UC resets or disables the integrated circuit CI.

(47) Thus, the integrated circuit CI is protected against the attacks comprising a thinning of the substrate.

(48) FIG. 5, where FIG. 6 is a cross-sectional view along the line of cross-section V-V of FIG. 5, and where FIG. 7 is a cross-sectional view along the line of cross-section VI-VI of FIG. 5, illustrates one variant of the embodiment in relation to FIGS. 1 to 3.

(49) In this embodiment, the first part 21 of the isolation trench does not occupy the entire surface of the second well C2 on the front face Fv, but extends around the periphery of the second well C2 in such a manner as to bound its edges.

(50) Thus, the second well C2 comprises a central part PC in which the group G of at least a first trench comprises a plurality of first trenches 4 extending transversally within the second well C2, from the front face Fv up to a second distance d2 from the bottom of the well, the second distance d2 being shorter than the first distance d1.

(51) The first trenches 4 are formed so as to be parallel to one another and are distributed between the input contact area Ze and the output contact area Zs.

(52) Here, for example, each first trench 4 comprises an insulating wall, for example made of silicon oxide 41, and is filled with a semiconductor material 40, here for example polysilicon.

(53) The first trenches 4 here therefore have the aspect of isolated vertical electrodes, but are not used as such.

(54) The formation of these first trenches 4 advantageously allows a group G of first trenches to be obtained which go more deeply into the substrate, and which therefore allow a more efficient detection of a thinning of the substrate.

(55) This is because, the more deeply the group G of at least one trench goes into the substrate, the less necessary it will be to carry out a significant thinning from the rear face Fr in order to reach the lower ends of the trenches 4, in other words to break through into the region 7, and hence the sooner this thinning will be detected.

(56) It should be noted that it would be possible to form a single isolation trench analogous to that previously described in relation to FIGS. 1 to 3 and which go more deeply into the substrate, but that would require specific fabrication steps.

(57) Thus, for this reason also, the formation of the first trenches 4 allows the process of fabrication of the device DIS to be optimized, and hence the production costs to be reduced.

(58) Furthermore, as illustrated in FIG. 8, it would also be possible to form an implanted region 40 of the N type of conductivity, between the lower end of each first trench 4 and the buried semiconductor layer 1, in such a manner that the implanted region 40 forms an extension of the associated first trench 4, which then extends up to a third distance d3 from the buried isolation layer 1, shorter than the second distance d2.

(59) This allows the efficiency of the device DIS to be further enhanced.

(60) FIG. 9, where FIG. 10 is a cross-sectional view along the line of cross-section IX-IX of FIG. 9, and where FIG. 11 is a cross-sectional view along the line of cross-section X-X of FIG. 9, illustrates one embodiment in which the second well C2 is of the second type of conductivity.

(61) In this embodiment, the device is analogous to the device DIS previously described in relation to FIGS. 1 to 3.

(62) The integrated circuit CI does not comprise the buried semiconductor layer 1, and the second isolation region R2 here comprises a second part 22 of the isolation trench 2, and the second well C2 here is isolated from the rest of the substrate by the second isolation region R2 and by the lateral PN junction between the second well and the rest of the substrate, and the horizontal PN junction between the bottom of the second well C2 and the rest of the substrate.

(63) The first isolation region R1 here comprises a second part 22 of the isolation trench 2 and the additional isolation trench 3, here formed through the second part 22.

(64) The additional trench 3 here extends from the front face Fv to beyond the bottom of the first well C1, into the substrate S, in such a manner as to provide a continuity of electrical isolation between the second part 22 of the isolation trench 2 and the bottom of the second well C2.

(65) FIG. 12, where FIG. 13 is a cross-sectional view along the line of cross-section XII-XII of FIG. 12, and where FIG. 14 is a cross-sectional view along the line of cross-section XIII-XIII of FIG. 12, illustrates an embodiment analogous to the embodiment previously described in relation to FIGS. 5 to 8, in which the first well C1 and the second well C2 are of the second type of conductivity.

(66) In this embodiment, the second part 22 of the isolation trench 2 does not occupy the entire surface of the second well C2 on the front face Fv, but extends around the periphery of the second well C2 in such a manner as to bound its edges.

(67) Thus, the second well C2 comprises a central part PC in which the group G of at least a first trench comprises a plurality of first trenches 4 extending transversally within the second well C2, from the front face Fv up to the second distance d2 from the bottom of the well.

(68) In this embodiment, the first isolation region R1 here comprises the second part 22 of the isolation trench 2 and the additional isolation trench 3, here formed through the second part 22.

(69) FIG. 15 illustrates an integrated circuit CI comprising a plurality of first wells C1, within and on which several transistors are formed, each first semiconductor well C1 being associated with a second well C2 comprising a device DIS according to any one of the embodiments previously described in relation to FIGS. 1 to 14.

(70) In this embodiment, the detection devices DIS are coupled in series so as to form a chain 5 of devices electrically coupled in series.

(71) In FIG. 15, the connections 50 between the devices are shown schematically, but they are in practice conventionally formed by metal tracks and vias formed in the interconnection part of the integrated circuit CI.

(72) The input contact area of the first device DIS of the chain here forms an input contact area ZCe for the chain of devices, and the output contact area of the last device of the chain here forms an output contact area ZCs for the chain of devices.

(73) Thus, the detection circuit D here is coupled between the input contact area ZCe of the chain of devices and the output contact area ZCs of the chain of devices, and is hence common to all the devices of the chain. This advantageously allows a space gain in the integrated circuit CI.

(74) In this embodiment, the chain may comprise any given number of devices according to embodiments which may be different, from amongst those previously described in relation to FIGS. 1 to 13.

(75) An integrated circuit CI such as previously described in relation to FIGS. 1 to 15 may be incorporated into any type of object, notably a smartcard CP, as illustrated schematically in FIG. 16.