WO2009085363A2

WO2009085363A2 - Ic disabling circuit

Info

Publication number: WO2009085363A2
Application number: PCT/US2008/078922
Authority: WO
Inventors: Lawrence T. Clark; Fionn Sheerin
Original assignee: Arizona Board Of Regents For And On Behalf Of Arizona State University
Priority date: 2007-10-05
Filing date: 2008-10-06
Publication date: 2009-07-09
Also published as: WO2009085363A3

Abstract

Systems and methods for disabling a secure Integrated Circuit (IC) are provided. In general, in response to detecting an event such as an intrusion on the secure IC, a supply voltage (VDD) node of the secure IC is clamped to, or effectively short circuited to, a reference voltage (Vss) node of the secure IC. The disabling of the secure IC may be temporary or permanent. In one embodiment, the disabling of the secure IC is made permanent by setting a state of a non-volatile memory element on the secure IC. In one embodiment, the non-volatile memory element is a thin gate transistor, wherein a thin gate oxide of the thin gate transistor is blown such that the thin gate transistor operates as a fuse.

Description

IC DISABLING CIRCUIT

[0001] This application claims the benefit of U.S. provisional application serial number 60/977,992 filed October 5, 2007, the disclosure of which is incorporated herein by reference in its entirety.

Statement Regarding Federally Sponsored Research or Development [0002] This invention was made with funding from the U.S. Missile Defense Agency under contract/grant number DWS0221 . The U.S. Government may have certain rights in the invention.

Background of the Invention

[0003] Secure Integrated Circuits (ICs) are desirable in many applications. However, in order for an IC to be secure, the IC needs to be able to detect intrusions, or attacks, and to appropriately respond to those detected intrusions. Accordingly, there is a need for a system and method for responding to detected intrusions on a secure IC by disabling the IC.

Summary of the Invention [0004] The present invention relates to a secure Integrated Circuit (IC) and more particularly relates to disabling at least one component of the secure IC in response to detecting an event such as an intrusion, or attack, on the secure IC. In general, in response to detecting an intrusion on the secure IC, a supply voltage (V_DD) node of the secure IC is clamped to, or effectively short circuited to, a reference voltage (Vss) node of the secure IC. The disabling of the secure IC may be temporary or permanent. In one embodiment, the disabling of the secure IC is made permanent by setting a state of a nonvolatile memory element on the secure IC. In one embodiment, the nonvolatile memory element is a thin gate transistor, wherein a thin gate oxide of the transistor is blown such that the thin gate transistor operates as a fuse. [0005] In general, the secure IC includes intrusion detection circuitry and disabling circuitry. Upon detecting an intrusion upon the core circuitry, the intrusion detection circuitry sends a disable signal to the disabling circuitry. In response, the disabling circuitry clamps a supply voltage (V_DD) node of the secure IC to a reference voltage (V_Ss) node of the secure IC, thereby disabling at least one component of the secure IC. In one embodiment, the disabling circuitry includes fuse circuitry and clamping circuitry. The fuse circuitry includes a thin gate transistor. Upon receiving the disable signal, the fuse circuitry applies a relatively high voltage (V_DDH) to a gate of the thin gate transistor, thereby blowing the thin gate transistor. In response, the clamping circuitry is activated to clamp, or effectively short circuit, the supply voltage (V_DD) node of the secure IC to the reference voltage (V_Ss) node of the secure IC. [0006] In another embodiment, the disabling circuitry includes electrostatic discharge (ESD) circuitry and fuse circuitry. The ESD circuitry provides conventional ESD protection for the secure IC. More specifically, under normal operation, the ESD circuitry provides a high-impedance path or open circuit between a supply voltage (V_DD) node of the secure IC and a reference voltage (Vss) node of the secure IC. However, during an ESD event, the ESD circuitry clamps the supply voltage (V_DD) node of the secure IC to the reference voltage (Vss) node of the secure IC. In this embodiment, the ESD circuitry is also activated in response to detecting an intrusion on the secure IC. By activating the ESD circuitry in response to detecting an intrusion on the secure IC, the secure IC is disabled by clamping the supply voltage (V_DD) node of the secure IC and the reference voltage (Vss) node of the secure IC.

Brief Description of the Drawing Figures

[0007] The accompanying drawing figures incorporated in and forming a part of this specification illustrate several aspects of the invention, and together with the description serve to explain the principles of the invention.

[0008] Figure 1 illustrates a secure Integrated Circuit (IC) including disabling circuitry according to one embodiment of the present invention;

[0009] Figure 2 is a more detailed illustration of the disabling circuitry of Figure 1 according to first embodiment of the present invention;

[0010] Figures 3A and 3B illustrate a thin gate transistor of Figure 2 before and after a gate oxide is ruptured according to one embodiment of the present invention; [0011] Figure 4 illustrates one implementation of a resistor that may be utilized in the disabling circuitry of Figure 2 according to one embodiment of the present invention;

[0012] Figure 5 illustrates an exemplary embodiment of a thick gate inverter included in the disabling circuitry of Figure 2;

[0013] Figures 6 through 8 graphically illustrate the operation of the disabling circuitry of Figure 2 according to one embodiment of the present invention;

[0014] Figure 9 is a more detailed illustration of the disabling circuitry of Figure 1 according to a second embodiment of the present invention;

[0015] Figure 10 is a more detailed illustration of the disabling circuitry of Figure 1 according to a third embodiment of the present invention; [0016] Figure 1 1 is a more detailed illustration of the disabling circuitry of Figure 1 according to a fourth embodiment of the present invention; [0017] Figure 12 illustrates a secure IC including disabling circuitry according to another embodiment of the present invention; and [0018] Figure 13 is a more detailed illustration of the disabling circuitry of Figure 12 according to one embodiment of the present invention.

Detailed Description of the Preferred Embodiments

[0019] The embodiments set forth below represent the necessary information to enable those skilled in the art to practice the invention and illustrate the best mode of practicing the invention. Upon reading the following description in light of the accompanying drawing figures, those skilled in the art will understand the concepts of the invention and will recognize applications of these concepts not particularly addressed herein. It should be understood that these concepts and applications fall within the scope of the disclosure and the accompanying claims. [0020] The present invention relates to a secure Integrated Circuit (IC) and more particularly relates to disabling the secure IC in response to detecting an intrusion, or attack, on the secure IC. In general, in response to detecting an intrusion on the secure IC, a supply voltage (V_DD) node of the secure IC is clamped to, or effectively shorted to, a reference voltage (Vss) node of the secure IC, where the reference voltage (V_Ss) may be, for example, ground. Figure 1 is a block diagram of a secure IC 10 including IC disabling circuitry 12 (hereinafter "disabling circuitry") according to one embodiment of the present invention. The secure IC 10 may be any type of IC wherein security is desired. The secure IC 10 may be utilized in military applications or commercial applications. For example, the secure IC 10 may be a secure Field Programmable Gate Array (FPGA) integrated circuit, a secure Read Only Memory (ROM) integrated circuit, a secure Erasable Programmable Read Only Memory (EPROM) integrated circuit such as a flash memory integrated circuit, an IC for controlling operation of a Smart Card, or the like. [0021] The secure IC 10 includes core circuitry 14, intrusion detection and authentication circuitry 16, and a fuse block 18. In the preferred embodiment, the secure IC 10 is a single integrated circuit die including the core circuitry 14, the intrusion detection and authentication circuitry 16, and the fuse block 18. In another embodiment, the secure integrated circuit 10 is a single integrated circuit package including the core circuitry 14, the intrusion detection and authentication circuitry 16, and the fuse block 18. In yet another embodiment, the secure integrated circuit 10 may be implemented as multiple die soldered together without the use of a package. The core circuitry 14 may vary depending on the particular implementation of the secure IC 10. For example, the core circuitry 14 may be core circuitry of an FPGA, ROM, EPROM, or the like. The intrusion detection and authentication circuitry 16 operates to provide authentication and to detect intrusions for the secure IC 10. For example, in one embodiment, a Personal Identification Number (PIN) or other authentication password is provided to the secure IC 10. The intrusion detection and authentication circuitry 16 compares the authentication password to a stored correct value. Upon receiving a predetermined number of incorrect authentication passwords, the intrusion detection and authentication circuitry 16 triggers a fuse to be blown in the fuse block 18. Note that the fuse block 18 is exemplary. Other types of non- volatile or, alternatively, volatile storage may be used. Further, the fuse block 18 or other type of non-volatile storage, or alternative volatile storage, may alternatively be implemented outside of the secure integrated circuit 10. Once a defined threshold number of fuses in the fuse block 18 are blown, indicating a defined threshold number of failed attempts to access the secure IC 10, the intrusion detection and authentication circuitry 16 sends a disable signal to the disabling circuitry 12. In response, as discussed below, the disabling circuitry 12 disables the secure IC 10 by either permanently or temporarily clamping a supply voltage (V_DD) of the secure IC 10 to a reference voltage (V_Ss) of the secure IC 10. Note that the number of allowable authentication attempts before blowing one of the fuses in the fuse block 18 or before disabling the secure IC 10 may be chosen on the basis of the level of security desired for the secure IC 10. [0022] Because one classic form of attack on a secure IC is to toggle power to "trick" the mechanism or otherwise bypass the security apparatus, in this embodiment, the intrusion detection and authentication circuitry 16 is coupled to a supply voltage (V_DD|₀) by a forward biased diode 20. Note that the supply voltage (V_DDIO) may be a supply voltage used for input/output circuitry to systems implemented in processes that use supply voltages greater than the supply voltage (V_DD)- For example, the supply voltage (V_DD) may be 1 .8 volts (V) and the supply voltage (V_DDIO) may be 3.3V or 5V. A decoupling capacitor 22 provides charge storage to the intrusion detection and authentication circuitry 16 for some amount of time after the supply voltage (V_DDIO) is removed. In this manner, the intrusion detection and authentication circuitry 16, or at least a desired subset thereof, may continue to operate after the supply voltage (V_DDIO) has been driven to ground. This allows the intrusion detection and authentication circuitry 16 to detect and respond to power attacks or attempts to remove power before the intrusion detection and authentication circuitry 16 can respond to an incorrect authentication attempt by blowing one of the fuses in the fuse block 18. To further the ability of the secure IC 10 to respond to such power attacks, the fuses in the fuse block 18 may also be coupled to the supply voltage (V_DDIO) by the diode 20 by the optional connection shown in Figure 1 . [0023] Note that the secure IC 10 may have a number of independent voltage domains. For example, each power supply pin of the secure IC 10 may correspond to an independent voltage domain. The disabling circuitry 12 may operate to disable only a subset of the independent voltage domains or all of the independent voltage domains. In this manner, for example, only the core circuitry 14, or some desired subset thereof, may be disabled. Further, as discussed below with respect to Figures 12 and 13, disabling circuitry may also be connected to the input-output supply voltage (V_DDIO) and operate to disable all of the intrusion detection and authentication circuitry 16 or some desired subset thereof. For example, authentication components of the intrusion detection and authentication circuitry 16 may be disabled while other components of the intrusion detection and authentication circuitry 16 remain enabled. This may aid in diagnosis of self-destructed devices that have been permanently disabled and returned by legitimate users for replacement. [0024] Figure 2 is a block diagram of the disabling circuitry 12 of Figure 1 according to one embodiment of the present invention. In general, the disabling circuitry 12 includes modified electrostatic discharge (ESD) circuitry 24 and fuse circuitry 26. The modified ESD circuitry 24 includes RC timer circuitry 28 formed by a transistor 30, a resistor 32, and a capacitor-connected transistor 34 connected as shown. In operation, during an ESD event, the RC timer circuitry 28 operates such that a timing node (TIMING_NODE) of the RC timer circuitry 28 is at a logic level "0," as will be appreciated by one of ordinary skill in the art upon reading this disclosure. When an ESD event is not present, the RC timer circuitry 28 operates such that the timing node (TIMING_NODE) is at a logic level "1." The output of the RC timer circuitry 28 at the timing node (TIMING_NODE) is inverted by an inverter 36 and provided to a first input (NORA) of a NOR gate 38.

[0025] An output of the NOR gate 38 is connected to an input of clamping circuitry 40 via an inverter chain 42. In this embodiment, the clamping circuitry 40 is a P-type Metal Oxide Semiconductor (PMOS) transistor 44. When the PMOS transistor 44 is in an off state (i.e., when a logic level "1 " is provided to a gate of the PMOS transistor 44), the PMOS transistor 44 provides a high impedance path or open circuit between the supply voltage (V_DD) and the reference voltage (Vss), or more specifically a high impedance path or open circuit between corresponding supply voltage (V_DD) and reference voltage (Vss) nodes. When the PMOS transistor 44 is in an on state (i.e., when a logic level "0" is provided to the gate of the PMOS transistor), the PMOS transistor 44 provides a low impedance path or short circuit between the supply voltage (V_DD) and the reference voltage (Vss), or more specifically a low impedance path or short circuit between corresponding supply voltage (V_DD) and reference voltage (Vss) nodes. [0026] In this embodiment, the inverter chain 42 connecting the output of the NOR gate 38 and the input of the clamping circuitry 40 includes an even number of inverters 46-1 through 46-N. As such, the input provided to the clamping circuitry 40 (i.e., the input provided to the gate of the PMOS transistor 44) is at a logic level "0" when the output of the NOR gate 38 is at a logic level "0," and at a logic level "1 " when the output of the NOR gate 38 is at a logic level "1 ." Note that the PMOS transistor 44 is a relatively large transistor. As such, the inverter chain 42 operates to "buffer up" the output of the NOR gate 38 such that the output of the NOR gate 38 can drive the PMOS transistor 44.

[0027] In normal operation when no ESD event is present, the timing node (TIMING_NODE) is at a logic level "1." As a result, the output of the NOR gate 38 and thus gate of the PMOS transistor 44 is at a logic level "1." Since the gate of the PMOS transistor 44 is at a logic level "1 ," the PMOS transistor 44 is in an off state, thereby presenting a high impedance path or open circuit between the supply voltage (V_DD) and the reference voltage (Vss)- In contrast, during an ESD event, the timing node (TIMING_NODE) is at a logic level "0." As a result, the output of the NOR gate 38 and thus the gate of the PMOS transistor 44 is at a logic level "0." Since the gate of the PMOS transistor 44 is at a logic level "0," the PMOS transistor 44 is in an on state, thereby effectively shorting the supply voltage (V_DD) to the reference voltage (Vss)- Once the ESD event is over, the timing node (TIMING_NODE) returns to a logic level "1." As a result, the PMOS transistor 44 is turned off, thereby presenting a high impedance path or open circuit between the supply voltage (V_DD) and the reference voltage (V_Ss)-

[0028] According to this embodiment of the present invention, an output of the fuse circuitry 26 is applied to a second input (NORB) of the NOR gate 38. The output of the fuse circuitry 26 is normally at a logic level "0" such that, unless there is an ESD event, the PMOS transistor 44 is in an off state. However, when the secure IC 10 is to be disabled, the output of the fuse circuitry 26 is set to a logic level "1 " such that the PMOS transistor 44 is set to an on state to clamp the supply voltage (V_DD) to the reference voltage (V_Ss)_> thereby disabling the secure IC 10.

[0029] More specifically, the fuse circuitry 26 includes a thick gate transistor 48, a thin gate transistor 50, a resistor 52, and a thick gate inverter 54. As used herein, a "thick gate" device is a device formed by a transistor or transistor(s) having a gate oxide thickness that is sufficient to withstand the application of a supply voltage (V_DDH), which is higher than some other supply voltage (V_DD) used in the circuit. For example, if V_DD is 1.8V, then V_DDH may be 3.3V or 5V. However, the present invention is not limited thereto. Further, as used herein, a "thin gate" transistor is a transistor having a gate oxide thickness that is not sufficient, or is most likely not sufficient, to withstand the application of the higher supply voltage potential (V_DDH), which again is higher than the supply voltage (V_DD)- AS discussed below, the supply voltage (V_DDH) is utilized to blow, or rupture, a gate oxide of the thin gate transistor 50 when the secure IC 10 is to be disabled. As such, the thin gate transistor 50 operates as a form of non-volatile storage, or memory. [0030] The thick gate transistor 48 is controlled by a disable signal (DISABLE) from the intrusion detection and authentication circuitry 16 (Figure 1 ). Initially, a storage node (STORAGE_NODE) of the fuse circuitry 26 is pulled to a logic level "1 " by the resistor 52. As such, the logic level "1 " at the storage node (STORAG E_NODE) is inverted by the thick gate inverter 54 to provide a logic level "0" to the NOR gate 38. Thus, at this point, unless there is an ESD event, the PMOS transistor 44 is in an off state. [0031] When an attack or intrusion is detected, the disable signal (DISABLE) is set to a logic level "0," thereby setting the thick gate transistor 48 to an on state. When the thick gate transistor 48 is set to the on state, the supply voltage (V_DDH) is applied to a gate of the thin gate transistor 50. The supply voltage (V_DDH) is greater than a break down voltage of a gate oxide of the thin gate transistor 50. For example, in one embodiment, the supply voltage (V_DD) is 1.8V, the supply voltage (V_DDH) is either 3.3V or 5V, and a thickness of a gate oxide of the thin gate transistor 50 is less than 35 Angstroms (A). However, the present invention is not limited thereto. The thickness of the gate oxide of the thin gate transistor 50 and the voltage level of the supply voltage (V_DDH) may vary depending on the voltage level used for the supply voltage (V_DD)-

[0032] By applying the supply voltage (V_DDH) to the gate of the thin gate transistor 50, the gate oxide of the thin gate transistor 50 is blown, or ruptured, thereby creating a low resistance path or short circuit between the storage node (STORAGE_NODE) and the reference voltage (Vss)- When the disable signal (DISABLE) is thereafter removed, the gate of the thick gate transistor 48 is de-asserted back to a logic level "1 " by the intrusion detection and authentication circuitry 16 such that the thick gate transistor 48 returns to an off state. At that point, since a low impedance path exists between the storage node (STORAG E_NODE) and the reference voltage (Vss) through the blown thin gate transistor 50, the storage node (STORAG E_NODE) is pulled to a logic level "0." Note that a ratio of the resistance of the resistor 52 and a resistance of the blown thin gate transistor 50 is such that the storage node (STORAG E_NODE) is at a logic level "0" when the thin gate transistor 50 is blown. The logic level "0" at the storage node (STORAGE_NODE) is inverted by the thick gate inverter 54 to provide a logic level "1 " to the NOR gate 38. As a result, the PMOS transistor 44 is set to the on state such that a low impedance path or short circuit is presented between the supply voltage (V_DD) and the reference voltage (V_Ss), thereby disabling the secure IC 10.

[0033] Figures 3A and 3B illustrate the thin gate transistor 50 before and after the thin gate oxide has been blown, or ruptured, according to an exemplary embodiment of the present invention. More specifically, Figure 3A illustrates the thin gate transistor 50 before the supply voltage (V_DDH) has been applied to the gate of the thin gate transistor 50. A thin gate oxide layer 56 creates a high impedance path between a polysilion gate 58 and a source 60, a drain 62, and a body 64 of the thin gate transistor 50. As illustrated in Figure 3B, once the supply voltage (V_DDH) is applied to the gate of the thin gate transistor 50, the thin gate oxide layer 56 is ruptured, or blown. A localized heating flows silicon (Si) or polysilcon material into the rupture, thereby creating a resistive path between the polysilicon gate 58 and the source 60, the drain 62, and the body 64 of the thin gate transistor 50. [0034] Figure 4 illustrates an exemplary implementation of the resistor 52 of Figure 2. In this embodiment, the resistor 52 is implemented as a thick gate PMOS transistor 66 connected as shown. Figure 5 illustrates an exemplary embodiment of the thick gate inverter 54 of Figure 2. In this embodiment, the thick gate inverter 54 is implemented as a thick gate PMOS transistor 68 and a thick gate NMOS transistor 70 connected as shown in Figure 5.

[0035] Figures 6 through 8 graphically illustrate the operation of the disabling circuitry 12 of Figure 2 according to one embodiment of the present invention. More specifically, Figure 6 illustrates a normal power-up of the secure IC 10. The supply voltage (V_DD) ramps relatively slowly. The RC time constant of the RC timer circuitry 28 is such that the voltage level on the timing node (TIMING_NODE) essentially rises with the supply voltage (V_DD)- Consequently, the clamping circuitry 40 is off. Figure 7 illustrates the operation of the disabling circuitry 12 during an ESD event. In an ESD event, the supply voltage (V_DD) rises very quickly. As a result of the ESD event and the time constant of the RC timer circuitry 28, the timing node

(TIMING_NODE) remains is at a logic level low for an amount of time that is sufficient for the charge causing the ESD event to be effectively shorted to the reference voltage (V_ss), which may be ground, without the supply voltage (V_DD) rising to a point where the secure IC 10 would be damaged. Figure 8 graphically illustrates the operation of the disabling circuitry 12 of Figure 2 when the secure IC 10 is disabled. After the thin gate transistor 50 has been blown to disable the secure IC 10, the clamping circuitry 40 is permanently activated such that the supply voltage (V_DD) is clamped to the reference voltage (V_Ss)- As a result, the supply voltage (V_DD) is prevented from rising to a voltage sufficient for normal operation of the secure IC 10. Here, V_MIN is the minimum V_DD required for proper circuit operation.

[0036] Figure 9 illustrates the disabling circuitry 12 of Figure 1 according to another embodiment of the present invention that is substantially the same as the embodiment of Figure 2. However, in this embodiment, the clamping circuitry 40 is formed by an N-type Metal Oxide Semiconductor (NMOS) transistor 44', rather than the PMOS transistor 44 (Figure 2). Since the NMOS transistor 44' is on when the input to the gate of the NMOS transistor 44' is at a logic level "1 " and off when the input to the gate of the NMOS transistor 44' is at a logic level "0," the inverter chain 42 includes an odd number of inverters 46-1 through 46-N. As such, when the output of the NOR gate 38 is at a logic level "0," the input to the NMOS transistor 44' is at a logic level "1 " and vice versa. Otherwise, the disabling circuitry 12 of Figure 9 operates the same as the embodiment of Figure 2. [0037] Figure 10 illustrates the disabling circuitry 12 of Figure 1 according to another embodiment of the present invention. This embodiment is substantially the same as that in Figure 2 without the RC timer circuitry 28. More specifically, in this embodiment, the disabling circuitry 12 includes the fuse circuitry 26, wherein the output of the fuse circuitry 26 drives clamping circuitry 72 via an inverter chain 74. The clamping circuitry 72 is formed by a PMOS transistor 76 connected as shown. In an alternative embodiment, the clamping circuitry 72 is formed by an NMOS transistor. The inverter chain 74 includes a number of inverters 78-1 through 78-N. Since the clamping circuitry 72 is implemented as a PMOS transistor 76, there is an odd number of inverters 78-1 through 78-N in the inverter chain 74.

[0038] In normal operation, the storage node (STORAG E_NODE) is at a logic level "1." As such, the output of the thick gate inverter 54 is at a logic level "0," and the output of the inverter chain 74 is at a logic level "1." Therefore, the PMOS transistor 76 is off such that a high impedance or open circuit is presented between the supply voltage (V_DD) and the reference voltage (Vss)- When the secure IC 10 is disabled, the storage node (STORAG E_NODE) is at a logic level "0." As such, the output of the thick gate inverter 54 is at a logic level "1 ," and the output of the inverter chain 74 is at a logic level "0." Therefore, the PMOS transistor 76 is on such that a low impedance or short circuit is presented between the supply voltage (V_DD) and the reference voltage (Vss).

[0039] Figure 1 1 illustrates the disabling circuitry 12 according to yet another embodiment of the present invention. In this embodiment, a number of fuse circuitries 26-1 through 26-M are connected in parallel and controlled by the same disable signal (DISABLE). The multiple fuse circuitries 26-1 through 26-M provide redundancy. As such, if, for some reason, one or more of the fuse circuitries 26-1 through 26-M would fail by, for example, not properly blowing the corresponding thin gate transistor, the disabling circuitry 12 would still operate to properly disable the secure IC 10 as long as at least one of the fuse circuitries 26-1 through 26-M does not fail. In this embodiment, each of the fuse circuitries 26-1 through 26-M is the same as the fuse circuitry 26 discussed above. The outputs of the fuse circuitries 26-1 through 26-M are input to a NOR gate 80. The output of the NOR gate 80 then drives the clamping circuitry 72 via the inverter chain 74. In this embodiment, since the clamping circuitry 72 is implemented as a PMOS transistor 76, there is an even number of inverters 78-1 through 78-N in the inverter chain 74. Note that the multiple fuse circuitries 26-1 through 26-M in the embodiment of the disabling circuitry 12 of Figure 1 1 may be used in the same manner as in the embodiments of the disabling circuitry 12 of Figures 2 and 9. For example, the outputs of the multiple fuse circuitries 26-1 through 26-M may be input to the NOR gate 38 of Figure 2 or Figure 9. [0040] Figure 12 illustrates the secure IC 10 according to another embodiment of the present invention. In this embodiment, the secure IC 10 also includes IC disabling circuitry 82 (hereinafter "disabling circuitry") coupled to the supply voltage (V_DDIO)- In this example, the secure IC 10 also includes the disabling circuitry 12 connected to the supply voltage (V_DD)- However, the present invention is not limited thereto. Note that the secure IC 10 may include multiple voltage domains. For example, the secure IC 10 may include multiple voltage domains for the intrusion detection and authentication circuitry 16. The disabling circuitry 82 may be associated with one or more of these voltage domains such that all of the functionality of the intrusion detection and authentication circuitry 16 is disabled by the disabling circuitry 82 or, alternatively, such that some of the functionality of the intrusion detection and authentication circuitry 16 is disabled by the disabling circuitry 82 while other functionality of the intrusion detection and authentication circuitry 16 is not disabled by the disabling circuitry 82. [0041] Figure 13 illustrates the disabling circuitry 82 of Figure 12 according to one embodiment of the present invention. This embodiment of the disabling circuitry 82 is substantially the same as the embodiment of the disabling circuitry 12 illustrated in Figure 2. However, thin gate devices are replaced with corresponding thick gate devices capable of handing the supply voltage (V_DDIO), which is substantially higher than the supply voltage (V_DD). In general, the disabling circuitry 82 includes modified ESD circuitry 84 and fuse circuitry 86. The modified ESD circuitry 84 includes RC timer circuitry 88 formed by a thick gate transistor 90, a resistor 92, and a capacitor-connected thick gate transistor 94 connected as shown. In operation, during an ESD event, the RC timer circuitry 88 operates such that a timing node (TIMING_NODE) of the RC timer circuitry 88 is at a logic level "0," as will be appreciated by one of ordinary skill in the art upon reading this disclosure. When an ESD event is not present, the RC timer circuitry 88 operates such that the timing node (TIMING_NODE) is at a logic level "1." The output of the RC timer circuitry 88 at the timing node (TIMING_NODE) is inverted by an inverter 96 and provided to a first input (NORA) of a NOR gate 98. In this embodiment, the NOR gate 98 is a thick gate device. [0042] An output of the NOR gate 98 is connected to an input of clamping circuitry 100 via an inverter chain 102. In this embodiment, the clamping circuitry 100 is implemented as a thick gate PMOS transistor 104. When in an off state (i.e., when a logic level "1 " is provided to a gate of the PMOS transistor 104), the PMOS transistor 104 provides a high impedance path or open circuit between the supply voltage (V_DD) and the reference voltage (V_Ss)- When in an on state (i.e., when a logic level "0" is provided to the gate of the PMOS transistor 104), the PMOS transistor 104 provides a low impedance path or short circuit between the supply voltage (V_DD) and the reference voltage (Vss)- In this embodiment, the inverter chain 102 includes an even number of thick gate inverters 106-1 through 106-N. As such, the input provided to the clamping circuitry 100 (i.e., the input provided to the gate of the PMOS transistor 104) is at a logic level "0" when the output of the NOR gate 98 is at a logic level "0" and at a logic level "1 " when the output of the NOR gate 98 is at a logic level "1." Note that the PMOS transistor 104 is a relatively large transistor. As such, the inverter chain 102 operates to "buffer up" the output of the NOR gate 98 such that the output of the NOR gate 98 can drive the PMOS transistor 104. [0043] In normal operation when no ESD event is present, the timing node (TIMING_NODE) is at a logic level "1." As a result, the output of the NOR gate 98 and thus gate of the PMOS transistor 104 is at a logic level "1 ." Since the gate of the PMOS transistor 104 is at a logic level "1 ," the PMOS transistor 104 is in an off state, thereby presenting a high impedance path or open circuit between the supply voltage (V_DD) and the reference voltage (V_Ss)- In contrast, during an ESD event, the timing node (TIMING_NODE) is at a logic level "0." As a result, the output of the NOR gate 98 and thus the gate of the PMOS transistor 104 is at a logic level "0." Since the gate of the PMOS transistor 104 is at a logic level "0," the PMOS transistor 104 is in an on state, thereby effectively shorting the supply voltage (V_DD) to the reference voltage (Vss)- Once the ESD event is over, the timing node (TIMING_NODE) returns to a logic level "1." As a result, the PMOS transistor 104 is turned off, thereby presenting a high impedance path or open circuit between the supply voltage (V_DD) and the reference voltage (V_Ss)-

[0044] According to this embodiment of the present invention, an output of the fuse circuitry 86 is applied to a second input (NORB) of the NOR gate 98. The output of the fuse circuitry 86 is normally at a logic level "0" such that, unless there is an ESD event, the PMOS transistor 104 is in an off state. However, when the secure IC 10 is to be disabled, the output of the fuse circuitry 86 is set to a logic level "1 " such that the PMOS transistor 104 is set to an on state. When in the on state, the PMOS transistor 104 clamps the supply voltage (V_DD) to the reference voltage (V_Ss), thereby disabling the secure IC 10. [0045] More specifically, the fuse circuitry 86 includes a thick gate transistor 108, a thin gate transistor 1 10, a resistor 1 12, and a thick gate inverter 1 14 connected as shown. As discussed below, a supply voltage (V_DDH) is utilized to blow a gate oxide of the thin gate transistor 1 10 when the secure IC 10 is to be disabled. As such, the thin gate transistor 1 10 operates as a form of non-volatile memory, or storage.

[0046] The thick gate transistor 108 is controlled by a disable signal (DISABLE) from the intrusion detection and authentication circuitry 16 (Figure 12). Initially, a storage node (STORAGE_NODE) of the fuse circuitry 86 is pulled to a logic level "1 " by the resistor 1 12. As such, the logic level "1 " at the storage node (STORAG E_NODE) is inverted by the thick gate inverter 1 14 to provide a logic level "0." The output of the thick gate inverter 1 14 is provided to the NOR gate 98 via a level-shifter 1 16. In general, the level-shifter 1 16 includes thick gate transistors 1 18, 120, 122, and 124 and an inverter 126 connected as shown and operates to shift a logic level of the output of the thick gate inverter 1 14 from V_DD logic levels to V_DDIO logic levels. Because the output of the NOR gate 98, and thus the output of the level-shifter 1 16, is at a logic level "0" at this point, the PMOS transistor 44 is in an off state unless there is an ESD event. [0047] When an attack or intrusion is detected, the disable signal

(DISABLE) is set to a logic level "0," thereby setting the transistor 108 to an on state. When the transistor 108 is set to the on state, a supply voltage (V_DDH), which is substantially higher than the supply voltage (V_DD), is applied to a gate of the thin gate transistor 1 10. More specifically, the supply voltage (V_DDH) is greater than a break down voltage of a gate oxide of the thin gate transistor 1 10. For example, in one embodiment, the supply voltage (V_DD) is 1.8V, the supply voltage (V_DDH) is either 3.3V or 5V, and a thickness of a gate oxide of the thin gate transistor 1 10 is less than 35 Angstroms (A). However, the present invention is not limited thereto. The thickness of the gate oxide of the thin gate transistor 1 10 and the voltage level of the supply voltage (V_DDH) may vary depending on the voltage level used for the supply voltage (V_DD)- [0048] By applying the supply voltage (V_DDH) to the gate of the thin gate transistor 1 10, the gate oxide of the thin gate transistor 1 10 is blown, or ruptured, thereby creating a low resistance path or short circuit between the storage node (STORAGE_NODE) and the reference voltage (V_Ss)- When the disable signal (DISABLE) is thereafter removed, the gate of the thick gate transistor 108 returns to a logic level "1 " such that the thick gate transistor 108 returns to an off state. At that point, since a low impedance path exists between the storage node (STORAGE_NODE) and the reference voltage (Vss) through the blown thin gate transistor 1 10, the storage node

(STORAGE_NODE) is pulled to a logic level "0." Note that a ratio of the resistance of the resistor 1 12 and a resistance of the blown thin gate transistor 1 10 is such that the storage node (STORAG E_N OD E) is at a logic level "0" when the thin gate transistor 1 10 is blown. The logic level "0" at the storage node (STORAG E_NODE) is inverted by the thick gate inverter 1 14 to provide a logic level "1 " to the NOR gate 98 via the level-shifter 1 16. As a result, the PMOS transistor 104 is set to the on state such that a low impedance path or short circuit is presented between the supply voltage (V_DD) and the reference voltage (V_Ss), thereby disabling the secure IC 10. [0049] As discussed above for the disabling circuitry 12, there are numerous variations of the disabling circuitry 82 of Figure 13. More specifically, the clamping circuitry 100 may alternatively be implemented as an NMOS transistor. In addition or alternatively, the disabling circuitry 82 may not include the RC timer circuitry 88 in a manner similar to the embodiment of the disabling circuitry 12 illustrated in Figure 10. Still further, the disabling circuitry 82 may alternatively include multiple fuse circuitries 86, as discussed above with respect to the embodiment of the disabling circuitry 12 illustrated in Figures 1 1 . [0050] While the discussion above focuses on permanently disabling the secure IC 10, the present invention is not limited thereto. In another embodiment, the secure IC 10 is temporarily disabled in response to detecting an intrusion. For example, referring to Figure 2, in order to temporarily disable the secure IC 10, the disable signal (DISABLE) may be provided to the inverter 54, which in this case may be a thin gate device. The intrusion detection and authentication circuitry 16 may apply the disable signal (DISABLE) for an amount of time that the secure IC 10 is desired to be disabled. Alternatively, the disabling circuitry 12 may include a timer that controls the amount of time that the secure IC 10 is disabled. Likewise, the other embodiments of the disabling circuitry 12 as well as the disabling circuitry 82 may be modified to provide temporary, rather than permanent, disabling of the secure IC 10.

[0051] In addition, while the discussion above focuses on disabling the secure IC 10 in response to detecting an intrusion, in another embodiment, the secure IC 10 may be permanently or temporarily disabled after a predefined amount of time has expired since a triggering event occurred. The triggering event may be, for example, power-up of the secure IC 10. However, the present invention is not limited thereto. [0052] Still further, while the discussion above focuses on blowing the thin gate transistor 50/1 10 by applying the higher supply voltage (V_DDH) to the gate of the thin gate transistor 50/1 10, the present invention is not limited thereto. In an alternative embodiment, the normal supply voltage (V_DD) may be applied to the gate of the thin gate transistor 50/1 10. Then, in order to blow the thin gate transistor 50/1 10, the reference voltage (V_Ss) applied to the source and drain of the thin gate transistor 50/1 10 may be pulled to a lower voltage. For example, if the reference voltage (Vss) normally applied to the source and drain of the thin gate transistor 50/1 10 is ground, the reference voltage (Vss) applied to the source and drain of the thin gate transistor 50/1 10 may be pulled to a negative voltage that is sufficient to blow or rupture the thin gate oxide of the thin gate transistor 50/1 10.

[0053] Those skilled in the art will recognize improvements and modifications to the preferred embodiments of the present invention. All such improvements and modifications are considered within the scope of the concepts disclosed herein and the claims that follow.

Claims

ClaimsWhat is claimed is:

1. A secure Integrated Circuit (IC) comprising: core circuitry; disabling circuitry adapted to clamp a supply voltage node of the secure IC to a reference voltage node of the secure IC, thereby disabling at least one component of the secure IC, in response to a disable signal; and detection circuitry adapted to detect an event and provide the disable signal to the disabling circuitry in response to the event.

2. The secure IC of claim 1 wherein the event is an intrusion on the secure IC, and the detection circuitry comprises intrusion detection circuitry adapted to detect the intrusion on the secure IC and provide the disable signal to the disabling circuitry in response to the intrusion.

3. The secure IC of claim 1 wherein the event is a predetermined event, and the detection circuitry is adapted to: detect the predetermined event; and provide the disable signal to the disabling circuitry after a predetermined amount of time has expired since detection of the predetermined event.

4. The secure IC of claim 1 wherein the disabling circuitry permanently disables the secure IC in response to the disable signal by permanently clamping the supply voltage node of the secure IC to the reference voltage node of the secure IC.

5. The secure IC of claim 1 wherein the disabling circuitry temporarily disables the secure IC in response to the disable signal by temporarily clamping the supply voltage node of the secure IC to the reference voltage node of the secure IC.

6. The secure IC of claim 1 wherein the disabling circuitry comprises: Electrostatic Discharge (ESD) circuitry comprising clamping circuitry adapted to clamp the supply voltage node of the secure IC to the reference voltage node of the secure IC when activated; wherein the disabling circuitry is further adapted to activate the clamping circuitry in response to the disable signal.

7. The secure IC of claim 6 wherein the disabling circuitry is further adapted to permanently activate the clamping circuitry in response to the disable signal, thereby permanently disabling the at least one component of the secure IC.

8. The secure IC of claim 6 wherein the disabling circuitry is further adapted to temporarily activate the clamping circuitry in response to the disable signal, thereby temporarily disabling the at least one component of the secure IC.

9. The secure IC of claim 6 wherein the disabling circuitry further comprises: a non-volatile storage element that is set to a first state in response to the disable signal; wherein an input of the clamping circuitry is coupled to the non-volatile storage element such that that clamping circuitry is activated when the nonvolatile storage element is set to the first state.

10. The secure IC of claim 6 wherein the disabling circuitry further comprises: fuse circuitry that is set to a first state in response to the disable signal; wherein an input of the clamping circuitry is coupled to the fuse circuitry such that that clamping circuitry is activated when the fuse circuitry is set to the first state.

1 1. The secure IC of claim 6 wherein the disabling circuitry further comprises: fuse circuitry comprising a thin gate transistor that is blown by applying a second supply voltage to a gate of the thin gate transistor in response to detection of an intrusion, the second supply voltage being greater than a breakdown voltage of a gate oxide of the thin gate transistor; wherein an input of the clamping circuitry is coupled to the fuse circuitry such that the clamping circuitry is activated in response to the thin gate transistor being blown.

12. The secure IC of claim 6 wherein the clamping circuitry comprises a P- type Metal Oxide Semiconductor (PMOS) transistor having a gate, a source coupled to the supply voltage node of the secure IC, and a drain coupled to the reference voltage node of the secure IC, wherein a logic level "0" is applied to the gate of the PMOS transistor in response to the disable signal.

13. The secure IC of claim 6 wherein the clamping circuitry comprises an N-type Metal Oxide Semiconductor (NMOS) transistor having a gate, a source coupled to the supply voltage node of the secure IC, and a drain coupled to the reference voltage node of the secure IC, wherein a logic level "1 " is applied to the gate of the NMOS transistor in response to the disable signal.

14. The secure IC of claim 6 wherein the ESD circuitry is further adapted to temporarily activate the clamping circuitry during an ESD event.

15. The secure IC of claim 6 wherein the disabling circuitry further comprises: a plurality of fuse circuitries comprising a corresponding plurality of thin gate transistors and adapted to apply a second supply voltage to gates of the plurality of thin gate transistors in response to the disable signal, the second supply voltage being greater than a breakdown voltage of a gate oxide of each of the plurality of the thin gate transistors; wherein an input of the clamping circuitry is coupled to the plurality of fuse circuitries such that the clamping circuitry is activated in response to at least one of the plurality of thin gate transistors being blown by the second supply voltage.

16. The secure IC of claim 1 wherein the disabling circuitry comprises: clamping circuitry adapted to clamp the supply voltage node of the secure IC to the reference voltage node of the secure IC when activated; wherein the disabling circuitry is further adapted to activate the clamping circuitry in response to the disable signal.

17. The secure IC of claim 16 wherein the disabling circuitry is further adapted to permanently activate the clamping circuitry in response to the disable signal, thereby permanently disabling the at least one component of the secure IC.

18. The secure IC of claim 16 wherein the disabling circuitry is further adapted to temporarily activate the clamping circuitry in response to the disable signal, thereby temporarily disabling the at least one component of the secure IC.

19. The secure IC of claim 16 wherein the disabling circuitry further comprises: a non-volatile storage element that is set to a first state in response to the disable signal; wherein an input of the clamping circuitry is coupled to the non-volatile storage element such that that clamping circuitry is activated when the nonvolatile storage element is set to the first state.

20. The secure IC of claim 16 wherein the disabling circuitry further comprises: fuse circuitry that is set to a first state in response to the disable signal; wherein an input of the clamping circuitry is coupled to the fuse circuitry such that that clamping circuitry is activated when the fuse circuitry is set to the first state.

21. The secure IC of claim 16 wherein the disabling circuitry further comprises: fuse circuitry comprising a thin gate transistor that is blown by applying a second supply voltage to a gate of the thin gate transistor in response to detection of an intrusion, the second supply voltage being greater than a breakdown voltage of a gate oxide of the thin gate transistor; wherein an input of the clamping circuitry is coupled to the fuse circuitry such that the clamping circuitry is activated in response to the thin gate transistor being blown.

22. The secure IC of claim 16 wherein the clamping circuitry comprises a P-type Metal Oxide Semiconductor (PMOS) transistor having a gate, a source coupled to the supply voltage node of the secure IC, and a drain coupled to the reference voltage node of the secure IC, wherein a logic level "0" is applied to the gate of the PMOS transistor in response to the disable signal.

23. The secure IC of claim 16 wherein the clamping circuitry comprises an N-type Metal Oxide Semiconductor (NMOS) transistor having a gate, a source coupled to the supply voltage node of the secure IC, and a drain coupled to the reference voltage node of the secure IC, wherein a logic level "1 " is applied to the gate of the NMOS transistor in response to the disable signal.

24. The secure IC of claim 16 wherein the disabling circuitry further comprises: a plurality of fuse circuitries comprising a corresponding plurality of thin gate transistors and adapted to apply a second supply voltage to gates of the plurality of thin gate transistors in response to the disable signal, the second supply voltage being greater than a breakdown voltage of a gate oxide of each of the plurality of thin gate transistors; wherein an input of the clamping circuitry is coupled to the plurality of fuse circuitries such that the clamping circuitry is activated in response to at least one of the plurality of thin gate transistors being blown by the second supply voltage.

25. The secure IC of claim 1 wherein the secure IC is an integrated circuit for controlling operation of a smart card.

26. The secure IC of claim 1 wherein the secure IC is a secure Field Programmable Gate Array (FPGA) integrated circuit.

27. The secure IC of claim 1 wherein the secure IC is a secure Read Only Memory (ROM) integrated circuit.

28. The secure IC of claim 1 wherein the secure IC is a secure Erasable Programmable Read Only Memory (EPROM) integrated circuit.

29. The secure IC of claim 1 wherein the secure IC is a secure flash memory integrated circuit.

30. The secure IC of claim 1 wherein the core circuitry, the disabling circuitry, and the detection circuitry are integrated into a single integrated circuit package.

31. The secure IC of claim 1 wherein the core circuitry, the disabling circuitry, and the detection circuitry are integrated into a single integrated circuit die.

32. The secure IC of claim 1 wherein the core circuitry, the disabling circuitry, and the detection circuitry are implemented on multiple die soldered together without a package..

33. A method of operating a secure Integrated Circuit (IC) comprising: detecting an event; and clamping a supply voltage node of the secure IC to a reference voltage node of the secure IC in response to detecting the event, thereby disabling at least one component of the secure IC.

34. The method of claim 33 wherein the event is an intrusion on the secure IC, and detecting the event comprises detecting the intrusion on the secure IC.