The invention relates to a sensor, in particular for detecting attacks on signal-carrying lines of for example chip cards.
Chip cards, also known as smart cards, are used very frequently nowadays. Such chip cards are usually embodied as plastic cards with an integrated electronic chip which preferably includes hardware logic, a memory and a microprocessor. Such chip cards are used for carrying out certain transactions, such as money transactions in cashless payments and/or for performing an identification or authorization of a user. They can, for example, make possible access to places or services or manage accounts or allow transactions relating thereto.
Therefore, the confidential information stored on the chip card is typically not accessible from the exterior, since these data would then be subject to potential misuse. More particularly encryption data with which information to be propagated is encrypted are then of particular importance. Therefore, these encryption data are highly sensitive and therefore should be protected very well.
Chip cards of this type, but also other circuits, whose signals are to be protected for security reasons, such as circuits in the range of set-top boxes for example for pay television or DRM circuits for Digital Rights Management meanwhile, also due to the stored confidential or secret information such as encryption data, have ever more been subjected to attacks to reach the stored data.
Typically, such attacks on the security and the stored data of the chip cards are attempted by using the cards without the specifications. Use without the specifications of parameters such as temperature, supply voltage or clock frequency is then possible or because voltage spikes or incident radiated light are used. In such applications the chip of the chip card is then to have its function disturbed, so that it allows uncontrolled data access or performs uncontrolled operations via which information about the secret data can be obtained.
In order to avoid or prevent such undesired attacks on the confidential data stored on the chip, such chips include sensors which are capable of detecting voltage, temperature, frequency or voltage spikes or incident light radiation. If any unwanted attack is detected by one of these sensors, a reset is performed, that is to say, the chip restarts its boot sequence in order to again come into a defined state and also to avoid uncontrolled operations in this manner.
With the known chip cards the included detectors are used for voltage spikes for static signals, that is to say, they monitor the constancy of supply lines as is known from U.S. Pat. No. 6,542,010 B2.
From U.S. Pat. No. 6,745,331 B1 is known a detection device for chip cards by means of which an overvoltage or an undervoltage of supply lines is detected.
US 2003/0226082 A1 discloses a what is called voltage glitch detection for the detection of short-lasting voltage deviations in the supply voltage.
These publications from the state of the art relate to lines which as supply lines are at a constant supply voltage level. These measures, however, are unsuitable for signal-carrying lines.
In addition, as protection against attacks security-relevant signal lines are disposed in the lower metal layers of a multi-layer process of the chips. As a result of practical manipulations of lines lying on top of them disturbances may nonetheless be coupled in in the underlying layers, whereas these manipulations can certainly also result in the logic level in the top layers not being impeded or distorted. With a logic 1 this may be a voltage above the supply voltage or with a logic 0 a voltage below the ground level. As a result of sufficiently fast voltage variations a signal lying below this level may then be disturbed. A disturbance may also be capacitively coupled in via an additionally disposed metallization layer when sufficiently steep voltage edges in the disturbance signal are used.
It is an object of the invention to provide a sensor or a circuit arrangement which enhances the security more specifically in chip cards, so that in the event of an attack more particularly defence mechanisms suitable for the chip card can be induced to operate.
According to the invention this is achieved by means of a sensor more particularly for detecting attacks on at least one signal-carrying line more particularly of chip cards, comprising a circuit arrangement which comprises a first circuit arrangement for detecting an instantaneous voltage value above a first supply voltage and a second circuit arrangement for detecting an instantaneous voltage value below a second supply voltage, wherein, when a voltage value outside the range between the first and second supply voltages is detected, a signal is generated and can be taken as a basis for initiating a protective measure. According to the invention this achieves that it is detected when the voltage value of the monitored signal-carrying line is situated outside the permissible range after which there may be inferred that there was abusive use or an attack, respectively.
As a protective measure after detection of the fact that the permissible voltage range has been left it is suitable, if the signal pointing to an attack occurs, to perform a reset of the chip more particularly of the chip card or the complete circuit of the chip is deactivated at least at times.
It is highly advantageous if the circuit arrangement for generating the falling-short signal and/or the circuit arrangement for generating the exceeding signal are formed by at least two field effect transistors. It is also advantageous if the total circuit arrangement is built up from field effect transistors.
It is particularly advantageous if the circuit arrangement described above is integrated with the general chip logic of the chip, more particularly of the chip card. As a result of this the sensor cannot be identified so easily for targeted manipulation. This is advantageously possible because the total circuit can be built up only from logic transistors and thus also requires little space or surface, respectively.
The invention can be used not only for protecting circuits of chip cards, but in general for protecting circuits of which the signals are to be protected for security reasons, such as for example circuits in the range of set-top boxes for example for pay television or also DRM circuits for Digital Rights Management.
Advantageous further embodiments are described in the dependent claims.
The following description relating to the appended drawings, the whole given by way of non-limiting example, will provide better understanding of how the invention can be realized.
Also a second circuit arrangement 23 is connected or coupled to the signal-carrying line 21 as part of the circuit arrangement 20 according to the invention. Two transistors MN0 and MP3 in the circuit arrangement 23 are interconnected in such a way that the two drain electrodes are connected together and connected to the circuit 24. The two gate electrodes of MN0 and MP3 are together connected to the potential gnd! of the negative supply voltage. The source electrode of transistor MN0 is connected to line 21 and the source electrode of transistor MP3 is connected to vdd! potential of the positive supply voltage.
The two inverters 30 and 31 between the input signal sigin and the output signal sigout with their respective transistors MP1, MN1 and MP2, MN2 respectively do not, however, form part of the circuit arrangement according to the invention or the sensor respectively. They are represented only as substitutes for a circuit which is to be driven by the signal to be monitored sigin.
In normal operation the input signal sigin should carry only voltages between the positive supply voltage vdd! and the negative supply voltage gnd!, such as for example ground. The two transistors MN0 and MP0 of the circuit arrangements 22 and 23 are then always cut off independent of the voltage present. The two transistors MP3 and MN3, used as resistors, of the circuit arrangements 22 and 23 provide that the voltages bor_n at the drain electrodes of MN0 and MP3 are connected to vdd! potential and the voltage for of the drain electrodes of MN3 and MP0 to gnd! potential.
Alternatively, if sigin exceeds the supply voltage vdd! by a first predefinable threshold voltage of MP0, the voltage on for will rise accordingly and indicate an overvoltage. If sigin falls short of the supply voltage gnd! by the threshold voltage of MN0, the voltage on bor_n will drop and indicate an undervoltage.
The two sensor signals indicating an overvoltage or an undervoltage on the drain electrodes of MP0/MN3 or MP3/MN0 respectively, are combined to a common signal sor_sensed via the inverter including the transistors MP4 and MN4 and by means of the NAND circuit including the transistors MP5, MP6, MN5 and MN6. The moment sigin is in excess of the supply voltage by a threshold voltage, the signal sor_sensed will be actuated.
The circuit arrangement of the inverter 25 is interconnected such that the two gate electrodes of MP4 and MN4 are connected to one another and are interconnected to the drain electrodes of MP0 and MN3. The two drain electrodes of MP4 and MN4 are interconnected and are connected to the circuit 24. Furthermore, the source electrode of MP4 is connected to vdd! potential and the source electrode of MN4 to gnd! potential.
The NAND circuit 24 with the transistors MP5, MN5, MP6 and MN6 is then interconnected such that the two gate electrodes of MP6 and MN6 are connected to one another and are interconnected to the drain electrodes of MN0 and MP3. Furthermore the two gate electrodes of MP5 and MN5 are connected to one another and are interconnected to the drain electrodes of MP4 and MN4. The two drain electrodes of MP5 and MN5 are interconnected to the drain electrode of MP6, while the source electrode of MP6 is connected to vdd! potential and the source electrode of MP5 is also connected to vdd! potential. The source electrode of MN6 is then connected to gnd! potential. Finally, the drain electrode of MN6 is connected to the source electrode of MN5. The output line which carries the signal sor_sensed is interconnected to the drain electrodes of MN5, MP5 and MP6.
An advantageous further effect of this circuit arrangement is the limitation of the possible voltage deviations since the transistors MP0 and MN0 via the substrate terminal also act as diodes for the supply voltages.
Number | Date | Country | Kind |
---|---|---|---|
06113747.7 | May 2006 | EP | regional |
Filing Document | Filing Date | Country | Kind | 371c Date |
---|---|---|---|---|
PCT/IB2007/051652 | 5/3/2007 | WO | 00 | 3/19/2009 |