Patent Application
20060053297
The present invention relates to data protection and particularly to processing equipment equipped with security mechanisms.
Semiconductors are typically mass produced from silicon wafers. A silicon wafer is processed by a sequence of various processing steps, such as deposition, photolithography, etch, etc. Wafers processed in a fab also undergo various tests and measurements for conformance with original design and process requirements. Various wafer inspection, metrology, test, and measurements tools are used. Each of these semiconductor-processing, inspection, metrology, and measurement machines requires a set of equipment data, such as operating instructions (processing programs or recipes, process logs, equipment constants, etc.), digital data, trend charts, parameters, and so on. Recipes and parameters vary with different kinds of machines, as do recipes and parameters of the same kind of machines made by different machine manufacturers.
Similarly, a liquid-crystal display (LCD) is processed by a sequence of various steps. LCDs generally undergo three kinds of processes, array processes, cell processes, and module assembly processes. Among these various LCD processes, array processes are similar to semiconductor manufacturing processes, except that in array processes transistors are fabricated on a glass substrate instead of a silicon wafer. Similar to that in the semiconductor industry, each LCD processing machine requires a set of equipment data, such as operating instructions (processing programs or recipes, process logs, equipment constants, etc.), digital data, trend charts, parameters, and so on. Recipes and parameters vary with different kinds of machines, as do recipes and parameters of the same kind of machines made by different machine manufacturers.
Equipment data can become quite complex and very diverse as process engineers attempt to refine the process for desired results. Different semiconductor/LCD products may require operation instructions, including different recipes, different steps, or different combinations of steps, or may generate different measurement data and parameters. Such process and measurement data are very important for perfecting a manufacturing process, and numerous resources are expended to obtain optimized equipment data. Such optimized equipment data are invaluable assets of a wafer manufacturing company, or a LCD manufacturing company.
The equipment data, however, is not well protected and thus susceptible to unauthorized distribution. As an example,
Embodiments of the present invention provide processing equipment equipped with a security system for managing distribution of equipment data. By implementing authentication and/or encryption mechanisms, the security system protects equipment data.
According to one embodiment, processing equipment having equipment data protection is provided. The processing equipment contains a processing unit, a storage unit, a controlling unit, and an authentication unit. The processing unit processes an article, such as a wafer, a display panel, an IC, etc. The storage unit stores equipment data for the processing unit. The controlling unit receives a data retrieval request for the equipment data, wherein the data retrieval request comprises identification data. The authentication unit validates the identification data and causes the controlling unit to retrieve corresponding equipment data from the storage unit, when the identification data is validated. The controlling unit further transfers the equipment data to an external system.
According to another embodiment, processing equipment having equipment data protection is provided. The processing equipment contains a processing unit, a storage unit, a controlling unit, and an encryption unit. The processing unit processes an article, such as a wafer, a display panel, an IC, etc. The storage unit stores equipment data for the processing unit. The controlling unit receives a data retrieval request from an external unit for the equipment data, wherein the data retrieval request preferably comprises identification data. The encryption unit receives the equipment data from the storage unit, and encrypts the equipment data. The controlling unit further transfers the equipment data to the external unit.
According to another embodiment, a manufacturing system is provided. The manufacturing system comprises processing equipment and an authentication unit external to the processing equipment. The processing equipment comprises a processing unit, a storage unit, and a controlling unit. The storage unit stores equipment data thereof. The controlling unit receives a first request for the equipment data, wherein the first request comprises identification data. The authentication unit validates the identification data and causes the controlling unit to retrieve the corresponding equipment data from the storage unit when the identification data is validated.
According to still another embodiment, a manufacturing system is provided. The manufacturing system comprises processing equipment and an encryption unit external to the processing equipment. The processing equipment comprises a processing unit, a storage unit, and a controlling unit. The storage unit stores equipment data thereof. The controlling unit receives a first request from an external unit for the equipment data, wherein the first request preferably comprises identification data. The encryption unit encrypts the equipment data before the data is sent out to the external requesting unit.
Also provided is an electronic device, which is processed by processing equipment comprising equipment data protection. The electronic device is a semiconductor device or a liquid crystal display panel.
Also provided is a method of managing equipment data distribution, which can be implemented in the aforementioned system. A data retrieval request for the equipment data is received, wherein the data retrieval request comprises identification data. The identification data is then validated. When the identification data is validated, the equipment data is retrieved from the storage unit and encrypted. The encrypted equipment data is then transferred to an external system.
A detailed description is given in the following embodiments with reference to the accompanying drawings.
The present invention can be more fully understood by reading the subsequent detailed description and examples with references made to the accompanying drawings, wherein:
The disclosure references FIGS. 2 to 3, which in general relate to processing equipment equipped with a security system for managing distribution of equipment data thereof. While the disclosure refers to a semiconductor manufacturing environment, it is understood that any processing equipment having equipment data stored within an internal memory thereof may operate with the embodiments disclose.
A manufacturing system 20 comprises processing equipment 21 and a host control system 25. Processing equipment 21 comprises a processing unit 211, a storage unit 213, a controlling unit 215, and a security unit 217. The security unit 217 preferably comprises an authentication module 212, an encryption module 214, and a decryption module 216. It is to be understood that the security unit 217 may only comprise the authentication module 212, but without the encryption module 214 and the decryption module 216, or only comprise the encryption module 214, but without the authentication module 212 and the decryption module 216.
Processing unit 211 processes a wafer, an IC, or an LCD panel according to, for example, manufacturing, testing, or packaging.
Storage unit 213 stores equipment data for processing unit 211. The equipment data comprises data pertaining to operation of processing equipment 21, such as operating instructions (processing programs or recipes, process logs, equipment constants, etc.), digital data, trend charts, and/or parameters. The equipment data can be stored in encrypted form or original form. When the equipment data is stored in encrypted form, it is decrypted before the processing equipment utilizes it, and transmitted to outside device in the encrypted form. When the equipment data is stored in its original form, it can be utilized directly within the processing equipment, and encrypted before it is transmitted to an outside device.
The controlling unit 215 communicates with host control system 27 and external system 29. The host control system 27 comprises a shop floor control system in a semiconductor manufacturing environment, such as a host computer, a manufacturing executive system (MES), or recipe management system. The external system can be any device capable of storing data. The controlling unit 215 receives a data retrieval request for the equipment data, the request comprising identification data. When the data retrieval request is received and the identification data is validated, authentication module 212 validates the identification data and retrieves corresponding equipment data from the storage unit 213 through the controlling unit 215. If the identification data is invalidated, authentication module 212 generates an alarm signal. After the equipment data is retrieved from the storage unit 213, it is further processed by the encryption module 214 into an encrypted form. The encrypted equipment data is then relayed to controlling unit 215, and provided to host control system or external system 29 accordingly.
When the encrypted equipment data needs to be decrypted, a decryption request is issued and sent to the authentication module 212. Similarly, the decryption request comprises identification data, and the identification data is validated by the authentication module 212. The authentication module 212 validates the identification data specified in the decryption request. When the identification data is validated, the authentication module 212 provides corresponding decryption key, or issues an approval for another source (not shown) to provide the corresponding decryption key. When the identification data is invalidated, authentication module 212 generates an alarm signal. Preferably, the authentication module 212 also retains a record of every data retrieving and decryption request, such that every action to retrieve or decrypt the equipment data is recorded and can be traced through any known method.
The security unit 217 and components thereof can be arranged in different ways. For example, according to one embodiment, the security unit 217 may only comprise the authentication module, while the encryption and/or decryption functions on the equipment data are not performed, or performed by encryption and/or decryption modules external to the processing equipment. The authentication module validates the identification data, and causes the controlling unit to retrieve corresponding equipment data from the storage unit, when the identification data is validated. The controlling unit further transfers the equipment data to an external system.
According to another embodiment, the security unit 217 may only comprise the encryption module, while the authentication function is performed optionally. Any equipment data that is transferred to an external unit is encrypted. Decryption of the data may be performed by a decryption module external to the processing equipment 21, which may be part of a centralized data security management unit (not shown), or performed by a decryption module embedded in the external unit which requests for the equipment data, such as the external system 29. When data is decrypted at the external requesting unit, the decryption key may be provided from the centralized data security management unit, or the external requesting unit has the key if it is a legitimate user of the data. The external requesting unit may be a processing equipment similar to the processing equipment 21, located at the same fab or at a different fab. In other words, there may be at least one “mother” processing equipment 21 which contains the equipment data and embedded with an encryption module 213, and one or more “daughter” processing equipment which intend to copy the equipment data and embedded with a decryption module 214. When the external requesting unit is not a legitimate user of the equipment data, the illegal external unit will not be able to decrypt the equipment data because it does not have the decryption key itself, nor can it get the key from the centralized data security management unit. According to another embodiment, a manufacturing system is provided. The manufacturing system comprises processing equipment and a security unit external to the processing equipment. In this embodiment, the security unit 217 is not part of the process equipment, but is an external unit to the processing equipment. The security unit is an isolated unit, or may be part of a centralized data security management unit (not shown). The security unit 217 comprises the authentication module, or the encryption module, or both. Preferably it further comprises a decryption module together with the encryption module. In addition, since the equipment data may usually be in the form of raw digital data which is not comprehensible by human being, the manufacturing system may further include a content management system (not shown) which generates a technical document, or an operation instruction, or other documents/data sheets, based on the equipment data.
Using
The identification data is validated (step S32). The validation result and the data retrieval request are recorded (step S33). Next, it is determined whether the request is validated (step S34), and if so, the equipment data is retrieved from the storage unit and encrypted (step S35). The equipment data can be stored in encrypted form or original form. When the equipment data is stored in encrypted form, it is decrypted before the processing equipment utilizes it, and transmitted to outside device in the encrypted form. When the equipment data is stored in its original form, it can be utilized directly within the processing equipment, and encrypted before it is transmitted to an outside device. The encrypted equipment data is then transferred to an external system (step S37). If the data retrieval request is invalidated, an alarm signal is generated (step S36).
Referring to
While the disclosure refers to a semiconductor manufacturing environment, it is understood that any processing equipment having equipment data stored within an internal memory thereof may operate with the embodiments disclosed. It is to be understood that the invention may be applicable to various industries such as, but not limited to, wafer manufacture, IC package, and LCD.
While the invention has been described by way of example and in terms of preferred embodiment, it is to be understood that the invention is not limited thereto. To the contrary, it is intended to cover various modifications and similar arrangements (as would be apparent to those skilled in the art). Therefore, the scope of the appended claims should be accorded the broadest interpretation so as to encompass all such modifications and similar arrangements.
