ANTI-TAMPER DEVICE FOR INTEGRATED CIRCUITS

S P E C I F I C A T I O N

ANTI-TAMPER DEVICE FOR INTEGRATED CIRCUITS

BACKGROUND OF THE INVENTION

Priority

[0001] Priority is claimed to U.S. Provisional Patent Application Serial No.

61/365,349, filed on July 18, 2010, the disclosure of which is incorporated herein by reference in its entirety.

Field of the Invention

[0002] The field of the present invention relates to an anti-tamper device for integrated circuits, particularly an anti-tamper device that physically alters and renders unreadable one or more integrated circuits.

Background

[0003] Often, one of the first steps taken by hackers, in their attempts to access embedded keys and data contained in integrated circuits, is hardware disassembly. Using readily available tools, techniques and information, many electronic devices and systems are easily disassembled. In most instances, however, hackers fail to encounter any type of anti-tamper device that prevents or deters hardware disassembly.

[0004] Although integrated circuits implement countermeasures designed to digitally or electronically destroy embedded keys and data, thwarting attacks with these types of countermeasures involves continued research and expense. In addition, due to external forces, such as reducing manufacturing costs and marketing timelines, designers of digital and electronic countermeasures are further disadvantaged. Therefore, using digital and electronic countermeasures alone often means hackers are able to access sensitive data stored within integrated circuits.

[0005] Despite being recognized as a better method of preventing access to integrated circuits, few, if any, systems use physical destruction methods as countermeasures. This is perhaps, in part, due to the potential harm to surrounding components and difficulties associated with commercially implementing known physical destruction methods.

[0006] Embedded keys and data contained within integrated circuits are not easily destroyed. Because even small fragments can contain sensitive data, scratching or cutting the surface of an integrated circuit is generally ineffective. Nonetheless, given the effectiveness of physical destruction methods in thwarting attacks and the ineffectiveness of digital and electronic countermeasures, there is a clear need for improved anti-tamper devices.

SUMMARY OF THE INVENTION

[0007] The present invention is directed toward an anti-tamper device for integrated circuits. The anti-tamper device includes a firing assembly having a contained energy source and an impact element. The device further includes a breach assembly having an integrated circuit and a propellant charge.

[0008] Upon an attempt to improperly remove or dislodge the integrated circuit from the anti-tamper device, the contained energy source is actuated. The energy source propels the impact element against the propellant charge, causing the charge to ignite. The resultant forces from the impact element and ignition of the charge imparts a shock wave through the anti-tamper device. This shock wave induces spalling of the integrated circuit such that the circuit is physically altered and rendered unreadable.

BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The drawings described herein are for illustrative purposes only and are not intended to limit the scope of the present disclosure. In the drawings:

FIG. 1 is an exploded view of a firing assembly;

FIG. 2 is a cross-sectional view of an assembled firing assembly in its Primed State; FIG. 3 is an exploded view of a firing assembly in its Primed State, an inner containment chamber, and a breach assembly;

FIG. 4 is a sectional view of a Loaded State assembly;

FIG. 5 is an exploded view of a Loaded State assembly and an outer containment chamber; FIG. 6 is a sectional view of a Set State assembly; and

FIG. 7 is a sectional view of the anti-tamper device shown in its Fired State.

DETAILED DESCRIPTION

[0010] Turning in detail to the drawings, FIGs. 1-7 illustrate the assembly of an anti-tamper device 10 for an integrated circuit 12. The anti-tamper device 10 includes a firing assembly 14 (FIGs. 1 and 2), a breach assembly 16 (FIG. 3), an inner containment chamber 20 and an outer containment chamber 80. The firing assembly 14 includes, in part, a receiver element 22, a contained energy source 24, and an impact element 26, as shown in FIGs. 1 and 2. The breach assembly 16 includes a breach element 18 configured to house the integrated circuit 12, a circuit interface 28, and a propellant charge 30, as shown particularly in FIG. 3.

[0011] When actuated, the contained energy source 24 propels the impact element 26 such that it ignites the propellant charge 30. Upon ignition of the charge, a localized shock wave is imparted through the anti -tamper device, causing spalling of the integrated circuit 12. This spalling renders the integrated circuit unreadable. "Spalling," as used herein, is broadly defined as breaking, shattering, disintegrating, splitting, chipping, or any other method that physically alters at least a portion of the integrated circuit such that the circuit is rendered unreadable.

[0012] FIG. 1 shows an exploded view of the firing assembly 14. Primary

components of the firing assembly 14 include a receiver element 22, a contained energy source 24, and an impact element 26. The receiver element 22 provides alignment and support for other components within the anti-tamper device. The receiver element 22

includes a stepped end section 34, a shaft section 36, and a nose section 38. As further described below, holes 40, 42 and receiver well 44 are also provided within the receiver element 22 for initial positioning of the energy source 24 and the impact element 26, using locking elements 46, 48 and locking pin 50. Vent holes 39, 41 are also preferably included within the stepped end section 34 of the receiver element 22. [0013] The energy source 24 is considered "contained" because it is not dependent upon external sources of energy, which are typically connected by wires or cables. In preferred configurations, the contained energy source 24 is a spring, imparting sufficient force to crimp the rim of the propellant charge and cause its ignition. While other types of energy sources are contemplated, preferable energy sources are capable of converting potential energy to kinetic energy upon their release from a compressed state.

[0014] The impact element 26 includes a shaft section 56 having a through-hole 58 and a head section 60 having an annular groove 62. The head section 60 preferably has a raised edge or surface 64 (FIG. 2) on its top face 66. The raised edge or surface 64 may be used to facilitate ignition of the propellant charge 30.

[0015] Three primary Assembly States are reached during preparation of the anti-tamper device: (1) the Primed State; (2) the Loaded State; and (3) the Set State.

[0016] To reach the primed state assembly 14a (FIGs. 2 and 3), the receiver element

22, energy source 24, and impact element 26 are positioned. Preferably, the energy source 24 and the impact element 26 are first pressed toward the stepped end section 34 of the receiver element 22 such that priming pin 47 (FIG. 1) may be inserted into pin hole 40. Thereafter, locking element access hole 51 is placed in alignment with receiver locking hole 42 for positioning of locking elements 46, 48. A first locking element 46 is initially placed into the receiver locking hole 42. Thereafter, locking pin 50 is inserted into the receiver well 44 and positioned against priming pin 47. A second locking element 48 is then placed into the receiver locking hole 42. In preferred configuration, the locking elements 46, 48 have a spherical outer periphery and the locking pin 50 has a circular cross-section.

[0017] When aligned, locking elements 46, 48 simultaneously rest on groove 62, located within the head section 60 of impact element 26, and in receiver locking hole 42. In this aligned position, priming pin 47 prevents movement of the impact element, while it is in a pressed position. Once assembled, the impact element may be turned approximately 90 degrees and the priming pin 47 removed, leaving the assembly in the Primed State. A Primed State Assembly 14a is shown in FIG. 2. [0018] Then, the impact element 26 is rotated to ensure that locking elements 46, 48 are contained within the assembly and the priming pin 47 is removed.

[0019] Next, to reach the Loaded State Assembly 92 (FIG. 4), the Primed State

Assembly 14a, the breach assembly 16, and the inner containment chamber 20 are positioned. The breach assembly 16 includes an integrated circuit 12, a breach element 18, a circuit interface 28, and a propellant charge 30. Breach element 18 includes a slot 70 configured to house one or more integrated circuits 12 and circuit interfaces 28.

[0020] Integrated circuits, as used herein, are broadly defined as memory devices, particularly devices based on integrated circuit technology, and including those with microprocessors or cryptographic processors. These devices may include any digital memory device having a small form factor, and specifically those that meet physical and electrical specifications for ISO/EEC 7810 ID-000 form factor (e.g. Subscriber Interface Modules (SIM) or Security Access Modules (SAM)) and ETSI TS 221 V9.0.0 (Mini-UIC). In addition, these devices may include generic secured or unsecured memory devices, such as MultiMediaCard (MMC), SecureDigital (SD), CompactFlash (CF), or other digital memory device formats with either standardized or proprietary form factors similar to those used in digital cameras and like devices.

[0021] The circuit interface 28 is preferably a frangible interface with physical and electrical interface connections, which are compatible with any of the aforementioned integrated circuit types. The circuit interface also includes a section 72 adapted for connection with a cable and/or wire 74. (See FIG. 3).

[0022] Breach element 18 includes a recessed slot 73 or other suitable area configured for positioning of a cable and/or wire 74. (See FIG. 3). The type of cable or wire used is configured to transmit and receive electrical signals from the integrated circuit to any external device. Such devices include, but are not limited to, transit systems, banking systems, physical access systems (e.g. door access systems), computers, and networks. Network types include Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMR), Enhanced Data for Global Evolution (EDGE), Ethernet ISO/IEEE 802-3 networks, and other devices configured to interface with and/or access data from integrated circuits.

[0023] Preferably, the integrated circuit 12 and circuit interface 28 are connected and placed within the slot 70 or other suitable area within the breach element 18. These elements 12, 28 are specifically positioned in the breach element 18 adjacent to cross ports 76. (See FIG. 3). These cross-ports are aligned with gas port 78 and propellant charge chamber 82, as described below.

[0024] The breach element 18 further includes a propellant charge chamber 82 for housing a propellant charge 30. The gas port 78 and the propellant charge chamber 82, however, are both configured to receive propellant charge 30.

[0025] Propellant charge, as used herein, is broadly defined as any type propellant charge that can be contained within a pyrotechnic cartridge. Preferably, these charges are powder actuated and commercially available from building suppliers such as those used for driving nails and other types of fastening devices. These types of charges are provided in a variety of powder level and calibers. Contemplated charges include those using smokeless powder or other low explosive materials which burn rapidly such as those manufactured by Illinois Tool Works, Inc. and the Hilti Corporation. When a surface strikes the base of the cartridge, the charge is activated by an impact sensitive primer compound. After activation off the charge, the burning propellant builds pressure within the cartridge and thereafter releases gases, imparting a shock wave throughout the breach assembly.

[0026] After the breach assembly 16 is assembled, it is placed into inner containment chamber 20, as shown particularly in FIGs. 4 and 5. The inner containment chamber 20 is preferably a sleeve of sufficient length to substantially cover both the firing assembly 14 and the breach assembly 16. This assembly is then coupled to the Primed State assembly 14a, as shown particularly in FIG. 5. Preferably, the nose section 38 (FIGs. 3 and 4) is configured to mate with hole 84 (FIG. 3). More preferably, the nose section 38 and the hole 84 have mating threads 85. During this assembly, an anaerobic locking compound may also be included on the threaded sections. A cross-sectional view of the Loaded State Assembly 92 is shown in FIG. 4. [0027] As shown in FIGs. 5 and 6, to reach the Set State Assembly 98 (FIG. 6), the outer containment chamber 80 is coupled to the Loaded State Assembly 92. The outer containment chamber 80 is preferably a tube having a closed end 86 and an open end 88. Included within the chamber 80 is tripping mechanism 90. Preferably, the tripping mechanism 90 is an integral part of the tube; however, it may be one or more separate components. In a preferred configuration, the tripping mechanism 90 is an elongated element having a circular cross-section. Preferably, the circular cross-section has about the same diametrical cross-section as locking pin 50 (FIG. 6).

[0028] Optionally, the outer containment chamber 80 may also include a forensic identifying material 68 (FIGs. 6 and 7) disposed within the chamber and preferably contained within in a frangible package 96 (FIGs. 6 and 7). Preferably, the frangible package 96 has an annular or doughnut-like shape. Any other shape, however, may be suitable. Upon improper removal of the integrated circuit 12 and/or the integrated circuit interface 28 from the Set State Assembly 98, this material will be released upon a hacker or unauthorized intruder for identification purposes, as described below. Contemplated forensic materials include powders or liquids such as residues from propellant charges and dyes. Any identifying material that is suitable for deposit onto a hacker or unauthorized intruder, however, may be utilized.

[0029] Under actual conditions, the outer containment chamber 80 is placed separately in an area (not shown), which is in proximity to a transit system, banking system, physical access system, a retail terminal, network, or any other type of system that uses integrated circuits. This area may be an opening, which is drilled into the ground or any type of building structure or furniture structure. Preferably, the outer containment chamber 80 is coupled to a predetermined area using methods such as grouting, gluing, or welding.

[0030] Alternatively, the outer containment chamber 80 may have an outer surface 83 that is configured to securely bite into or adhere to building structures or furniture structures made from plastic, concrete, metal, plaster, wood, foam, composite material or a building structure or furniture structure manufactured from a combination of these materials. Outer containment chamber 80 may also be integrally pre-molded into a building structure or furniture structure or a section thereof.

[0031] After positioning of the outer containment chamber 80 into the ground or the building structure, the Loaded State Assembly 92 is aligned with the outer containment chamber 80. Specifically, the tripping mechanism 90 is positioned within the receiver well 44 such that locking pin 50 is displaced, as shown in FIG. 6.

[0032] The Set State Assembly 98 of anti-tamper device 10 is released or triggered when an attempt is made to remove or dislodge an integrated circuit 12 and/or the integrated circuit interface 28 from position within the breach assembly 16. Under these circumstances one or more forces 100 is/are applied to the Set State assembly 98, during an attempt to remove or dislodge the integrated circuit 12 and/or the circuit interface 28.

[0033] For example, when a hacker or unauthorized intruder pulls on the extending cable or otherwise attempts to remove or dislodge the circuit from its Set State, the following can occur: (1) the triggering mechanism is withdrawn from the receiver well; (2) the locking elements drop into the receiver well, (3) the energy source (spring) and the impact element are released; (4) the impact element accelerates, propelling toward the breaching assembly and contacting and igniting the propellant charge.

[0034] The impact element 26 contacts the propellant charge 30 and the breaching assembly with sufficient impact force such that a shock wave is transmitted through the anti-tamper device 10. The resultant forces from the impact element 26 and the released gases 102 (FIG. 7) from the propellant charge 30 induce spalling of the integrated circuit 12 and the circuit interface 28. These forces, however, do not irreparably damage other components of the device. As such, the device may be reassembled and reused, after an initial triggering of the device, by placement of propellant charge, integrated circuit, and circuit interface within the breach assembly.

[0035] A Fired State Assembly 104, showing the physically altered integrated circuit

12a and circuit interface 28a is shown in FIG. 7. After impact of the resultant forces, both the integrated circuit and the circuit interface have breaches 106, 108. The physical alteration of the integrated circuit 12a is such that it is rendered unreadable. [0036] Preferably, with the exception of the integrated circuit, circuit interface, the propellant charge and cables/wires, components of the anti-tamper device are manufactured from metallic materials. Preferable materials include steel, stainless steel, and various types of metallic alloys. However, such materials may include, but are not limited to, composites and plastics with sufficient impact resistance.

[0037] The anti -tamper device 10 may be configured to house additional integrated circuits and/or propellant charges. Further, one or more anti-tamper devices may be positioned in parallel or in series, depending upon the configuration of the system to which the device is coupled.

[0038] Thus, an anti-tamper device for one or more integrated circuits is disclosed.

While embodiments of this invention have been shown and described, it will be apparent to those skilled in the art that many more modifications are possible without departing from the inventive concepts herein. The invention, therefore, is not to be restricted except in the spirit of the following claims.