Tamper Resistance

A physical mesh or conductive layer covering the chip's secure areas that carries a continuous signal. Any attempt to drill, probe, or etch through the shield disrupts the signal pattern, triggering an immediate tamper event that erases sensitive data. Modern implementations use multi-layer serpentine meshes with randomized routing to defeat micro-probing and Focused Ion Beam (FIB) attacks. These shields are often integrated into the top metal layers during fabrication and are continuously monitored by a dedicated tamper detection coprocessor.

A suite of on-die analog sensors that continuously monitor for anomalous operating conditions indicative of a physical attack:

• Temperature sensors: Detect extreme heat or cold used to induce faults or freeze memory remanence
• Voltage glitch detectors: Identify rapid power supply fluctuations used in fault injection attacks
• Clock frequency monitors: Detect overclocking or clock glitching attempts to skip instructions
• Radiation sensors: Trigger on X-ray, ion beam, or laser illumination used for circuit perturbation When any sensor exceeds its programmed threshold, the system executes a zeroization routine to destroy cryptographic keys.

A protection mechanism that encrypts all data traversing between the processor and external memory, preventing bus probing and cold boot attacks. Using a dedicated memory encryption engine with AES-XTS or similar ciphers, every cache line written to DRAM is encrypted with a unique tweak based on its physical address. This ensures that even if an attacker physically intercepts the memory bus signals or reads the DRAM chips directly, they obtain only ciphertext. Integrity trees built over Merkle hash structures additionally prevent undetected modification of memory contents.

A physical casing with embedded tamper detection switches and flexible circuit wraps that surround the entire cryptographic boundary. The enclosure design includes:

• Penetration meshes: Conductive traces that break on physical intrusion
• Pressure-sensitive membranes: Detect attempts to depress or deform the casing
• Light-sensitive diodes: Trigger on exposure to light if the enclosure is opened
• Conformal coatings: Opaque, chemically resistant layers that resist decapsulation solvents Upon breach detection, the system immediately executes a hardware zeroization of all protected key material stored in battery-backed SRAM.

Logical and circuit-level defenses against fault injection attacks that attempt to alter program execution:

• Instruction redundancy: Critical operations are executed multiple times with results compared
• Spatial redundancy: Duplicate logic paths compute the same operation in parallel
• Temporal redundancy: Operations are repeated at different clock cycles to detect transient faults
• Randomized clock jitter: Prevents precise timing alignment required for successful glitch injection
• Dual-rail logic: Uses complementary signals to balance power consumption and resist differential power analysis These techniques are particularly critical for protecting cryptographic boundary transitions and authentication checkpoints.

The hardware mechanism that guarantees complete and irreversible destruction of sensitive data upon tamper detection. Key design elements include:

• Dedicated erase circuitry: Independent of the main processor, powered by a backup battery or supercapacitor
• Multi-target erasure: Simultaneously clears all secure memory regions, key registers, and derived session keys
• Verified completion: Hardware state machines confirm each memory cell is overwritten before releasing the tamper latch
• Active low design: The tamper signal is asserted by removing power, ensuring that cutting power lines triggers zeroization rather than disabling it This is the final defense layer ensuring that no key material survives a successful physical breach.