There are various types of digital systems comprising clock generators for timing the operation and functionality of different electronic components located on a chip or on an integrated electronic circuit. Usually, the digital system has a clock signal that serves as a reference to clock generators. This clock, usually having high stability and accuracy, is used to control a network of clocks of lower stability and is called a reference clock.
The reference clock signal usually consists of a continuous train of pulses having a constant frequency. As a result of the existence of various intentional security attacks initiated by motivated persons on the reference clock signal, the frequency of said reference clock signal may not always be stable or available and that may cause disturbances in the normal circuit or chip operation and may even cause damage to the electronic components, which are comprised in said circuit. The failure of a reference clock does not necessarily cause loss of synchronization.
It is often desirable to detect reference clock frequency deviation, caused by the intentional security attack, before it causes drastic effects to a security system by damaging it or getting it out of control. In other cases, it is often desirable to detect frequency deviations exceeding certain given minimum and maximum values. A need for such detection may arise during normal usage of the system, for example, in order to warn of actual malfunction due to frequency deviations. Alternatively, it is possible to use an internal clock signal, but this signal is not accurate since it has no reference signal.
Several devices have been proposed for limiting the frequency of the clock signal in order to protect the electronic circuit from possible deviations of the reference clock signal frequency to prevent the damage which may be caused to the electronics components. For example, European Patent No. 0048638 A2 presents a circuit that limits the frequency of pulses passing through it by deleting any input pulse which follows too closely on the preceding pulse. The output pulses cannot occur at intervals less than 16 times the period of the clock pulses. However, this patent application presents only the maximum frequency limitation, and still allows the circuit to operate at frequencies that are below the minimum. Moreover, the patent application relies on an accurate reference signal of 6.4 MHz and the output clock signal is not accurate enough.
U.S. Pat. No. 6,633,933 B2 describes a method and apparatus for limiting a processor clock frequency. The apparatus includes a frequency limiting circuit including one or more programmable fusible elements. The frequency limiting circuit outputs a signal for identifying a maximum processor clock frequency based on the state of each of the fusible elements. However, the apparatus proposed by this patent relates only to limitation of the processor clock frequency and is not suitable for any other chip. Moreover, this patent deals with the internal clock generator and it does not provide a solution to overcome the problem of external reference clock signal tampering.
U.S. Pat. No. 4,227,154 presents a frequency oscillator with a controlled limit on the frequency deviation from a synchronizing frequency. In this patent a digital counter that is driven by a stable high frequency source, generates a periodic signal synchronized to an external signal source. Gating circuitry responsive to particular digital counts, accumulated by the counter, defines precise quantized time intervals. The external signal is examined during these quantized time intervals for the occurrence of significant cyclic events, such as zero-crossing. However, the proposed circuit is too complicated and it relies on an accurate frequency source.
U.S. patent application Ser. No. 10/797,478 presents an advanced integrated frequency monitor for monitoring the frequencies of clock signals. However, this patent application does not provide a method for limitation of the clock signal frequency, but only provides a circuit for monitoring the frequencies of such clock signals and alerting in the case of deviation beyond the acceptable bounds.
U.S. Pat. No. 4,943,850 describes an apparatus for limiting the output signal frequency band of an optical sensor. A digital video color camera is presented having three solid-state image sensing devices and an analog-to-digital converter that converts the signal from the image sensing devices to a digital signal and a digital signal processing circuit that processes the output of the analog-to-digital converter. It further includes a clock oscillator that generates a first sampling clock signal used to drive the solid-state image sensing devices and a second clock signal having a frequency that is higher than the first frequency used to drive the digital signal processing circuit. An optical low-pass filter and an electrical low-pass filter have frequency characteristics chosen to depress the frequency band component. However, this patent relates only to optical sensors and only to the limitation of the output signal frequency band.
One disadvantage of the prior art is the fact that the reference clock is not buffered from the output clock. Therefore, the output clock frequency can deviate from the maximum and minimum frequencies and the average clock frequency does not match the reference clock. Furthermore, clock generation is not possible when no reference clock is enabled.
Therefore, there is a need to guarantee device immunity to security attacks, such as low and high frequency attacks and clock glitch attacks. The present invention fulfills this need and provides further related advantages, presenting a method and apparatus for limiting the output frequency of an on-chip clock generator to provide immunity to security attacks on the external reference signal frequency.