Circuit to Protect Against Multi-Rail Voltage Glitching Attacks

A system-on-chip (SoC) comprising:

• a plurality of functional circuits powered by one or more power rails;
• a bandgap circuit configured to generate reference voltages from at least one of the power rails;
• a glitch detector configured to detect voltage conditions on the one or more power rails using the reference voltages;
• a self-referencing detector configured to detect the voltage conditions independently of the reference voltages;
• the SoC configured to:
• detect voltage glitching on the one or more power rails using the glitch detector when the bandgap circuit is operational;
• and
• in response to a voltage glitch that collapses the bandgap circuit and renders the reference voltages unreliable, perform a failover operation in which detection of the voltage conditions is performed by the self-referencing detector.

A method for detecting voltage glitching in a circuit, comprising:

• generating one or more reference voltages using a bandgap circuit;
• detecting a voltage condition on a power rail using a first detection circuit that utilizes the reference voltages;
• detecting the voltage condition using a second detection circuit that operates independently of the reference voltages;
• and
• responsive to determining that a voltage glitch has caused a collapse of the bandgap circuit resulting in instability of the reference voltages, performing a failover operation in which detection of the voltage condition is performed using the second detection circuit.

A protection circuit comprising:

• a bandgap circuit configured to generate one or more reference voltages from a power rail;
• a first voltage glitch detection circuit configured to utilize at least one of the reference voltages to generate a first reset signal in response to a voltage condition on the power rail;
• a second voltage glitch detection circuit comprising a self-referencing detector configured to generate a second reset signal independently of the reference voltages;
• and
• wherein the protection circuit is configured such that, responsive to a false de-assertion of the first reset signal due to a collapse of the bandgap circuit, the second reset signal remains asserted to maintain detection of the voltage condition.