⚡ electrical engineering

A Switched-Capacitor Converter with Switch-Mode Time-Domain Locking and HCI-Based Self-Destruction

This paper presents a key-driven switched-capacitor converter that utilizes a non-periodic PUF-generated digital key to authenticate hardware access, where mismatched keys trigger a self-destruct mechanism via hot-carrier injection-induced degradation and a startup-time detector to disable downstream circuitry.

Original authors: Heejoon Yoon Heejoon Yoon, Utkarsh Kumar Utkarsh Kumar, Aatmesh Shrivastava Aatmesh Shrivastava

Published 2026-07-08

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Heejoon Yoon Heejoon Yoon, Utkarsh Kumar Utkarsh Kumar, Aatmesh Shrivastava Aatmesh Shrivastava

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very special, high-tech power outlet in your computer chip. Usually, these outlets are like a metronome: they turn on and off in a perfect, rhythmic beat (a clock) to move electricity around efficiently.

This paper introduces a new kind of power outlet that doesn't use a metronome. Instead, it uses a secret, 128-digit password to decide when to turn on and off. If you don't have the exact right password, the outlet doesn't just stop working; it starts to break itself permanently.

Here is how it works, broken down into simple concepts:

1. The "Secret Rhythm" (Switch-Mode Time-Domain Locking)

Think of a standard power converter like a drummer keeping a steady beat. This new design replaces the drummer with a randomized sequence of drum hits based on a secret key.

The Good Key: If you type in the correct 128-bit password, the "hits" happen in a pattern that keeps the electricity flowing smoothly, just like a well-rehearsed band. The device works perfectly.
The Bad Key: If you type in the wrong password, the rhythm gets messed up. The switches turn on and off at the wrong times, causing electricity to short-circuit (like a car engine misfiring). This creates a "shoot-through" current, which is essentially wasted energy turning into heat and stress.

2. The "Self-Destruct" Mechanism (HCI-Based Self-Destruction)

This is the most unique part. Usually, when a security system fails, it just says "Access Denied" and waits for you to try again. This system is different: every wrong attempt physically damages the chip.

The Analogy: Imagine a door lock made of soft clay. Every time someone tries the wrong key, they don't just get rejected; they have to jam the key into the lock, which chips away a tiny piece of the clay.
The Science: The paper uses a phenomenon called Hot-Carrier Injection (HCI). When the wrong password causes those electrical "misfires," it blasts high-energy particles into the tiny transistors inside the chip. This permanently shifts their electrical properties (specifically their threshold voltage).
The Result: The more wrong passwords you try, the more the chip degrades. Eventually, the chip becomes so damaged that even if you finally guess the right password, the chip is too broken to turn on. It has "aged itself out" of existence.

3. The "Guard Dog" (Startup-Time Detector)

To make sure the attacker can't just keep trying until the chip breaks, the system has a watchdog.

The Analogy: Imagine a bouncer at a club who checks your ID. If you are the right person, you walk in immediately. If you are the wrong person, the bouncer lets you in for a split second, but then realizes you are taking too long to get settled.
The Action: The chip measures how long it takes to start up. If it takes too long (which happens with a wrong key), a "lockdown" switch flips. This shuts down power to the rest of the computer immediately, preventing the attacker from trying again.

4. Why This is a Big Deal

For the Good Guys: If you have the right key, the chip works almost exactly as fast and efficiently as a normal one. The "security cost" is tiny (about 18% more space on the chip, which is very small).
For the Bad Guys: They are trapped in a race against time. To guess the 128-bit password, they would need to try trillions of combinations. However, the chip will physically destroy itself after only a tiny fraction of those attempts (roughly 14 years of non-stop guessing, which is nothing compared to the billions of years needed to guess the code).
The Math: The paper tested 100 different random keys and found they were all unique and unpredictable (high entropy). Even with a "run-length controller" (a rule that prevents the password from having too many repeating numbers), the security remains incredibly strong.

Summary

This paper presents a power supply that acts like a booby-trapped safe.

It runs on a secret, random rhythm instead of a standard clock.
If you have the right key, it runs smoothly.
If you have the wrong key, it creates electrical stress that permanently damages the internal components.
It has a timer that shuts everything down if the startup is too slow, ensuring the damage happens quickly enough to stop a hacker before they can guess the code.

The authors claim this is a new way to protect analog circuits (the "muscles" of a chip) from being stolen or copied, using the laws of physics to ensure that a failed security attempt results in permanent self-destruction.

Technical Summary: A Switched-Capacitor Converter with Switch-Mode Time-Domain Locking and HCI-Based Self-Destruction

Problem Statement
While digital hardware security has advanced significantly through cryptographic techniques and logic locking, analog and mixed-signal circuits remain vulnerable to supply-chain threats such as intellectual property piracy, counterfeiting, and reverse engineering. Existing analog locking techniques suffer from critical limitations: bias-based obfuscation often yields low incorrect-key (IK) variation due to the continuous nature of analog operating points; calibration-based methods lack inter-chip entropy; and design-based approaches often incur prohibitive area overheads or offer limited key spaces. Furthermore, conventional analog locks are often "recoverable," allowing adversaries to perform unlimited brute-force attempts by simply resetting the circuit. This paper addresses the need for a robust, non-recoverable hardware security mechanism for power management circuits, specifically Switched-Capacitor Converters (SCCs), which sit at the top of the power delivery hierarchy in System-on-Chip (SoC) designs.

Methodology
The authors propose a key-driven SCC architecture that integrates Switch-Mode Time-Domain Locking (SMDL) with a Hot-Carrier Injection (HCI) based self-destruction mechanism.

SMDL Architecture: Instead of a periodic clock, the SCC is driven by a 128-bit non-periodic digital key generated by an on-chip Physically Unclonable Function (PUF). The PUF utilizes transistor mismatch in a differential-input, single-ended folded-cascode amplifier (FCA) to generate random bits. These bits are conditioned by a digital chain comprising a serial-in parallel-out (SIPO) shift register and a Maximum-Run-Length Controller (MRLC). The MRLC enforces a maximum run length of 2 bits to ensure the SCC maintains a Quasi-Steady-State (QSS) operation even with the correct key (CK).
Operational Logic: When the supplied key matches the on-chip reference (CK), the SCC operates with high efficiency. If an incorrect key (IK) is applied, specific phase mismatches occur, creating direct conduction paths (shoot-through) from the input supply to ground.
HCI-Based Self-Destruction: The paper exploits the reliability degradation mechanism of HCI. During IK operation, the shoot-through current subjects the Low-Voltage Domain (LVD) NMOS switches to high lateral electric fields. To maximize this effect, the switches are sized asymmetrically, concentrating the voltage drop across the NMOS. The authors model the threshold voltage shift ( $\Delta V_{th}$ ) as a positive-feedback process: as $\Delta V_{th}$ increases, the switch on-resistance ( $R_{on}$ ) changes, altering the stress conditions and accelerating further degradation.
Detection and Locking: A startup-time detector monitors the time required for the output voltage to reach a stable threshold (2 V). If an IK causes a startup delay beyond a set deadline, the detector triggers a logic lock that disables downstream circuitry. Crucially, the accumulated HCI damage is irreversible; even if the correct key is reapplied later, the shifted $V_{th}$ prevents the converter from reaching its target output.

Key Contributions

First SMDL Implementation in SCCs: The work extends the SMDL technique, previously applied to amplifiers and bandgap references, to the power delivery layer. This provides a "protection leverage" where securing the PSU implicitly secures all downstream blocks.
Irreversible Security via HCI: Unlike recoverable analog locks, this design introduces a physical, irreversible failure mode. Repeated unauthorized access attempts accumulate HCI stress, permanently degrading the device until it can no longer function, effectively limiting the number of brute-force attempts.
High-Entropy Key Generation: The system utilizes a 128-bit PUF key. Statistical analysis of 100 generated keys shows a Shannon entropy of 0.993 bit/position and a Hamming-weight distribution consistent with an ideal Bernoulli(0.5) source. After run-length correction, the effective key space is approximately 89 bits ( $8.15 \times 10^{26}$ combinations).
Low Overhead Design: The proposed design achieves a security area overhead of 18.4%, which is significantly lower than prior analog locking works (e.g., 116%–175% in previous studies). Power overhead is negligible (5 µW) under authorized operation.

Results

Statistical Analysis: The MRLC successfully constrains the maximum run length to 2 without significantly degrading key uniqueness (inter-key Hamming distance remains ~49.75%). The effective key space is reduced from $2^{128}$ to $\approx 2^{89}$ due to the run-length constraint, which still renders exhaustive search infeasible (estimated $10^{14}$ years).
Performance Degradation: Under incorrect key conditions, the power conversion efficiency (PCE) drops significantly. With 64 incorrect bits, PCE falls from 0.86 to 0.29, and output voltage drops from 2.18 V to 1.96 V.
HCI Impact: Simulation results indicate that after a cumulative $\Delta V_{th}$ of 100 mV, the output voltage falls to 1.84 V and startup time increases to 23.7 µs. A $\Delta V_{th}$ of approximately 160–180 mV renders the converter inoperable even with the correct key.
Attack Window: The time required to accumulate sufficient HCI damage to destroy the chip (approx. 3.5 years of cumulative stress, or ~14 years of unauthorized probing attempts) is 14 orders of magnitude shorter than the time required to exhaust the 89-bit key space. The probability of a brute-force attacker succeeding before self-destruction is calculated at $\approx 1.15 \times 10^{-14}$ .
Robustness: The PUF control loop maintains stability (DC gain > 60 dB, phase margin > 45°) across process variations and temperatures ranging from -40°C to 100°C.

Significance
The paper claims that this design offers a scalable foundation for securing switching-based analog circuits by embedding authentication directly into the power delivery mechanism. By combining high-entropy time-domain locking with a physical self-destruction mechanism, the system eliminates the "repeated-attack advantage" inherent in recoverable analog locks. The authors emphasize that the design achieves lower power and area overheads than prior work while providing negligible performance degradation under authorized operation. The work positions the SCC not just as a power source, but as a primary gatekeeper for system security, ensuring that unauthorized access leads to permanent hardware failure rather than transient disruption.

1. The "Secret Rhythm" (Switch-Mode Time-Domain Locking)

2. The "Self-Destruct" Mechanism (HCI-Based Self-Destruction)

3. The "Guard Dog" (Startup-Time Detector)

4. Why This is a Big Deal

Summary

More like this