292 IEEE JOURNAL OF SOLID-STATE CIRCUITS, VOL. 43, NO. 1, JANUARY 2008 UHF RFCPUs on Flexible and Glass Substrates for Secure RFID Systems Yoshiyuki Kurokawa, Takayuki Ikeda, Masami Endo, Hiroki Dembo, Daisuke Kawae, Takayuki Inoue, Munehiro Kozuma, Daisuke Ohgarane, Satoru Saito, Koji Dairiki, Hidekazu Takahashi, Yutaka Shionoiri, TomoakiAtsumi, Takeshi Osada, Kei Takahashi, Takanori Matsuzaki, Hiroyuki Takashina, YoshinariYamashita, and Shunpei Yamazaki Abstract—A radio frequency integrated circuit (RFIC) tag consisting of an 8 bit CPU, a 4 kB ROM, a 512B SRAM, and an RF circuit, which communicates using 915 MHz UHF RF signals, has been developed on both a ﬂexible substrate and a glass substrate. Each of the RFIC tags employs a single DES and an anti-side channel attack routine in ﬁrmware for secured communication, and occupies an area of 10.5 mm in width and 8.9 mm in height. The RFIC tag on the ﬂexible substrate is 145 m thick and weighs 262 mg, and the RFIC tag on the glass substrate consumes 0.54 mW at a power supply voltage of 1.5 V and communicates with a maximum range of 43 cm at a power of 30 dBm. The high-performance poly-silicon TFT technology on ﬂexible substrate and glass substrate of 0.8 m design rule, and a gate plus one metal layer are used for fabrication. The RFIC tag realizes stable internal clock generation and distribution by a digital control clock generator and a two-phase nonoverlap clock scheme, respectively. Index Terms—Digital control clock generator, poly-silicon TFT, RFIC tag, RFID. I. INTRODUCTION R ADIO-FREQUENCY identiﬁcation (RFID) technology is one of the key technologies of the coming ubiquitous- computing era, and it is expected to grow to a thriving multibil- lion-dollar industry centering around distribution systems, in- cluding supply chain management. However, for RFID to be utilized to its full potential there are certain capabilities that radio-frequency integrated circuit (RFIC) tags needs to support: ﬁrst, an RFIC tag must have physical ﬂexibility to be attached to a wide variety of merchandise such as books and fresh foods; second, an RFIC tag must be produced at ultra-low cost; third, an RFIC tag must have high conﬁdentiality in communication. Although it is difﬁcult to realize the ﬁrst and second capabil- ities with conventional silicon LSI, organic transistors may re- alize these capabilities. However, only low-performance organic transistors have been realized as yet [1]–[3], and therefore the third capability has not been achieved. Manuscript received April 27, 2007; revised October 23, 2007. Y. Kurokawa, T. Ikeda, M. Endo, H. Dembo, D. Kawae, T. Inoue, M. Kozuma, D. Ohgarane, S. Saito, K. Dairiki, H. Takahashi, Y. Shionoiri, T. Atsumi, T. Osada, K. Takahashi, T. Matsuzaki, and S. Yamazaki are with the Semiconductor Energy Laboratory Company, Ltd., Kanagawa 243-0036, Japan (e-mail: kurokawa@sel.co.jp). H. Takashina and Y. Yamashita are with the Devices Development Center, TDK Corporation, Ichikawa, Chiba 272-8558, Japan. Digital Object Identiﬁer 10.1109/JSSC.2007.914743 In response to such demands, the authors recently proposed a 13.56 MHz RFCPU on a ﬂexible substrate and a glass sub- strate [4] which are RFIC tags containing an 8 bit CPU and an RF circuit, having a software-programmed decryption func- tion and which communicate with a 13.56 MHz RF signal. The 13.56 MHz RFCPUs are fabricated by using our high-perfor- mance poly-silicon thin-ﬁlm transistor (TFT) technology on the ﬂexible substrate [5] and that on the glass substrate [6]–[8]. Since the proposal of the 13.56 MHz RFCPU, the demand for further sophisticated RFIC tags for building a more func- tional RFID system continues to grow. Such demands are, for example, extension in communication range, reduction in power consumption, and improvement of an encryption function such as resistance to side channel attacks. For these demands, we con- sidered the feasibility of a UHF RFCPU [9], which is a high-per- formance RFIC tag containing an 8 bit CPU and an RF circuit that communicates with UHF (915 MHz) RF signals, since long distance communication is more possible in principle than 13.56 MHz RF signals. However, in employing the UHF RF signal, there are many challenges in terms of circuits such as stable gen- eration and distribution of clock signals. Further, in order to also satisfy the other demands above, the design of the 13.56 MHz RFCPU itself needs to be reconsidered. In our UHF RFCPU, the generation of clock signals with stable frequency and the distribution of clock signals unaf- fected by characteristic variation of poly-silicon TFTs have been realized by the digital control clock generator and the two-phase nonoverlap clock scheme, respectively. Reduction in power consumption is realized by some design ideas such as improvements in operation efﬁciency of the CPU and control of the active region of the memory, and as a result, power con- sumption is signiﬁcantly lower than the 13.56 MHz RFCPU. Further, by reducing the number of transistors of the CPU and the controller, the capacity of the memory can be increased at the same time as reducing chip size, which is an improvement from the 13.56 MHz RFCPU. By the increase in memory capacity, the anti-side channel attack function can be realized by using ﬁrmware to improve the encryption function. II. CIRCUIT DESIGN A. Overview The speciﬁcation of the wireless communication between the UHF RFCPU and the reader is shown in Table I. The speciﬁ- cation is partially based on Auto-ID Center Class I Region 1 (North America). An RF signal with a frequency of 915 MHz is 0018-9200/$25.00 © 2008 IEEE