Tamper resistant shadow memory

1. An integrated circuit comprising a processor and memory, the memory storing a set of data representing program code and/or an operating value, wherein each bit of the data is stored as a bit/inverse-bit pair in corresponding pairs of physically adjacent bit cells in the memory.

2. An integrated circuit according to claim 1 , further including a memory management unit configured to receive a request for the set of data and to test, during processing of the request, whether the respective pairs of physically adjacent bit-cells that correspond to the set of data contain bit/inverse-bit pairs, thereby to confirm the validity of the set of data as stored in the memory.

3. An integrated circuit according to claim 2 , wherein the memory management unit is configured to store sets of data as sets of bit/inverse-bit pairs in the memory.

4. An integrated circuit according to claim 2 , configured to implement a defensive action in the event the test fails.

5. An integrated circuit according to claim 4 , wherein the defensive action includes resetting the integrated circuit.

6. An integrated circuit according to claim 4 , wherein the defensive reaction includes returning second data other than that the subject of the test.

7. An integrated circuit according to claim 6 , wherein the second data is a string of identical digits.

8. An integrated circuit according to claim 4 , wherein the defensive reaction is different depending upon whether the set of data represents program code or an operating value.

9. An integrated circuit according to claim 8 , wherein, in the event the test fails and the set of data is an operating value, the integrated circuit is configured to replace the failed value with a substitute value.

10. An integrated circuit according to claim 9 , wherein the substitute value is selected to disrupt a program running on the integrated circuit.

11. An integrated circuit according to claim 8 , wherein, in the event the test fails and the set of data is a program code, the integrated circuit is configured to replace the failed value with a substitute value.

12. An integrated circuit according to claim 11 , wherein the substitute value is selected to disrupt a program running on the integrated circuit.

13. An integrated circuit according to claim 12 , wherein the substitute causes at least some circuitry on the integrated circuit to reset.

14. An integrated circuit according to claim 2 , wherein, in the event the test fails, the integrated circuit is permanently prevented from running software.

15. An integrated circuit according to claim 2 , wherein, in the event the test fails, the integrated circuit is configured to delete from the memory some or all of the bit values associated with the set of data.

16. An integrated circuit according to claim 2 , wherein, in the event the test fails, the integrated circuit is configured to delete some or all of the contents of the memory.

17. An integrated circuit according to claim 1 , selectively operable in either of first and second modes, wherein:

in the first mode, the memory management unit is configured to receive and process a request for the set of data, and to test, during processing of the request, whether the respective pairs of physically adjacent bit-cells corresponding to the set of data contain bit/inverse-bit pairs, thereby to confirm the validity of the set of data as stored in the memory; and

in the second mode, the memory management unit is configured to receive and process a request for data stored in the memory, without testing whether pairs of physically adjacent bit-cells contain bit/inverse-bit pairs.

18. An integrated circuit according to claim 17 , wherein:

in the first mode, the memory management unit is configured to store a set of data associated with a memory write request as a corresponding set of bit/inverse-bit pairs, each of the bit/inverse-bit pairs being physically adjacent each other; and

in the second mode, the memory management unit is configured to store a set of data associated with a memory write request as the set of data without corresponding inverse-bits.

19. An integrated circuit according to claim 17 , configured to boot into the first mode by default.