IOLTS th IEEE International On-Line Testing Symposium

Transcription

1 IOLTS th IEEE International On-Line Testing Symposium Exp. comparison and analysis of the sensitivity to laser fault injection of CMOS FD-SOI and CMOS bulk technologies J.M. Dutertre 1, V. Beroulle 2, P. Candelier 3, L.B. Faber 3, M.L. Flottes 4, P. Gendrier 3, D. Hély 2, R. Leveugle 5, P. Maistri 5, G. Di Natale 4, A. Papadimitriou 2, B. Rouzeyre 4 Wednesday, July 4 th 2018 Platja D Aro, Costa Brava, Spain (1) (2) (3) (4) (5)

2 Laser Fault Injection CMOS bulk vs FD-SOI! Who s interested in laser fault injection? " Radiation effects community since 1967! ICs for spatial & aircraft applications! Single Event Effects (SEEs) induced by ionizing particles! Pulsed laser (ps range) used for SEE emulation! Various countermeasures: techno. & process? (small market) CMOS Silicon On Insulator (SOI) less sensitive to SEEs The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits, D. Habing,

3 Laser Fault Injection CMOS bulk vs FD-SOI! Who s interested in laser fault injection? " Hardware Security community! Concept of fault injection: 1997 D. Boneh et al.! Laser fault injection: 2002 S. Skorobogatov et al.! Technological countermeasure?! SOI to mitigate laser fault injection! Dev. of a dedicated process is expensive On the Importance of Checking Cryptographic Protocols for Faults, Dan Boneh et al, 1997 Optical Fault Induction Attacks, S. Skorobogatov et al,

4 Laser Fault Injection CMOS bulk vs FD-SOI " UTBB FD-SOI (Ultra-Thin Body and Box Fully-Depleted SOI)! is now a mature technology (ST Micro, Samsung, GlobalFoundries)! Ultra Low Power application (low static leakage, body biasing)! Laser-induced faults/sees mitigation properties? Topic of this talk: FD-SOI laser fault injection mitigation properties, and comparison with CMOS bulk, on experimental basis at the 28 nm tech. node 4

5 Outline I. Introduction II. Theory of laser fault injection III. State of the art IV. Laser sensitivity assessment of FD-SOI and CMOS bulk V. Conclusion 5

6 Outline I. Introduction II. Theory of laser fault injection! Mechanism, photoelectric effect! LFI sensitivity of CMOS bulk! LFI sensitivity of CMOS FD-SOI III. State of the art IV. Laser sensitivity assessment of FD-SOI and CMOS bulk V. Conclusion 6

7 ! Photoelectric effect: transient current generation Theory of laser fault injection Laser Drain ( Gnd V DD ) I max Transient current Current (ma) E N + diffusion Depletion region P substrate (Gnd) Current peak Drift current Time (ns) Laser sensitive areas: reverse biased PN junctions 7

8 Theory of laser fault injection! Fault injection mechanism: CMOS bulk inverter transient current # voltage transient (SET, single event transient) in 0 Metal 1 MOS gate out 1 => 0 C to Gnd to Vdd P+ N+ N+ P+ P+ N+ P substrate NMOS OFF PMOS ON N well laser beam Voltage transient # fault (prop. into DFF, or memory flip) 8

9 Theory of laser fault injection! LFI sensitivity of CMOS bulk nmos pmos B (gnd) S G D D G S B (Vdd) P+ P substrate N+ (a) N+ (1) P+ P+ N+ (2) (b) Nwell (c) (3) PN junctions = laser sensitive ares of CMOS devices: 3 types Parasitic bipolar transistors: 3 types (a), (b), (c) (1), (2), (3) 9

10 Theory of laser fault injection! CMOS FD-SOI structure Regular Vt transistors G NMOS G gnd B (gnd) S D D S B (Vdd) P+ STI P+ N+ N+ P+ P+ box box STI STI STI STI N+ Pwell Nwell P substrate P+ type Si P type Si P substrate gate N+ type Si N type Si Insulator (STI or box or gate oxide) 10

11 Theory of laser fault injection! CMOS FD-SOI structure Regular Vt transistors gnd P+ STI B (gnd) P+ G S D D Channel: Sintrinsic B (Vdd) Si N+ N+ P+ P+ box box STI STI STI STI N+ Pwell NMOS G (thickness < 10 nm) Nwell Reduced charge collection volume Reduced laser sensitivity? P substrate Isolation box (thickness < 30nm) P+ type Si P type Si P substrate gate N+ type Si N type Si Insulator (STI or box or gate oxide) 11

12 Theory of laser fault injection! CMOS FD-SOI structure Regular Vt transistors Laser sensitive PN junctions: 1 type (1) G G gnd B (gnd) S D D S B (Vdd) P+ STI P+ N+ N+ P+ P+ box box STI STI STI STI N+ Pwell Nwell (1) P substrate 12

13 Theory of laser fault injection! Laser sensitivity of FD-SOI V S = 0 Source N+ emitter e Channel Gate oxide V FG = 0 base h + collector e V D> 0 Drain N+ BOX Pwell V BG = 0 Parasitic bipolar NPN transistor Laser induced charge carriers + holes: (h h + ) electrons: (e e) - 13

14 Theory of laser fault injection! Laser sensitivity of FD-SOI V S = 0 Source N+ emitter e Channel Gate oxide V FG = 0 base h + collector e V D> 0 Drain N+ BOX Pwell V BG = 0 Parasitic bipolar NPN transistor amplification effect on the laser-induced current 14

15 Theory of laser fault injection! Laser sensitivity of FD-SOI vs CMOS bulk Advantages of FD-SOI (rule of thumbs): isolation box under transistors x10 (factor in lower sensitivity) smaller sensitive area x2 (factor in lower sensitivity) # less charge sharing between transistors. Parasitic bipolar amplification effect on the laser-induced current: # there are still faults # x10 and x2 may not be fullfilled Radiation hardness of FDSOI and FinFET technologies, M.L. Alles et al,

16 Outline I. Introduction II. Theory of laser fault injection III. State of the art! Radiation focused State-of-the-art! Security focused State-of-the-art IV. Laser sensitivity assessment of FD-SOI and CMOS bulk V. Conclusion 16

17 State-of-the-art " Radiation focused state-of-the-art! Neutrons, heavy ions, laser! Laser for SEE emulation: 1 µm diameter, ps range! SOI or FD-SOI, 0.2 µm to 28 nm! Mainly on elementary test patterns 1-2 orders of magnitude in favor of SOI/FD-SOI 17

18 State-of-the-art " Security focused state-of-the-art! CMOS bulk vs CMOS FD-SOI at 28 nm! Elementary test patterns: wells or transistors! Laser settings: 1,064 nm, 1-5 µm diameter, ns & µs ranges 1 order of magnitude in terms of peak current FD-SOI: smaller extension of sensitive areas 18

19 Outline I. Introduction II. Theory of laser fault injection III. State of the art IV. Laser sensitivity assessment of FD-SOI and CMOS bulk! Experimental setup! Radiation-centric experimental results! Attack-centric experimental results V. Conclusion 19

20 " Experimental setup Laser sensitivity of FD-SOI vs CMOS bulk 20

21 Laser sensitivity of FD-SOI vs CMOS bulk " Experimental setup Backside injection Pulse width: 30 ps up to 100 nj Wavelength: 1,030 nm Pulse width: ns 5-50 ns, max. power 1 W 50 ns 1 s, max. power 3 W Wavelength: 1,064 nm Spot size: 1µm or 5 µm 21

22 " Test chips CMOS 28 nm! Target: AES implementation (with parity-based CM) Vdd = 1.2 V IR microphotography (rear side), obj. x20 Laser sensitivity of FD-SOI vs CMOS bulk CMOS bulk Thickness ~ 100 µm CMOS FD-SOI Thickness ~ 100 µm 22

23 " Experiments description Laser sensitivity of FD-SOI vs CMOS bulk Laser head y x Laser fault injection threshold + 2,000 injections attempts per test Full functional IP running at 100 MHz 23

24 Laser sensitivity of FD-SOI vs CMOS bulk " Radiation-centric experimental results! Laser parameters: 30 ps, 1 µm laser spot diameter Laser fault injection threshold CMOS bulk CMOS FD-SOI [W] [mw/µm 2 ] [W] [mw/µm 2 ] Laser: 30 ps / 1 µm 0.2 nj 16.9 pj/µm nj 50.6 pj/µm 2 x3 24

25 Laser sensitivity of FD-SOI vs CMOS bulk " Radiation-centric experimental results! Laser parameters: 30 ps, 1 µm laser spot diameter 30 ps, 5 µm laser spot diameter Laser fault injection threshold CMOS bulk CMOS FD-SOI [W] [mw/µm 2 ] [W] [mw/µm 2 ] Laser: 30 ps / 1 µm 0.2 nj 16.9 pj/µm nj 50.6 pj/µm 2 Laser: 30 ps / 5 µm 0.3 nj 2.2 pj/µm nj 15.4 pj/µm 2 FD-SOI vs bulk: x3 factor sensitivity decrease disappointing at 1 µm, FD-SOI vs bulk: x7 factor at 5 µm close to state-of-the-art. x7 25

26 Laser sensitivity of FD-SOI vs CMOS bulk " Attack-centric experimental results! Laser parameters: 10 ns, 1 µm laser spot diameter Laser fault injection threshold CMOS bulk CMOS FD-SOI [W] [mw/µm 2 ] [W] [mw/µm 2 ] Laser: 10 ns / 1 µm

27 Laser sensitivity of FD-SOI vs CMOS bulk " Attack-centric experimental results! Laser parameters: 10 ns, 1 µm laser spot diameter 10 ns, 5 µm laser spot diameter Laser fault injection threshold CMOS bulk CMOS FD-SOI [W] [mw/µm 2 ] [W] [mw/µm 2 ] Laser: 10 ns / 1 µm Laser: 10 ns / 5 µm No fault (1W limit) 27

28 Laser sensitivity of FD-SOI vs CMOS bulk " Attack-centric experimental results! Laser parameters: 10 ns, 1 µm -10 ns, 5 µm 50 ns, 5 µm laser spot diameter Laser fault injection threshold CMOS bulk CMOS FD-SOI [W] [mw/µm 2 ] [W] [mw/µm 2 ] Laser: 10 ns / 1 µm Laser: 10 ns / 5 µm Laser: 50 ns / 5 µm x7 28

29 Outline I. Introduction II. Theory of laser fault injection III. State of the art IV. Laser sensitivity assessment of FD-SOI and CMOS bulk V. Conclusion 29

30 Conclusion " Analysis Laser fault injection threshold CMOS bulk CMOS FD-SOI [W] [mw/µm 2 ] [W] [mw/µm 2 ] Laser: 30 ps / 1 µm 0.2 nj 16.9 pj/µm nj 50.6 pj/µm 2 Laser: 30 ps / 5 µm 0.3 nj 2.2 pj/µm nj 15.4 pj/µm 2 Laser: 10 ns / 1 µm Laser: 10 ns / 5 µm Laser: 50 ns / 5 µm Advantage of CMOS FD-SOI over CMOS bulk: 1-2 order of magnitude of the SotA not fulfilled, At 1 µm spot diameter: a factor 2-3 At 5 µm spot diameter: a factor 7 30

31 Conclusion " Analysis! FD-SOI vulnerability? G G gnd B (gnd) S D D S B (Vdd) P+ STI P+ N+ N+ P+ P+ box box STI STI STI STI N+ P substrate Pwell Nwell (1) Laser sensitive PN junctions: (1) Laser-induced Vdd drop? 31

32 " Analysis! Interest of a 2-3 lower laser sensitivity? Conclusion Intrinsic to FD-SOI, Equivalent to a similar increase in laser sensors efficiency, eg BBICS: 32

33 Thank you for your attention Work funded by the ANR: LIESSE project J.M. Dutertre 1, V. Beroulle 2, P. Candelier 3, L.B. Faber 3, M.L. Flottes 4, P. Gendrier 3, D. Hély 2, R. Leveugle 5, P. Maistri 5, G. Di Natale 4, A. Papadimitriou 2, B. Rouzeyre 4 (1) (2) (3) (4) (5)