Semiconductor Security Techniques Utilizing Invisible Bias Generators

Transcription

1 Create Protect Authenticate Semiconductor Security Techniques Utilizing Invisible Bias Generators Semiconductor hacking techniques such as fault injection, circuit monitoring, and memory content retrieval involving high end equipment such as Focused Ion Beam (FIB) circuit editors[1] can be used to reveal secret elements of the semiconductor design such as cryptographic keys and algorithms[2]. In addition, reverse engineering semiconductor devices[3] using mentioned above techniques along with other tear down procedures are a proven method for examination, analysis, and hacking[4] of such devices. An infamous hacker known by the code name bunnie [5] was quoted to say There are no secrets in silicon. Semiconductor tear down techniques typically involve imaging a device layer, removing the layer, imaging the next layer, removing the layer, and so on until a complete representation of the semiconductor device is realized. Layer imaging is usually accomplished using an electron microscope or by the combination of staining the die (in order to highlight amorphous regions) and the use of a high resolution microscope. Layer removal can use physical means such as grinding or polishing, or chemical means by etching specific compounds. Once the semiconductor device tear down is complete and the imaging information is gathered, the logic function of the device can be reconstructed by the use of diffusion, polysilicon, and well areas to define the MOS devices used to create logic gates, and the metal layers to define how the logic gates are interconnected. Most semiconductor processes that contain logic functions provide different types of MOS devices to be used in different environments. For example, one device must operate only at lower voltages but can be sized to minimum geometry, while another device can operate at higher voltages and cannot be sized to minimum geometry. This allows the semiconductor device to interface to external signals that are higher in voltage when compared to the internal minimumsized devices. [1] Why Every Chip Can Be Hacked With This Tool. Ernest Worthman. August 4,2014. [2] Deconstructing a Secure Processor. Christopher Tarnovsky Tarnovsky-DASP-slides.pdf. February 2, [3] Reverse Engineering in the Semiconductor Industry. Randy Torrance and Dick James, Chipworks, Inc. IEEE 2007 Custom Integrated Circuits Conference. [4] Hacker (computer security). Wikipedia. June 17, [5] bunnie: studios. June 18, Verisiti, Inc. All Rights Reserved Worldwide. 1

2 The type of MOS device in the previous example is typically controlled by the electrical characteristics of the diffusion material. These characteristics are changed by slightly altering the atomic structure of this material by exposing the diffusion to gases at high temperature. This process is normally described as doping. This slight change of electrical properties cannot be detected by the use of scanning electron microscopes or by the combination of die stain and optical microscope. To provide an effective deterrent to semiconductor device tear down techniques, a circuit that depends on the electrical differences due to slight doping changes while maintaining identical device geometry is used. The gates on the P channel devices are charged via leakage to VCC while the gates on the N channel devices are charged via leakage to ground. The size of the conduction channel is determined by the doping levels of the diffusion area, which in turn determines the voltage level on the P and N channel device junction. The difference in voltage bias levels is used as the criteria for determining whether this device has a logic output of 1 or 0. The logic function of this circuit is invisible to reverse engineering tear down techniques. This patented circuit is referred to as an Invisible Bias Generator or IBG[6]. The Invisible Bias Generator is a MOS transistor pair (N channel, P channel) with identical geometries that provide an output connection to a logic element. This output must be either at VCC (high) or at ground (low). Intermediate values will cause excessive current to flow and will not function properly. [6] US Patent No. 8,975,748. Additional Patents Pending Verisiti, Inc. All Rights Reserved Worldwide. 2

3 VCC floating gates VOUT With the gate inputs of the devices disconnected (floating), the output must be determined solely by the characteristics of the MOS transistors and parasitic devices. This information is available if the designer (or hacker) has intimate knowledge of the semiconductor process used to create the device. Without knowledge of these characteristics or parasitic devices, the value of VOUT is unknown, thus it represents an invisible bias. Typically, this type of invisible bias circuit is unstable because the circuit depends on the relationship of the P and N channel devices. These devices are so dissimilar in operation that the overall gain is large and the output result is not stable unless the gates are driven. Verisiti, Inc. All Rights Reserved Worldwide. 3

4 VCC floating gates VOUT 1 VOUT 2 Adding a second transistor pair and connecting the floating gates of the P channel and N channel devices together result in the values VOUT1 and VOUT2 depending on the characteristic relationship of the P channel pair and the N channel pair. This relationship can now be modified by using parasitic devices to result in stable operation. Another critical aspect of semiconductor security is the ability to prevent circuit monitoring, measurements, and modification. Using patented IBG technology, an effective shield is developed preventing equipment such as FIB editors and physical etching devices to be used for circuit analysis or modification. This shield is formed when a nearly solid metal layer is created without any direct connection to active circuitry, and then coupled to an IBG floating gate with a capacitor. Due to the antenna effect[7], the IBG floating gates are subjected to gate oxide breakdown which causes the IBG cell to fail and change state. The antenna effect occurs when charge accumulates on the metal shield creating a voltage exceeding the maximum dielectric voltage leading to both hard and soft gate oxide breakdown[8] events. Unlike digital circuits, the IBG cell is sensitive to soft gate oxide breakdown since leakage current increases in this state, causing the floating gate bias to change. The following image shows the layout of an IBG cell coupled to a metal security shield. The floating gates of the IBG cell are connected to the metal layer, and then surrounded by the remaining metal. This gap creates a side wall capacitor coupling the gate to the shield. [7] Antenna effect. Wikipedia. July 3, [8] Gate Oxide Breakdown. Navid Azizi and Peter Yiannacouras. December 8, Verisiti, Inc. All Rights Reserved Worldwide. 4

5 A single FIB edit will cause gate oxide breakdown on multiple IBG cells rendering the circuit inoperable. This prevents many popular hacking techniques such as fault injection, bus monitoring, secure boot attacks, and memory content retrieval. In conclusion, patented IBG technology is a unique countermeasure to all types of semiconductor hacking techniques. A few hundred IBG devices included in a design along with the associated security screen is a low cost semiconductor security solution. Keeping secrets in silicon may be realized after all. Verisiti, Inc. All Rights Reserved Worldwide. 5