From IC Debug to Hardware Security Risk: The Power of Backside Access and Optical Interaction

Transcription

1 From IC Debug to Hardware Security Risk: The Power of Backside Access and Optical Interaction C. Boit, S. Tajik*, P. Scholz, E. Amini, A. Beyreuther, H. Lohrke, J.P. Seifert* Technische Universität Berlin, Semiconductor Devices, *Security in Telecommunications Einsteinufer 19, Sekr. E4, Berlin, Germany, *Ernst-Reuter-Platz 7, Sekr. TEL 17, Berlin, Germany Phone: Fax: Abstract- IC debug and diagnosis techniques like photon emission and FIB circuit edit are well established as powerful ways to attack secret codes in security ICs through chip frontside. But protective additions like interconnect meshes serve as countermeasures. This work shows examples how the risk assessment of contactless fault isolation (CFI) techniques through chip backside has indicated a drastic increase of vulnerability. Acclaimed unclonable functions and keys have been successfully challenged. There is no low-cost electronic backside protection concept available like the frontside meshes, because alignment and contact of backside structures to active IC layers cannot be handled without expensive through-silicon-via (TSV) technologies. But optical interaction can also be used to create backside protection concepts: Such concepts based on electro-optical properties are presented and proven to be operational. I. INTRODUCTION Originally, all signal tracking IC analysis of the chip has been performed by probing with needles or contactless physical interactions directly on the planar technology layers of the chip. With the help of focused ion beam (FIB), conductive connections to lower levels and / or probing pads improved the access to local IC functionality. Even circuit modification has been established to create engineering samples in IC debug under the name of circuit edit (CE). All these techniques are not only powerful ways of signal tracking and trimming of functionality, the analytical power can as well be used to approach data to be kept secret and copy codes and thus became common ways to challenge the sensitive information on security ICs like smartcards [1, 2, 3]. A number of countermeasures have been developed in order to protect the chip surface. Additional interconnect meshes are standard now whose integrity can be monitored electrically and the card will be deactivated once the resistivity of the meshes indicates a violation. The expansion of IC interconnect levels to 5 and higher plus new packaging concepts like ball grid arrays and flip chip technologies were triggers for a paradigm shift in the world of IC debug & diagnosis and failure analysis. The access to local performance information of the chip had since then to pass chip backside. Mainly optical techniques have been developed (time resolved photon emission, laser stimulation, laser voltage probing [4, 5, 6]) taking advantage of the high infrared (IR) transmission for wavelengths > 1 µm as long as the substrate is not highly doped. Probing and CE were successful through chip backside after FIB-based local substrate removal has been established. This paper investigates how the progress in IC signal tracking is affecting the vulnerability of security functions and how the chip can be protected from such challenges. II. OPTICAL IC DEBUG IN FINFET AGE One of the hardest challenges for optical IC debug techniques is the ever increasing miniaturization, now managing to handle feature sizes of 10 nm and smaller. Resolution R in optical imaging is a function of wavelength λ: R λ / (2 NA), NA: Numerical Aperture (in air < 1) (1) With λ 1 µm, R is at best around 500 nm if the chip is simply put into the optical path of the instrument. Introducing immersion, namely a spherical solid immersion lens (SIL) on back surface, NA is increased by the index of refraction n SIL [7] (see Figure 1). For silicon and λ = 1 µm, n is 3.5, resulting in a maximum R of around 150 nm. (a) Fig. 1. Imaging from the chip s backside through silicon substrate (a) without and (b) with a solid immersion lens (SIL). If the resolution needs to increase further, the NA part of the equation in exhausted. Wavelength reduction is the only possible approach. There are a few publications stating that contactless fault isolation (CFI) can improve with the use of visible light (VIS) [8, 9, 10]. But the increase of photon energy means a dramatic increase in absorption. Figure 2 shows that a wavelength reduction from 1 µm (NIR) to 550 nm changes the absorption depth in silicon by 2 orders of magnitude from ca. 150 µm to 1.5 µm. This is not only a real challenge for sample preparation, it also means that the SIL material can no longer be silicon. Such a VIS setup requires some new solutions [10], with a back surface suitable for SIL application. For wavelengths up to 550 nm, GaP is a very suitable material, keeping the NA almost on the same level and resulting in a maximum resolution of about 80 nm. For shorter wavelengths, the SIL material would reduce the NA by 30% and (b)

2 more. So, a better resolution than 80 nm can optically only be achieved if the wavelength would be reduced to ca. 330 nm, with an absorption depth of 10 nm which is probably out of reach. Therefore, 550 nm excitation wavelength and the use of GaP SILs will probably be the best that optics can do for debug with a resolution of about 80 nm. Fig. 3. Technology generations with their FET pitch sizes according to ITRS roadmap [13]. Grey areas indicate fault isolating capability in real world IC debug with NIR and NIR+SIL based on [12] and adapted for VIS+SIL. Fig. 2. Absorption depth of silicon at 300 K as a function of the wavelength, based on [11]. Debug is all about the identification of a failing device. The node that gives a technology the feature size number is just the smallest existing feature, the gate length in planar devices and the fin width in FinFETs. A full device is larger, expanded by source / drain area and the respective share of the device in isolation area. This full device dimension is called pitch, altogether by a factor of around 3 to 5 larger than minimum feature size. Figure 3 shows how ITRS correlates the FET pitch to the technology generation. The image also shows the 3 relevant resolution levels of NIR, NIR plus Si SIL and VIS plus GaP SIL. The present FinFET technologies have pitch dimensions of nm, about a factor of 2 smaller than R at λ = 1 µm with Si SILs. There seems to be a relaxing margin of about 3x in resolution for real world IC debug, as table 1 in [12] suggests. This extra margin can also be expected for VIS analysis and is adumbrated in Figure 3 with a grey shadow under the resolution marks. The essence of recent debug technique development is that optical IC debug will be good enough to serve technology generations to 10 nm and smaller. This is a strong statement also towards the security IC community: Optical attack techniques through chip backside will not lose their risk potential with the transition to smaller dimension technologies. III. OPTICAL IC DEBUG AND HARDWARE SECURITY RISK ASSESSMENT A. Physically Unclonable Functions Due to lack of proper protection against semi- and fully-invasive attacks from the IC backside, the secret data can be extracted from conventional storage technologies, such as SRAMs and efuses. One advanced solution, which has been already integrated by different vendors into the modern System on Chips (SoCs), are Physically Unclonable Functions (PUFs) [14]. PUFs utilize the existing manufacturing process variations on the chip to create an instance-specific fingerprint, which can be used to authenticate individual chips. Moreover, by utilizing the variations as an entropy source, PUFs can generate secure keys instantly on the chip. Hence, no key is required to be stored on the chip. The input and output of a PUF are called challenge and response, respectively. Regarding the characteristics of intrinsic PUFs, they can be classified into two groups [15]: memory-based PUFs and delay-based PUFs. Memory-based PUFs exploit the settling state of digital memory circuits such as SRAM cells or flip-flops. SRAM cells consist of two inverters in a loop and two transistors for read and write operation. Due to variations in manufacturing process the state the SRAM cells will be settled randomly to logical 1 or 0 after power-up. If the states are repeatable upon each power-up, the logical addresses of SRAM cells can be seen as the challenges and the state of the SRAM cells as PUF responses. Delay-based PUFs, on the other hand, utilize the intrinsic differences in timing of a set of symmetric circuit paths on the chip to generate a unique response. Arbiter and Ring Oscillator (RO) PUF are two popular instances of delay-based PUFs. For instance, an RO PUF consists of n independent ROs. The challenge applied to the multiplexers selects a ring-oscillator

3 pair and connects the outputs of selected ROs to the clock inputs of two binary counters. The counter states (i.e., the measured frequency of ROs) are compared to each other after a predefined period. Based on this comparison a binary response is generated, see Figure 4. Fig. 5. The outputs of 3 RO implemented on an Altera MAX V device. Fault injection into one of the inverters of RO 3 hinder the oscillation of that RO, while the other 2 ROs continue oscillation. Similarly, RO 2 can be deactivated later in time, while RO 1 continues oscillation. Fig. 4. A simplified schematic of an RO PUF construction. Each RO consists of odd number of the inverters and an AND gate to enable or disable the ring. Although unclonability and unpredictability are the main requirements of the PUFs, different attacks in the literature have demonstrated how these hardware primitives can be cloned and predicted. While SRAM PUFs could be readout and physically cloned with the help of photon emission and FIB [16], delay-based PUFs could be modeled and characterized by modeling and side-channel attacks [17, 18, 19] (see Section III.B). B. Vulnerability of PUFs to Optical IC Debug Techniques The acquisition of valuable internal IC signals through chip backside is orders of magnitude better in comparison to frontside attacks. Between active device and detection system there is no structured interaction like interconnect geometries, so the interaction signal is quantitatively comparable. This fact allows introducing techniques that would never work through frontside, like laser voltage probing (LVP) and its derivatives. Reading out SRAM cells in an SRAM PUF is successful with backside photon emission. This technique, though, requires more than 1000 readout iterations for noise suppression, a fact that would make several security protection circuits to raise an alarm flag that something unexpected happened. Using thermal laser stimulation [16], reading out SRAM is also successful with the clock turned off, so the real time consumption of the attack would not be noticed by the chip internal event counters. Furthermore, laser beams can be used to inject faults into the delay-based PUF circuits to either simplify the modeling attacks or to reduce the entropy of the generated PUF responses [17]. In the latter case, for instance, the attacker can convert the inverters of individual ROs to a non-inverting gate, by manipulating the configuration of the lookup-tables (LUTs) of a programmable logic. Hence, the oscillation is hindered and the response entropy is reduced (Figure 5). Here, we focus on electro-optical frequency modulation (EOFM) and electro-optical probing (EOP), an LVP derivative that has only rarely been used for security attacks yet. We show the great potential to read out waveforms and do a perfect ring oscillator characterization that challenges RO PUFs. If the attacker has access to the challenges and responses of an RO PUF, the precise measurement of the RO frequencies leads to complete characterization and cloning of the PUF [20]. The attacker can estimate the approximate frequency of the ROs by power analysis in frequency domain. However, the limited resolution of this method will not enable the attacker to precisely measure the individual RO frequencies, but rather the superposition of all frequencies. If the attacker perform an EOFM measurement at this approximate frequency with large enough bandwidth, the nodes of the ROs and all registers, which are switching with the same frequency, can be detected on the chip, see Figure 6a. Fig. 6. (a) EOFM image of inverters of an RO implemented on an Altera Cyclone IV device. (b) EOP spectrum of an RO. In the next step, by performing EOP on an inverter of the RO and connecting the reflected light signal of the EOP measurement to the spectrum analyzer, the attacker is able to precisely measure the frequency of individual ROs, see Figure 6b.

4 IV. OPTICAL INTERACTION AND HARDWARE SECURITY PROTECTION CONCEPTS The vulnerability of security features in ICs in presence of backside attacks is very obvious. Protection is an unavoidable requirement but technically not so easy to achieve. Countermeasures like electrically monitorable protection meshes do not apply for backside because there is no common alignment for backside and frontside structuring. Technologies that connect to chip backside like through-silicon vias (TSV) are comparably expensive and only applied in high-performance products. But with the experience from optical debug techniques, the operation of electronic devices with optical interaction is already familiar. For backside protection, an application of optoelectronics in the world of IC can be very helpful. An example will be given in the following. Ideas of backside protection like this one are covered by a more general patent pending by C. Boit and B. Szyszka of TU Berlin, Germany. Forward bias operation of pn junctions accompanied by light emission, depleted areas like pn junctions in reverse bias are detecting photocurrents. Each logical node in ICs consists of MOSFETs that pn junctions are mandatory elements of. If light emitted from a pn junction is transmitted through silicon, the part which is reflected from back surface will be detectable by another pn junction. So, an optical signal can be released by a specific IC operation at one node that in turn is able to create an electrical signal at a different location. The intensity of the detected photocurrent may depend on the reflection properties of the back surface. An active backside protection concept may use a treatment of the back surface that provides angle-dependent reflection in combination with full transmission blocking. Then, the photocurrent can be used as the signal to indicate integrity of the backside protection layer. Such a concept is presented in Figure 7. The pn junction driven in forward bias (named LED) is emitting light that gets reflected and transmitted to a detecting pn junction (named PD, like photodetector). From device thickness d and the distance of LED to PD, the reflection angle can be calculated (Table I). Then, as displayed in Figure 8, the ratio of a few photocurrents with respect to the reflection angles can be detected. Our test structure shows a clear measurement evidence of presence or absence of the protective layer. Table II shows that the difference is close to the simulated angle dependence of the deposited layer (Figure 9). The evaluation of the photocurrent ratios as seen in Figure 8 will then indicate whether the layer is damaged or at least changed or if the integrity is maintained. Fig. 7. Cross section of the chip with locations of light source (LED) and detectors (PD). X is the lateral distance between LED and PD, d is the thickness of silicon and α is the angle of incidence. Table I. Location of light source and detectors. Detector x (µm) L (µm) α ( ) PD ,2 PD ,7 PD ,2 PD ,5 Fig. 8. Cross section of chip protected by optically active layer and attack detection technique. This way, optical interaction with IC performance is not only a security risk as described in chapter III but can also be used to implement backside protection concepts as well. The example chosen here shows a clearly altered angle dependence of the detected photocurrent in Table II which enables the security IC to monitor a definite indication of a hardware attack through chip backside. Table II Photocurrents of detectors in 1 V reverse bias before and after coating the optical layer. Comparison of simulated and experimental data. Detector I ph (before coating) I ph (after coating) LEDdetector distance Angle of incidence change sim. in % change exp. in % PD1-3.44µA -2.93µA 360µm PD nA nA 780µm PD3-12.6nA nA 1097µm PD4-3.63nA -3.57nA 1766µm

5 REFERENCES Fig. 9. Angle-dependent reflectivity inside the silicon without optical layer (solid green line) and with optical layer (dashed red line). V. CONCLUSION This paper presents optical interaction with access through chip backside to prevail as most important and powerful IC debug approach for CFI, using near infrared (NIR) with a solid immersion lens (SIL) for present IC technologies and a progress into shorter, visible light domain for FinFET technologies of 10 nm and smaller. It is demonstrated as well how these techniques can also be used successfully to read out and clone security codes. This includes even the recently acclaimed Physically Unclonable Functions (PUFs). This statement holds for all kinds of presented PUF concepts to date, shown here in more detail for ring oscillator PUFs. But the optical interaction is not only increasing the security risk. The necessary protection of the chip backside from security attacks also comes using optical interaction concepts. A concept chosen here for verification proves protective functionality. Optical interaction will be for a long time the most powerful partner of IC technology for performance debug, for assessment and protection of hardware security risks. ACKNOWLEDGMENT We would like to acknowledge Hamamatsu Japan and Hamamatsu Germany for support of our research. We also like to thank IHP for custom devices and Bernd Szyszka for the protection layer concept and development. This research was partially supported by the German Federal Ministry of Education and Research in the project Photon FX 2. The authors would like to thank the Helmholtz Research School on Security Technologies for its support. We gratefully thank Andreas Eckert at Technische Universität Berlin for sample preparation. Finally, we would like to thank Clemens Helfmeier at Technische Universität Berlin for test structure design. [1] N. Khurana and C. Chiang, Dynamic Imaging of Current Conduction in Dielectric Films by Emission Microscopy, Reliability Physics Symposium, th Annual, San Diego, CA, USA, 1987, pp [2] K.S. Wills, T. Lewis, G. Billus, and H. Hoang, Optical Beam Induced Current Applications for Failure Analysis of VLSI Devices, Proceedings of the 16th International Symposium for Testing and Failure Analysis, pp , [3] K. Nikawa and S. Tozaki, Novel OBIC Observation Method for Detecting Defects in Al Stripes under Current Stressing, Proceedings of the 19th International Symposium for Testing and Failure Analysis, pp , [4] J.A. Kash, J.C. Tsang, D.R. Knebel, and D.P. Vallet, Non-Invasive Backside Failure Analysis of Integrated Circuits by Time-Dependent Light Emission: Picosecond Imaging Circuit Analysis, Proceedings of the 24th International Symposium for Testing and Failure Analysis, pp , [5] M. Paniccia, T. Eiles, V.R.M. Rao, and W.M. Yee, Novel Optical Waveform Probing Technique for Flip Chip Packaged Microprocessors, Proceedings International Test Conference, pp. 740, [6] M.R. Bruce et al., Soft Defect Localization (SDL), Proceedings of the 28th International Symposium for Testing and Failure Analysis, pp , [7] G. S. Kino, Solid immersion lens, Proc. SPIE, vol. 3740, no. June, pp. 2-5, [8] J. Beutler, J. J. Clement, M. A. Miller, J. Stevens, and E. I. Cole Jr, Visible Light LVP on Ultra-Thinned Substrates, Proceedings of the 40th International Symposium for Testing and Failure Analysis, pp , [9] C. Boit et al., Contactless Visible Light Probing for Nanoscale ICs through 10 µm Bulk Silicon, Proceedings of the 35th NANO Testing Symposium, pp , [10] H. Lohrke et al., Contactless Fault Isolation for FinFET Technologies with Visible Light and GaP SIL, Proceedings of the 42nd International Symposium for Testing and Failure Analysis, in press, [11] M. A. Green and M. J. Keevers, Optical properties of intrinsic silicon at 300 K, Prog. Photovoltaics, vol. 3, no. 3, pp , [12] M. Von Haartman et al., Optical Fault Isolation and Nanoprobing Techniques for the 10 nm Technology Node and Beyond, Proceedings of the 41st International Symposium for Testing and Failure Analysis, pp , [13] ITRS - International Technology Roadmap for Semiconductors. [Online]. Available: [14] B. Gassend, D. Clarke, M. Van Dijk, and S. Devadas, Silicon Physical Random Functions, in Proceedings of the 9th Association for Computing Machinery conference on Computer and communications security, pp , [15] R. Maes, Physically Unclonable Functions: Concept and Constructions, in Physically Unclonable Functions. Springer, 2013, pp [16] C. Helfmeier, C. Boit, D. Nedospasov and J. P. Seifert, Cloning Physically Unclonable Functions, Hardware-Oriented Security and Trust (HOST), 2013 IEEE International Symposium on, Austin, TX, pp. 1-6, [17] S. Tajik et al., Physical Characterization of Arbiter PUFs, in Cryptographic Hardware and Embedded Systems, Springer, pp , [18] S. Tajik et al., Photonic Side-Channel Analysis of Arbiter PUFs, Journal of Cryptology, pp. 1-22, [19] S. Tajik, H. Lohrke, F. Ganji, J. P. Seifert, and C. Boit, Laser Fault Attack on Physically Unclonable Functions, in 12th Workshop on Fault Diagnosis and Tolerance in Cryptography, pp , [20] H. Lohrke, S. Tajik, C. Boit, and J. P. Seifert, No Place to Hide: Contactless Probing of Secret Data on FPGAs, in Cryptographic Hardware and Embedded Systems CHES Springer, 2016.