Laser attacks on integrated circuits: from CMOS to FD-SOI

DTIS 2014 9 th International Conference on Design & Technology of Integrated Systems in Nanoscale Era Laser attacks on integrated circuits: from CMOS to FD-SOI J.-M. Dutertre 1, S. De Castro 1, A. Sarafianos 2, N. Boher 3, B. Rouzeyre 4, M. Lisart 2, J. Damiens 3, P. Candelier 3, M.-L. Flottes 4, D. Di Natale 4 May 7 th 2014 Santorini Greece 1: ENSM.SE - Centre Microélectronique de Provence, 13541 Gardanne, France, name@emse.fr 2, 3: STMicroelectronics, 13390 Rousset 2 / 38926 Crolles 3, France, firstname.name@st.com 4: LIRMM (CNRS UMR N5506), 24085 Montpellier, France, name@lirmm.fr

I. Introduction Outline Laser attacks on secure circuits Fault injection mechanism Modeling laser effects on ICs: from CMOS to FDSOI II. Modeling laser attacks on CMOS ICs Methodology / Measurement based electrical model Obtained results III. Modeling laser attacks on FD-SOI ICs FD-SOI structure / first results IV. Conclusion and perspectives 2 / 26

I. Introduction! Laser attacks on secure circuits " Secure circuit " Laser attack: active hardware attack Distortion of the chip environmental conditions (active perturbation) => bypass security features (security fuse, code alteration, etc.) => extract information (Differential Fault Attack) Keys / Private data 0110010101100001 010110000110011 110101000101101 Faulted ciphertext 3 / 26

I. Introduction! Fault injection mechanism " Photoelectric effect: photon energy > silicon band gap Laser Drain ( Gnd ) - - + + + - + - - - + + + - + + - N + diffusion Space charge region P substrate (Gnd) 4 / 26

I. Introduction! Fault injection mechanism " Photoelectric effect: photon energy > silicon band gap Drain ( V DD ) E N + diffusion Space charge region P substrate (Gnd) 4 / 26

I. Introduction! Fault injection mechanism " Photoelectric effect: photon energy > silicon band gap Laser Drain ( V DD ) - - + + + - + - - - + + + - + + - E N + diffusion Space charge region P substrate (Gnd) 4 / 26

I. Introduction! Fault injection mechanism " Photoelectric effect: photon energy > silicon band gap Laser Drain ( V DD ) Current (ma) Photocurrent transient Current peak - - + + + - + - - - + + + - + + - E N + diffusion Space charge region P substrate (Gnd) Drfift current Sensitive area: reverse biased PN junction Time (ns) 4 / 26

I. Introduction! Fault injection mechanism (cont.) " Photocurrent => voltage transient (SET) in 0 Metal 1 MOS gate out 1 C " to Gnd to Vdd P+ N+ N+ P+ P+ N+ NMOS PMOS N well P substrate laser beam Sensitive area: reverse biased PN junction (drain of the off transistor) 5 / 26

I. Introduction! Fault injection mechanism (cont.) " Photocurrent => voltage transient (SET) in 0 Metal 1 MOS gate out 1 => 0 C " to Gnd to Vdd P+ N+ N+ P+ P+ N+ NMOS PMOS N well P substrate laser beam Sensitive area: reverse biased PN junction (drain of the off transistor) 5 / 26

I. Introduction! Fault injection mechanism (cont.) " Photocurrent => voltage transient (SET) in 0 Metal 1 MOS gate out 1 => 0 C " to Gnd to Vdd P+ N+ N+ P+ P+ N+ NMOS PMOS N well P substrate Sensitive area: reverse biased PN junction (drain of the off transistor) 5 / 26

I. Introduction! Fault injection mechanism (cont.) " Photocurrent => voltage transient (SET) in 0 Metal 1 MOS gate out 1 C " to Gnd to Vdd P+ N+ N+ P+ P+ N+ NMOS PMOS N well P substrate Sensitive area: reverse biased PN junction (drain of the off transistor) 5 / 26

I. Introduction! Fault injection mechanism (cont.) " Single Event Transient (SET) Target: logic Laser shot voltage transient IN 6 / 26

I. Introduction! Fault injection mechanism (cont.) " Single Event Transient (SET) Target: logic Laser shot voltage transient IN fault Actual fault injection depends on: the injection timing, the voltage transient duration. 6 / 26

I. Introduction! Fault injection mechanism (cont.) " Single Event Upset (SEU) Target: memory cells (SRAM, Dff) 1 0 OFF ON OFF ON OFF ON = 1 (state 1) OFF ON 1 sensitive areas in state 1 (data dependent) 7 / 26

I. Introduction! Fault injection mechanism (cont.) " Single Event Upset (SEU) Target: memory cells (SRAM, Dff) 1 0 => 1 OFF ON OFF ON OFF ON = 1 (state 1) OFF ON 1 sensitive areas in state 1 (data dependent) 7 / 26

I. Introduction! Fault injection mechanism (cont.) " Single Event Upset (SEU) Target: memory cells (SRAM, Dff) 1 0 => 1 OFF ON OFF ON OFF ON = 1 (state 1) OFF ON 1 => 0 sensitive areas in state 1 (data dependent) 7 / 26

I. Introduction! Fault injection mechanism (cont.) " Single Event Upset (SEU) Target: memory cells (SRAM, Dff) 1 0 => 1 1 OFF ON OFF ON OFF ON = 10 (state 1) 0) OFF ON 1 => 0 0 sensitive areas in state 1 (data dependent) 7 / 26

I. Introduction! Modeling laser effects on ICs " 2D/3D physical simulation - radiation community TCAD Accurate but requires: long calculation time, knowledge of the process. " Electrical simulation using spice-like simulators Photocurrent generation modeled with a current source Current (ma) Less accurate: short calculation time, topology not considered. Time (ns) 8 / 26

I. Introduction! Modeling laser effects on ICs " Our work previous collaborations and LIESSE project Building an electrical model of laser attacks on CMOS ICs: on experimental basis, that takes into account the target topology (laser sensitivity maps). Building an electrical model of laser attacks on FD-SOI ICs: an emerging technology, expected to be less sensitive to laser attacks, first results. Studying laser sensitivity at design time 9 / 26

II. Modeling laser attacks on CMOS ICs! Methodology " CMOS structure nmos pmos B (gnd) S G D D G S B (Vdd) P+ P substrate N+ N+ (1) P+ P+ N+ (2) (3) Nwell PN junctions laser sensitive places: 3 types (1), (2), (3) 10 / 26

II. Modeling laser attacks on CMOS ICs! Methodology " CMOS structure nmos pmos B (gnd) S G D D G S B (Vdd) P+ N+ N+ P+ P+ N+ (a) (b) Nwell P substrate (c) Parasitic bipolar transistors: 3 types (a), (b), (c) 10 / 26

II. Modeling laser attacks on CMOS ICs! Methodology (cont.) " NMOS electrical model Gate Drain Source Psub Psub N+ model npn model Psub N+ model B RC1 RC2 RB RB C B B2 RB2 PN junction and parasitic npn models tuned according real experiments 11 / 26

! Methodology (cont.) II. Modeling laser attacks on CMOS ICs " Photocurrent model: voltage controlled current source I ph (t) = [ a(p).v r + b(p) ]. A. α topology. ω thick. Ω shape (t) P laser power V r junction reverse voltage A junction area α topology models the influence of the topology (i.e. laser shot to junction distance) ω thick silicon thickness (backside injection) Ω shape (t) current pulse shaping Model s parameters tuned experimentally 12 / 26

II. Modeling laser attacks on CMOS ICs! Measurement based electrical model " Experimental setup CMOS 90nm Wavelength: 1064nm (IR) Spot size: 1µm, 5µm, 20µm Pulse width: 50ns 30µs Power: up to 3W Backside injection 13 / 26

II. Modeling laser attacks on CMOS ICs! Measurement based electrical model (cont.) " Laser induced photocurrent peak amplitude, PsubN+ junction 12 x 10 3 Photocurrent [A] 10 8 6 4 2 0.025W 0.420W 1.25W a(p).v r + b(p) 0 2 0 0.2 0.4 0.6 0.8 1 1.2 Reverse voltage [V] 14 / 26

II. Modeling laser attacks on CMOS ICs! Measurement based electrical model (cont.) " Topology photocurrent peak amplitude vs. laser shot distance to junction s centre 1 Spatial dependence [%] 0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 100x 20x 5x α topology 0.1 0 0 50 100 150 200 250 300 350 400 450 500 Distance [µm] 15 / 26

! Obtained results II. Modeling laser attacks on CMOS ICs " Laser-induced transient currents in an NMOS transistor Laser pulse: 20µs, power: 1.25W, V drain =1.2V, V gate = V source =V bulk = 0V Measurements: Electrical simulation: 16 / 26

! Obtained results (cont.) II. Modeling laser attacks on CMOS ICs " Laser fault sensitivity map of an SRAM cell CMOS 0,25µm Measurements: Electrical simulation: -9 Bit Set fault Bit Reset fault -9 Bit Reset fault Bit Set fault -8-8 -7-7 -6-6 Y (µm) -5 Y (µm) -5-4 -4-3 -3-2 -2-1 -4-5 -6-7 -8 X (µm) -9-10 -11-12 -1-4 -5-6 -7-8 X (µm) -9-10 -11-12 -13 17 / 26

III. Modeling laser attacks on FD-SOI ICs! Methodology " FD-SOI structure, 28nm Fully Depleted Silicon on Insulator G NMOS G gnd B (gnd) S D D S B (Vdd) P+ STI P+ N+ N+ P+ P+ box box STI STI STI STI N+ Pwell Nwell P substrate P+ type Si P type Si P substrate gate N+ type Si N type Si Insulator (STI or box or gate oxide) 18 / 26

III. Modeling laser attacks on FD-SOI ICs! Methodology " FD-SOI structure, 28nm Fully Depleted Silicon on Insulator G NMOS G gnd P+ STI B (gnd) P+ S D D Intrinsic Ssilicon B (Vdd) channel (less N+ N+ P+ P+ box box STI STI STI STI N+ Pwell than 10nm thick) Nwell smaller charge collection volume lower laser sensitivity? P substrate Isolation box (less than 30nm thick) P+ type Si P type Si P substrate gate N+ type Si N type Si Insulator (STI or box or gate oxide) 18 / 26

! Methodology (cont.) " FD-SOI structure laser sensitive places III. Modeling laser attacks on FD-SOI ICs G G gnd B (gnd) S D D S B (Vdd) P+ STI P+ N+ N+ P+ P+ box box STI STI STI STI N+ Pwell Nwell P substrate (1) PN junctions laser sensitive places: 1 type Parasitic bipolar transistors: none (1) 19 / 26

III. Modeling laser attacks on FD-SOI ICs! Measurement of laser effect on FD-SOI " Psubstrate-Nwell junction 2.5 V r =1V, P laser =285mW 2 1.14W 855mW 570mW 285mW Photocurrent [ma] 1.5 1 0.5 0 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 1.2 Reverse voltage [V] 20 / 26

0.25 III. Modeling laser attacks on FD-SOI ICs! Measurement of laser effect on FD-SOI " Psubstrate-Nwell junction V r =1V, P laser =285mW 0.2 Photocurrent [ma] 0.15 0.1 0.05 0 60 40 20 0 20 40 60 Distance [µm] 20 / 26

III. Modeling laser attacks on FD-SOI ICs! Measurement of laser effect on FD-SOI (cont.) " Laser-induced NMOS drain current (transistors #1 and #2) 30 25 transistor #1 27µA Photocurrent [µa] 20 15 10 5 transistor #2 8µA 0 10 8 6 4 2 0 2 4 6 8 10 Distance [µm] Thick-oxide FD-SOI NMOS in OFF state, photocurrent amplitude vs. distance 21 / 26

III. Modeling laser attacks on FD-SOI ICs! Measurement of laser effect on FD-SOI (cont.) " Laser-induced NMOS drain current (transistors #1 and #2) 30 25 transistor #1 27µA Photocurrent [µa] 20 15 10 5 transistor #2 8µA 0 10 8 6 4 2 0 2 4 6 8 10 Distance [µm] Similar settings for CMOS 90nm: 5-6mA drain current?! 22 / 26

III. Modeling laser attacks on FD-SOI ICs! Measurement of laser effect on FD-SOI (cont.) " Laser-induced NMOS drain current - laser spot s size: 5µm 30 25 transistor #1 27µA Photocurrent [µa] 20 15 10 5 13µA transistor #2 ~ 4µm 0 10 8 6 4 2 0 2 4 6 8 10 Distance [µm] 4µm to halve the photocurrent pulse amplitude box s isolation effect Similar settings for CMOS 90nm: more than 100µm! 23 / 26

III. Modeling laser attacks on FD-SOI ICs! Measurement of laser effect on FD-SOI (cont.) " FD-SOI laser sensitivity: first results One PN junction (Psub-Nwell): similar behavior (as expected) Laser-induced currents in NMOS: drain current is 2 order of magnitude lower less topology dependence: 4µm vs. ~100µm (box and STI isolation) FD-SOI: a lower laser sensitivity may be expected wrt. CMOS To be confirmed 24 / 26

IV. Conclusion! Laser attacks on ICs: electrical model CMOS: 1 st achievement: simulation based sensitivity maps FD-SOI: first results, lower laser-induced fault sensitivity?! Perspectives " Complete electrical model of FD-SOI transistors " Incoming test chips: both 28nm CMOS and FD-SOI 25 / 26

IV. Conclusion Thank you for your attention dutertre@emse.fr LIESSE project - Laser-Induced fault Effects in Security-dedicated circuits Funded by 26 / 26