Laser-based attacks on secure integrated circuits
Heiko Lohrke · DepositOnce · 2019
To defend against attackers, knowledge about their approach is helpful. This work evaluates attacks on integrated circuits (ICs) using laser scanning microscopes (LSMs) in combination with semiconductor failure analysis (FA) techniques. It identifies likely attack paths, develops suitable setups, and tests attack feasibility. All attacks are performed through the silicon backside. Three main attack approaches are evaluated: automated laser fault injection location profiling, memory readout by laser stimulation, and reverse engineering as well as data extraction using optical contactless probing. Using these approaches, commercial application-specific integrated circuits (ASICs) down to 20 nm technology size are successfully attacked using an optical resolution of about 1 µm. Additionally, the use of visible light (VIS) and solid immersion lenses (SILs) for resolution improvement as well as low-cost approaches to VIS LSMs are assessed. Furthermore, concrete countermeasures are implemented and evaluated. Further mitigation approaches are also presented and discussed. The lack of backside protection is identified as a key factor in all attacks. Flip-chip devices are found to worsen this situation by removing the need for any preparation and giving direct backside access. More specifically, the findings are as follows. Automated laser fault injection profiling is shown to determine suitable attack locations in a time span in the order of minutes. This is demonstrated by analyzing the configuration memory on 180 nm technology size Altera MAX V complex programmable logic devices (CPLDs). Using the profiling information, laser reconfiguration attacks are performed on proof-of-concept (POC) implementations of physically unclonable functions (PUFs). Additionally, an analysis of the underlying fault mechanism is carried out. For laser stimulation, data extraction from static random access memory (SRAM) and battery-backed SRAM (BBRAM) key memory is demonstrated. Readout of the 1 KB SRAM of a 180 nm technology Texas Instruments MSP430 microcontroller is presented with error rates between 0.4% and 5.5%. BBRAM key recovery from the ASIC decryption core of a 20 nm technology Xilinx Kintex UltraScale field-programmable gate array (FPGA) is developed in 7 hours of lab work, with a single 256-bit key ultimately being extracted in 15 minutes. For optical contactless probing, two attacks are presented. The first performs key extraction on a POC implementation of a PUF key storage concept by Xilinx implemented on a 60 nm Altera Cyclone IV FPGA. A contactless characterization of the employed ring oscillator PUF is also performed. The second attack enables reverse-engineering and plaintext extraction on the decryption ASIC of a 28 nm technology Xilinx Kintex 7 FPGA. The plaintext gates are found in less than 10 working days and extraction of decrypted data is demonstrated. For evaluation of resolution improvements, a suitable setup for comparison of visible light (VIS) and infrared (IR) illumination is developed. Additionally, a gallium phosphide solid immersion lens (GaP SIL) is designed, fabricated, incorporated into the setup, and experimentally verified. Application of the SIL improves resolution by 190% and 170% in IR and VIS respectively. Switching the illumination of the SIL from IR to VIS yields an improvement of 60%. Optical contactless probing techniques in VIS are performed by using the setup on 16/14 nm FinFET test devices. Additionally, a low-cost setup for VIS LSMs built from optical drive components is presented. The setup is capable of acquiring reflected light images with sub-micron resolution with a hardware cost of less than $100. In connection with implemented countermeasures, two circuits are presented. The first one is shown to successfully prevent laser stimulation data extraction by injection of a noisy current. The second circuit combines a PUF with an attack detection circuit to prevent optical probing. Sensitivity to both 1.1 µm and 1.3 µm laser radiation is demonstrated while also providing PUF functionality. Further potential attack-specific and general countermeasures are discussed. In conclusion, this work shows that employing LSM-based failure analysis techniques for attack development is a promising approach for attackers and a serious threat to defenders. Especially in the absence of backside protection, a multitude of attacks can be successfully launched. To properly secure integrated circuits in the future, the development of reliable, thorough, and cost-effective backside protection structures is indicated.