Determining the state of non-volatile memory cells with floating gate using scanning probe microscopy

Hanzii, D.; Kelm, E.; Luapunov, N.; Милованов, Р. А.; Molodcova, G.; Yanul, M.; Zubov, D. N.

doi:10.1117/12.2017156

Cited by 5 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For instance, the use of a current applied on a conductive tip allows seeing some interaction whenever electron charges are present within memory cells. Following Skorobogatov's conclusions [8], the first investigations using SPM-based techniques have been performed by De Nardi et al [9,10] and, recently, similarly performed again by different teams Konopinski et al [11], Hanzii et al [12] and Dhar et al [13,14]. The main drawbacks of SPM techniques are the low scanning speed (approximately 10 minutes per 20×20 µm image), the small area covered (approximately 100×100 µm), the need to replace the tip (as it becomes unusable after days of continuous scanning) and the necessity of operator interventions (moving to the scanning area).…”

Section: Introductionmentioning

confidence: 97%

Direct Charge Measurement in Floating Gate Transistors of Flash EEPROM Using Scanning Electron Microscopy

Courbon

Skorobogatov

Woods³

2016

International Symposium for Testing and Failure Analysis

View full text Add to dashboard Cite

We present a characterization methodology for fast direct measurement of the charge accumulated on Floating Gate (FG) transistors of Flash EEPROM cells. Using a Scanning Electron Microscope (SEM) in Passive Voltage Contrast (PVC) mode we were able to distinguish between '0' and '1' bit values stored in each memory cell. Moreover, it was possible to characterize the remaining charge on the FG; thus making this technique valuable for Failure Analysis applications for data retention measurements in Flash EEPROM. The technique is at least two orders of magnitude faster than state-of-the-art Scanning Probe Microscopy (SPM) methods. Only a relatively simple backside sample preparation is necessary for accessing the FG of memory transistors. The technique presented was successfully implemented on a 0.35 μm technology node microcontroller and a 0.21 μm smart card integrated circuit. We also show the ease of such technique to cover all cells of a memory (using intrinsic features of SEM) and to automate memory cells characterization using standard image processing technique.

show abstract

Section: Introductionmentioning

confidence: 97%

Direct Charge Measurement in Floating Gate Transistors of Flash EEPROM Using Scanning Electron Microscopy

Courbon

Skorobogatov

Woods³

2016

International Symposium for Testing and Failure Analysis

View full text Add to dashboard Cite

show abstract

“…For instance, the use of a current applied on a conductive tip allows us to see some interaction whenever electron charges are present within memory cells. Following Skorobogatov's conclusions [18], the first investigations using SPMbased techniques have been performed by De Nardi et al [6,7] and, recently, similarly performed again by different teams; Konopinski et al [15], Hanzii et al [11] and Dhar et al [9,10].…”

Section: Introductionmentioning

confidence: 98%

Reverse Engineering Flash EEPROM Memories Using Scanning Electron Microscopy

Courbon

Skorobogatov

Woods³

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this article, a methodology to extract Flash EEPROM memory contents is presented. Samples are first backside prepared to expose the tunnel oxide of floating gate transistors. Then, a Scanning Electron Microscope (SEM) in the so called Passive Voltage Contrast (PVC) mode allows distinguishing '0' and '1' bit values stored in individual memory cell. Using SEM operator-free acquisition and standard image processing technique we demonstrate the possible automating of such technique over a full memory. The presented fast, efficient and low cost technique is successfully implemented on 0.35µm technology node microcontrollers and on a 0.21µm smart card type integrated circuit. The technique is at least two orders of magnitude faster than state-of-the-art Scanning Probe Microscopy (SPM) methods. Without adequate protection an adversary could obtain the full memory array content within minutes. The technique is a first step for reverse engineering secure embedded systems.

show abstract

“…Scanning Kelvin Probe Microscopy (SKPM), Electrical Force Microscopy (EFM), and Scanning Capacitance Microscopy (SCM) to probe and measure the charges in the FG of Flash and EEPROM directly [10,[12][13][14][15][16][17][18]. The number of charges in the FG can vary from 10 5 in the older technology nodes to less than 10 3 in the advanced chips.…”

Section: Different Research Teams Have Done Studies Using Electrical ...mentioning

confidence: 99%

Investigation on the security of stored data in emerging non-volatile memory devices using AFM- based techniques

Tay¹

View full text Add to dashboard Cite

Nowadays, non-volatile memory (NVM) devices are extensively used for information storage in artificial intelligence, communication, transportation, mobile and many other applications. With their intended use in these applications, it is important to evaluate the security of stored data in these devices against extraction or modification. Hardware security analysis includes physical attacks and software attacks. Prior studies have been conducted on NVMs such as Flash and EEPROM devices using Atomic Force Microscopy (AFM) based techniques. AFM is a versatile tool that can measure different material properties along with topography and morphology information. This makes it suitable for the investigation on the emerging NVMs such as magnetic random-access memory (MRAM), ferroelectric random-access memory (FeRAM), phase-change memory (PCM), and resistive random-access memory (RRAM) in the market.In this study, RRAM and MRAM devices that are available in the market will first be analyzed through the use of failure analysis techniques such as chemical deprocessing, Xray imaging and scanning electron microscopy (SEM) with focused ion beam (FIB) to understand its device architecture. Next, deprocessing steps such as chemical etching and reactive ion etching will be developed to access the data storage layer of the RRAM/MRAM where the devices store their data depending on the resistance state, which corresponds to the binary bit of '1' or '0'. Then, the AFM technique such as conductive probe AFM (CP-AFM), using a constant dc bias, will be used to scan across the sample's surface and directly probe on the data storage layer to measure the current and thus its resistance. The collected results from the current scans will be validated with the input data in order to assess the accuracy of the technique. Precaution measures adopted to prevent the loss of data during the sample preparation process will also be discussed. The first ever successful readout of data in RRAM samples using CP-AFM has been achieved and block level data organization of the memory is also presented in this study, thus demonstrating the vulnerability of RRAM devices to security attacks, and potentially MRAM technology as well.

show abstract

Determining the state of non-volatile memory cells with floating gate using scanning probe microscopy

Cited by 5 publications

References 0 publications

Direct Charge Measurement in Floating Gate Transistors of Flash EEPROM Using Scanning Electron Microscopy

Direct Charge Measurement in Floating Gate Transistors of Flash EEPROM Using Scanning Electron Microscopy

Reverse Engineering Flash EEPROM Memories Using Scanning Electron Microscopy

Investigation on the security of stored data in emerging non-volatile memory devices using AFM- based techniques

Contact Info

Product

Resources

About