Laser attacks on integrated circuits: From CMOS to FD-SOI

Abstract

The use of a laser as a means to inject errors during the computations of a secure integrated circuit (IC) for the purpose of retrieving secret data was first reported in 2002. Since then, a lot of research work, mainly experimental, has been carried out to study this threat. This paper reports research conducted, in the framework of the french national project LIESSE, to obtain an electrical model of the laser effects on CMOS ICs. Based on simulation, a first model permitted us to draw the laser sensitivity map of a SRAM cell. It demonstrates a very close correlation with experimental measures. We also introduce the preliminary results we gathered to build a similar electrical model for FD-SOI circuits. FD-SOI technology is expected to be less sensitive to laser than CMOS.

The case of using CMOS FD-SOI rather than CMOS bulk to harden ICs against laser attacks

“…that of CMOS bulk from a security perspective. The authors of [15], [16], [25] performed such experiments at the 28 nm technological node on elementary test transistors. Their main purpose was to build electrical models of the laser illumination of FD-SOI transistors.…”

“…SEE laser emulation is done with settings chosen to mimic the passing of a ionizing particle through silicon [2]: a wavelength in the near Infrared (IR), a laser pulse duration in the picosecond range (from several ps to a few tens of ps), and a laser beam diameter set to 1 µm (the minimal size achievable with an air gap lens). Regarding the interest of using FD-SOI rather than CMOS bulk to mitigate laser fault injection, there are very few published papers [15], [16]. Moreover, their experimental results were as well obtained on elementary test elements.…”

Automatic Application of Software Countermeasures Against Physical Attacks

“…Fault injection attacks exploit this principle. They can use various physical means to provoke faults: light [39,75], electromagnetic injection [65,62,35], temperature [74,46], etc.…”

“…(2) Fault injection attacks, introduced in 1997 by Boneh et al [21], exploit the effect of a deliberate disturbance of a system during its operation. Fault injection attacks can be carried out by means of laser/light beam [39,75], electromagnetic injection [65,62,35], variation of the supply voltage [12,24], clock glitch [5], temperature [74,46], etc.…”

Importance of IR drops on the modeling of laser-induced transient faults

“…This undesired state propagates toward the input of registers (flip-flops or latches) and, if it is still present when the clock edges occurs a soft error appears. However, flipping the output of a gate with a laser source forces it in a state where there is a massive short-circuit between VDD and GND (this current component has been experimentally validated in [2]). The question remains if this massive short-circuit creates significant IR drops and thus can induce transient faults by itself.…”