Laser fault injection into SRAM cells: Picosecond versus nanosecond pulses

2018 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC)

Beroulle

Candelier

et al. 2018

Self Cite

S. Skorobogatov and R. Anderson identified laser illumination as an effective technique to conduct fault attacks in 2002. In these early days of laser-induced fault injection, it was proven to be possible to inject single-bit faults into integrated circuits. This corresponds to the more restrictive fault model found in the fault attack bibliography. The target area under laser illumination (a few micrometers, down to ∼ 1 µm) broadly matched that of a single transistor. It was consistent with a singlebit fault model. However, since then the technology of secure devices has evolved. In current circuits even the smallest laser spots may illuminate several logic cells. This raises the question of the validity of the single-bit fault model: does it still hold? In this work, we report an assessment of its validity through experimental results obtained from circuits designed at the 28 nm CMOS technology node. We also describe the main properties of the corresponding fault model obtained from both static and dynamic experiments.

Section: Discussionmentioning

confidence: 96%

“…In the early days of laser fault injection, the single-bit and bit-set/reset FMs were achieved and reported [1], [13], [6]. The most recent state-of-the-art was obtained at the 40 nm CMOS technology node on memory elements in static mode.…”

Section: B Theory Of Laser-induced Fault Injectionmentioning

confidence: 99%

Laser Fault Injection at the CMOS 28 nm Technology Node: an Analysis of the Fault Model

2018 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC)

Beroulle

Candelier

et al. 2018

Self Cite

“…1. The magnitude of this laser-induced photocurrent depends of several parameters: it is proportional to the PN junction area and it increases linearly with the junction reverse voltage [18]. It also rely on the size of the funnel region.…”

Section: A Photoelectric Effectmentioning

confidence: 99%

The case of using CMOS FD-SOI rather than CMOS bulk to harden ICs against laser attacks

2018 IEEE 24th International Symposium on on-Line Testing and Robust System Design (IOLTS)

Beroulle

Candelier

et al. 2018

Self Cite

At first used to emulate the effects of radioactive ionizing particules passing through integrated circuits (ICs), laser illumination is also used to inject faults into the computations of secure ICs for the purpose of retrieving secret data. The CMOS FD-SOI technology is expected to be less sensitive to laser faults injection than the more usual CMOS bulk technology. We report in this work an experimental assessment of the interest of using FD-SOI rather than CMOS bulk to decrease laser sensitivity. Our experiments were conducted on test chips at the 28 nm node for both technologies with laser pulse durations in the picosecond and nanosecond ranges.

“…In the following, laser-induced SEEs are described. A laser-induced transient current is then called a 'photocurrent' [8][9][10][11][12][13][14][15][16].…”

Section: A Single Event Effects In Integrated Circuitsmentioning

confidence: 99%

SEU sensitivity and modeling using pico-second pulsed laser stimulation of a D Flip-Flop in 40 nm CMOS technology

Champeix

Borrel

2015 IEEE International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFTS)

et al. 2015

Self Cite

This paper presents the design of a CMOS 40 nm D Flip-Flop cell and reports the laser fault sensitivity mapping both with experiments and simulation results. Theses studies are driven by the need to propose a simulation methodology based on laser/silicon interactions with a complex integrated circuit. In the security field, it is therefore mandatory to understand the behavior of sensitive devices like D Flip-Flops to laser stimulation. In previous works, Roscian et al., Sarafianos et al., Lacruche et al. or Courbon et al. studied the relations between the layout of cells, its different laser-sensitive areas and their associated fault model using laser pulse duration in the nanosecond range. In this paper, we report similar experiments carried out using a shorter laser pulse duration (30 ps instead of 50 ns). We also propose an upgrade of the simulation model they used to take into account laser pulse durations in the picosecond range on a logic gate composed of a large number of transistors for a recent CMOS technology (40 nm).