Laser Logic State Imaging (LLSI)

Niu, Ben; Khoo, Grace Mei Ee; Chen, Yuan-Chuan Steven; Chapman, F. W.; Bockelman, Dan; Tong, Tom

doi:10.31399/asm.cp.istfa2014p0065

Cited by 17 publications

(7 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Detecting capacitor-based Trojans Results from [24] indicate that decoupling capacitors can be imaged using LLSI, see Fig. 14a.…”

Section: Discussionmentioning

confidence: 99%

“…Using classical EOFM, only periodically switching elements on the chip can be detected. The static logic state of circuits, however, can be captured using laser logic state imaging (LLSI), which was introduced as an extension to EOFM [24]. The main idea behind LLSI is to stop the clock and induce a periodic frequency into the entire logic by modulating the power supply, see Fig.…”

Section: Modulated Lightmentioning

confidence: 99%

“…Moreover, a so-called solid immersion lens (SIL) can be used to increase the optical resolution down to 250 nm [49], which is sufficient to resolve individual transistors in a 14 nm technology [50]. Accordingly, Intel has shown that LLSI can be applied on very small devices, such as single inverters, on a test chip manufactured in a 14 nm technology [24], see Fig. 14b.…”

Section: B Applicability Of Llsimentioning

confidence: 99%

“…A new optical probing technique that has recently been leveraged in the hardware security field is called laser logic state imaging (LLSI) [23]. It is an optical probing technique that can extract the logic states of single transistors, and therefore, more complex logic gates or memory cells [24]. In LLSI, the chip's supply voltage is modulated, which causes the light reflection originating from a laser scanning irradiation to be modulated as well.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Trojan Awakener: Detecting Dormant Malicious Hardware Using Laser Logic State Imaging

Krachenfels¹,

Seifert²,

Tajik³

2021

Preprint

View full text Add to dashboard Cite

The threat of hardware Trojans (HTs) and their detection is a widely studied field. While the effort for inserting a Trojan into an application-specific integrated circuit (ASIC) can be considered relatively high, especially when trusting the chip manufacturer, programmable hardware is vulnerable to Trojan insertion even after the product has been shipped or during usage. At the same time, detecting dormant HTs with small or zero-overhead triggers and payloads on these platforms is still a challenging task, as the Trojan might not get activated during the chip verification using logical testing or physical measurements. In this work, we present a novel Trojan detection approach based on a technique known from integrated circuit (IC) failure analysis, capable of detecting virtually all classes of dormant Trojans. Using laser logic state imaging (LLSI), we show how supply voltage modulations can awaken inactive Trojans, making them detectable using laser voltage imaging techniques. Therefore, our technique does not require triggering the Trojan. To support our claims, we present two case studies on 28 nm SRAM-and flash-based field-programmable gate arrays (FPGAs). We demonstrate how to detect with high confidence small changes in sequential and combinatorial logic as well as in the routing configuration of FPGAs in a non-invasive manner. Finally, we discuss the practical applicability of our approach on dormant analog Trojans in ASICs.

show abstract

“…Detecting capacitor-based Trojans Results from [24] indicate that decoupling capacitors can be imaged using LLSI, see Fig. 14a.…”

Section: Discussionmentioning

confidence: 99%

Section: Modulated Lightmentioning

confidence: 99%

Section: B Applicability Of Llsimentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Trojan Awakener: Detecting Dormant Malicious Hardware Using Laser Logic State Imaging

Krachenfels¹,

Seifert²,

Tajik³

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…2) LLSI: Laser Logic State Imaging (LLSI) makes the readout of static signals possible. The technique was introduced as an extension to EOFM to the failure analysis community [50]. For LLSI the supply voltage is modulated with a known frequency.…”

Section: B Optical Backside Failure Analysis Techniquesmentioning

confidence: 99%

Real-World Snapshots vs. Theory: Questioning the t-Probing Security Model

Krachenfels,

Ganji,

Moradi

et al. 2020

Preprint

View full text Add to dashboard Cite

Due to its sound theoretical basis and practical efficiency, masking has become the most prominent countermeasure to protect cryptographic implementations against physical sidechannel attacks (SCAs). The core idea of masking is to randomly split every sensitive intermediate variable during computation into at least t+1 shares, where t denotes the maximum number of shares that are allowed to be observed by an adversary without learning any sensitive information. In other words, it is assumed that the adversary is bounded either by the possessed number of probes (e.g., microprobe needles) or by the order of statistical analyses while conducting higher-order SCA attacks (e.g., differential power analysis). Such bounded models are employed to prove the SCA security of the corresponding implementations. Consequently, it is believed that given a sufficiently large number of shares, the vast majority of known SCA attacks are mitigated.In this work, we present a novel laser-assisted SCA technique, called Laser Logic State Imaging (LLSI), which offers an unlimited number of contactless probes, and therefore, violates the probing security model assumption. This technique enables us to take snapshots of hardware implementations, i.e., extract the logical state of all registers at any arbitrary clock cycle with a single measurement. To validate this, we mount our attack on masked AES hardware implementations and practically demonstrate the extraction of the full-length key in two different scenarios. First, we assume that the location of the registers (key and/or state) is known, and hence, their content can be directly read by a single snapshot. Second, we consider an implementation with unknown register locations, where we make use of multiple snapshots and a SAT solver to reveal the secrets.

show abstract

Trojan awakener: detecting dormant malicious hardware using laser logic state imaging (extended version)

2023

View full text Add to dashboard Cite

The threat of (HTs) and their detection is a widely studied field. While the effort for inserting a Trojan into an (ASIC) can be considered relatively high, especially when trusting the chip manufacturer, programmable hardware is vulnerable to Trojan insertion even after the product has been shipped or during usage. At the same time, detecting dormant HTs with small or zero-overhead triggers and payloads on these platforms is still a challenging task, as the Trojan might not get activated during the chip verification using logical testing or physical measurements. In this work, we present a novel Trojan detection approach based on a technique known from (IC) failure analysis, capable of detecting virtually all classes of dormant Trojans. Using (LLSI), we show how supply voltage modulations can awaken inactive Trojans, making them detectable using laser voltage imaging techniques. Therefore, our technique does not require triggering the Trojan. To support our claims, we present three case studies on 28 nm and 20 nm SRAM- and flash-based (FPGAs). We demonstrate how to detect with high confidence small changes in sequential and combinatorial logic as well as in the routing configuration of FPGAs in a non-invasive manner. Finally, we discuss the practical applicability of our approach on dormant analog Trojans in ASICs.

show abstract

Laser Logic State Imaging (LLSI)

Cited by 17 publications

References 6 publications

Trojan Awakener: Detecting Dormant Malicious Hardware Using Laser Logic State Imaging

Trojan Awakener: Detecting Dormant Malicious Hardware Using Laser Logic State Imaging

Real-World Snapshots vs. Theory: Questioning the t-Probing Security Model

Trojan awakener: detecting dormant malicious hardware using laser logic state imaging (extended version)

Contact Info

Product

Resources

About