Metal Fillers as Potential Low Cost Countermeasure against Optical Fault Injection Attacks

Abstract

Physically accessible devices such as sensor nodes in Wireless Sensor Networks or "smart" devices in the Internet of Things have to be resistant to a broad spectrum of physical attacks, for example to Side Channel Analysis and to Fault Injection attacks. In this work we concentrate on the vulnerability of ASICs to precise optical Fault Injection attacks. Here we propose to use metal fillers as potential low-cost countermeasure that may be effective against a broad spectrum of physical attacks. In our future work we plan to evaluate different methods of metal fillers placement, to select an effective one and to integrate it as additional design rules into automated design flows.

Optical Fault Injection Attacks against Radiation-Hard Shift Registers

“…Due to the increased number of transistors, the size of a single JICG flip-flop is relatively big (82×20 µm 2 ) compared to a non-radiation-hard flip-flop (20×7 µm 2 ) available in the standard IHP's 250 nm gate library [2].…”

“…Metal fillers are obstacles for a visual inspection of the chip as well as for the laser beam, i.e. the metal fillers can significantly decrease the success rate of optical FI attacks [2]. In our experiments we expect FI to be successful due to the following facts:  the diameter of the laser beam spot for the single-mode red laser can be set from 1 µm up to 15 µm using different magnification objectives (see details in section IV);  the distance between metal fillers in the middle metal layer (see Fig.…”

“…These attacks belong to the class of semi-invasive attacks and are known as optical FI attacks [1]. In [2] we reported about successful optical FI attacks against different chips based on standard library cells manufactured in IHP's 250 nm and in IHP's 130 nm technology using the Riscure multi-mode red light laser source [8].…”

Sensitivity of Standard Library Cells to Optical Fault Injection Attacks in IHP 250 nm Technology

“…3 Small metal structures that are placed in different metal layers to comply with technology manufacturing process requirements. The metal fillers are obstacles for laser illumination and can reduce the success rate of laser fault injection attacks [8].…”

Silicon Proven 1.29 μm × 1.8 μm 65nm Sub-Vt Optical Sensor for Hardware Security Applications

“…There are numerous countermeasures aimed at the prevention of this type of attack. Although protecting the front side is straightforward and can be done at the packaging stage (using metal mesh) or during the standard physical design (dense metal fill [16]), protecting the back is more complex. Recent studies have suggested using non-standard fabrication processes such as Through-Silicon Via (TSV) [17] (which creates cavities inside the silicon to weaken the structure, thus hindering the ability of the adversary to decapsulate and thin out the die) and Backside Buried Metal (BBM) [18], [19], [20] (which is a kind of Cu mesh buried inside the silicon during the last fabrication step).…”