Reversing Stealthy Dopant-Level Circuits

Abstract

Abstract.A successful detection of the stealthy dopant-level circuit (trojan), proposed by Becker et al. at CHES 2013 [1], is reported. Contrary to an assumption made by Becker et al., dopant types in active region are visible with either scanning electron microscopy (SEM) or focused ion beam (FIB) imaging. The successful measurement is explained by an LSI failure analysis technique called the passive voltage contrast [2]. The experiments are conducted by measuring a dedicated chip. The chip uses the diffusion programmable device [3]: an anti-reverse-engineering technique by the same principle as the stealthy dopant-level trojan. The chip is delayered down to the contact layer, and images are taken with (1) an optical microscope, (2) SEM, and (3) FIB. As a result, the four possible dopant-well combinations, namely (i) p+/n-well, (ii) p+/p-well, (iii) n+/n-well and (iv) n+/p-well are distinguishable in the SEM images. Partial but sufficient detection is also achieved with FIB. Although the stealthy dopant-level circuits are visible, however, they potentially make a detection harder. That is because the contact layer should be measured. We show that imaging the contact layer is at most 16-times expensive than that of a metal layer in terms of the number of images 3 .

Obfuscating the Interconnects: Low-Cost and Resilient Full-Chip Layout Camouflaging

“…This is because dummy contacts/channels accumulate charges to a much lower degree than real contacts/channels. Threshold-dependent camouflaging of gates can also be revealed by SEM PVC, as demonstrated successfully by Sugawara et al [4]. As Collantes et al [10] indicate themselves, monitoring the etch rates can also reveal different doping levels, which are at the heart of their thresholddependent gates.…”

“…As a result, the constrained application of these and other schemes can compromise their resilience, as discussed next. 4…”

“…To hinder fab adversaries, i.e., to protect the secret dummy/true vias and wires in the BEOL layers, we leverage split manufacturing; therefore, we require a trusted BEOL facility. 4 The goal of malicious end-users is to reverse engineer the chip's layout and identify its secret mappings in the BEOL layers-recall that the latter is challenging and yet to be demonstrated (Sec. II-C).…”

“…Besides, a malicious end-user, i.e., an adversary without direct access to the design and fabrication process, can resort to reverse engineering of ICs to obtain the IP. The tools and know-how for such reverse-engineering attacks are becoming more advanced and widely available, rendering this a practical and severe threat [3], [4].…”

Physical Design Obfuscation of Hardware: A Comprehensive Investigation of Device and Logic-Level Techniques

“…Torrance and James [2] note that optical imaging suffices to extract such finer details at technologies above 0.18µm, and that Scanning Electron Microscope (SEM) can accomplish the same below 0.18µm if the dielectric is removed. 6) The attacker is able to detect dopant programming of transistors using techniques like passive voltage contrast [14]. 7) The attacker is able to delayer chip and further can distinguish between vias and fake vias; Rajendran et al [9] and others assume an attacker that lacks this capability.…”