Reversing stealthy dopant-level circuits

Sugawara, Takeshi; Suzuki, Daisuke; Fujii, Ryoichi; Tawa, Shigeaki; Ryohei, Hori; Shiozaki, Mitsuru; Fujino, Takeshi

doi:10.1007/s13389-015-0102-5

Cited by 31 publications

(34 citation statements)

References 5 publications

(7 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This results in an impractical technique of reading out the complete memory of several mm 2 . Whereas in the security community, Scanning Electron Microscopy has been recently used for hardware trojan detection [21] [5] and for spatially resolved laser fault injection [4]. Following those investigations, we show in this paper how Flash EEPROM contents commonly thought unreachable are retrieved using artefact free backside sample preparation, fined tuned SEM acquisitions (Voltage Contrast mode) and efficient image processing.…”

Section: Introductionmentioning

confidence: 82%

Reverse Engineering Flash EEPROM Memories Using Scanning Electron Microscopy

Courbon

Skorobogatov

Woods³

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this article, a methodology to extract Flash EEPROM memory contents is presented. Samples are first backside prepared to expose the tunnel oxide of floating gate transistors. Then, a Scanning Electron Microscope (SEM) in the so called Passive Voltage Contrast (PVC) mode allows distinguishing '0' and '1' bit values stored in individual memory cell. Using SEM operator-free acquisition and standard image processing technique we demonstrate the possible automating of such technique over a full memory. The presented fast, efficient and low cost technique is successfully implemented on 0.35µm technology node microcontrollers and on a 0.21µm smart card type integrated circuit. The technique is at least two orders of magnitude faster than state-of-the-art Scanning Probe Microscopy (SPM) methods. Without adequate protection an adversary could obtain the full memory array content within minutes. The technique is a first step for reverse engineering secure embedded systems.

show abstract

Section: Introductionmentioning

confidence: 82%

Reverse Engineering Flash EEPROM Memories Using Scanning Electron Microscopy

Courbon

Skorobogatov

Woods³

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Dopant-level Trojans are the closest example of substitution Trojans [4], [5]. Though their non-existent footprints make them difficult to detect via side channels, post-fabrication imaging techniques that can identify such Trojans have been proposed [48]. Lastly, our implemented metrics do not capture the threat of viaonly additive Trojans.…”

Section: Discussionmentioning

confidence: 99%

ICAS: an Extensible Framework for Estimating the Susceptibility of IC Layouts to Additive Trojans

Trippel

Shin

Bush

et al. 2020

2020 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

The transistors used to construct Integrated Circuits (ICs) continue to shrink. While this shrinkage improves performance and density, it also reduces trust: the price to build leading-edge fabrication facilities has skyrocketed, forcing even nation states to outsource the fabrication of high-performance ICs. Outsourcing fabrication presents a security threat because the black-box nature of a fabricated IC makes comprehensive inspection infeasible. Since prior work shows the feasibility of fabrication-time attackers' evasion of existing post-fabrication defenses, IC designers must be able to protect their physical designs before handing them off to an untrusted foundry. To this end, recent work suggests methods to harden IC layouts against attack. Unfortunately, no tool exists to assess the effectiveness of the proposed defenses, thus leaving defensive gaps.This paper presents an extensible IC layout security analysis tool called IC Attack Surface (ICAS) that quantifies defensive coverage. For researchers, ICAS identifies gaps for future defenses to target, and enables the quantitative comparison of existing and future defenses. For practitioners, ICAS enables the exploration of the impact of design decisions on an IC's resilience to fabrication-time attack. ICAS takes a set of metrics that encode the challenge of inserting a hardware Trojan into an IC layout, a set of attacks that the defender cares about, and a completed IC layout and reports the number of ways an attacker can add each attack to the design. While the ideal score is zero, practically, we find that lower scores correlate with increased attacker effort.To demonstrate ICAS' ability to reveal defensive gaps, we analyze over 60 layouts of three real-world hardware designs (a processor, AES and DSP accelerators), protected with existing defenses. We evaluate the effectiveness of each circuit-defense combination against three representative attacks from the literature. Results show that some defenses are ineffective and others, while effective at reducing the attack surface, leave 10's to 1000's of unique attack implementations that an attacker can exploit.

show abstract

“…For example, advanced tools for failure analysis of emerging technologies can be "misused" for physical attacks in the field. For security schemes based on CMOS technology, we have seen this with the proliferation and wider availability of, e.g., electron microscopy [73] and electro-optical probing [27]. (4) Technology exploration, prototyping, and joint evaluation of securities schemes based on emerging technologies.…”

Section: Challenges For Hardware Security Using Emerging Technologiesmentioning

confidence: 99%

Hardware Security For and Beyond CMOS Technology

Knechtel¹

2020

Proceedings of the 2020 International Symposium on Physical Design

View full text Add to dashboard Cite

As with most aspects of electronic systems and integrated circuits, hardware security has traditionally evolved around the dominant CMOS technology. However, with the rise of various emerging technologies, whose main purpose is to overcome the fundamental limitations for scaling and power consumption of CMOS technology, unique opportunities arise also to advance the notion of hardware security. In this paper, I first provide an overview on hardware security in general. Next, I review selected emerging technologies, namely (i) spintronics, (ii) memristors, (iii) carbon nanotubes and related transistors, (iv) nanowires and related transistors, and (v) 3D and 2.5D integration. I then discuss their application to advance hardware security and also outline related challenges. CCS CONCEPTS• Security and privacy → Security in hardware; • Hardware → Emerging technologies.

show abstract

Reversing stealthy dopant-level circuits

Cited by 31 publications

References 5 publications

Reverse Engineering Flash EEPROM Memories Using Scanning Electron Microscopy

Reverse Engineering Flash EEPROM Memories Using Scanning Electron Microscopy

ICAS: an Extensible Framework for Estimating the Susceptibility of IC Layouts to Additive Trojans

Hardware Security For and Beyond CMOS Technology

Contact Info

Product

Resources

About