Role of Laser-Induced IR Drops in the Occurrence of Faults: Assessment and Simulation

Abstract

International audienceLaser fault injection attacks induce transient faults into ICs by locally generating transient currents capable of temporarily flipping the outputs of logic gates. Laser fault injection may be anticipated or studied by using simulation tools at different abstraction levels: physical, electrical or logical. At the electrical level, the general laser-fault injection model is based on the addition of current sources to the various sensitive nodes of CMOS transistors. This type of electrical model does not take into account the large transient current components also induced between VDD and GND as a result of laser illumination. Such current components have no direct effect on the logic gate output nodes. Still, they provoke a significant IR-drop that may, in turn, contribute to the fault injection process. This paper describes our research on the assessment of this contribution. It introduces an upgraded electrical model taking the laser-induced IR-drop into account. It also proposes a methodology that allows the model's use to simulate laser-induced faults at electrical level in large-scale circuits. On the basis of simulations with a case-study circuit, we found that, depending on the parameters of the laser pulse, the number of injected faults may be underestimated by a factor as large as 48 if the laser-induced IR-drop is ignored. This may lead to incorrect estimations of the fault injection threshold, which is especially relevant for the design of countermeasure techniques for secure integrated systems

The case of using CMOS FD-SOI rather than CMOS bulk to harden ICs against laser attacks

“…It is always reserve biased (at V dd,core ) and has a large area (two factors in favor of a large laserinduced transient current). When exposed to laser illumination it will undergo a pulse photocurrent between Vdd and Gnd, inducing an IR drop phenomenon that may encourage the injection of faults as reported in [27].…”

Laser attack benchmark suite

“…At the Electrical level, a double exponential current source can model the irst order of a laser shot [26]. With the current sources added to the netlists of cells illuminated by the laser, an electricallevel simulation that takes into account the efects of a laser attack can be performed [41]. To improve simulation performance, new multi-level techniques propose hybrid solutions that simulate in detail only speciic circuit blocks that are afected by the laser (see Section 8).…”

Further Analysis of Laser-induced IR-drop

“…In this case, a laser shot also induces a current that flows from VDD to GND causing a temporary drop in supply voltage (IR-drop) known by designers to be a source of timing failures. As the induced IR-drop may be of significant amplitude and duration [16], [17], it has to be taken into account while performing LFI simulation.…”