SEU sensitivity and modeling using pico-second pulsed laser stimulation of a D Flip-Flop in 40 nm CMOS technology

Abstract

This paper presents the design of a CMOS 40 nm D Flip-Flop cell and reports the laser fault sensitivity mapping both with experiments and simulation results. Theses studies are driven by the need to propose a simulation methodology based on laser/silicon interactions with a complex integrated circuit. In the security field, it is therefore mandatory to understand the behavior of sensitive devices like D Flip-Flops to laser stimulation. In previous works, Roscian et al., Sarafianos et al., Lacruche et al. or Courbon et al. studied the relations between the layout of cells, its different laser-sensitive areas and their associated fault model using laser pulse duration in the nanosecond range. In this paper, we report similar experiments carried out using a shorter laser pulse duration (30 ps instead of 50 ns). We also propose an upgrade of the simulation model they used to take into account laser pulse durations in the picosecond range on a logic gate composed of a large number of transistors for a recent CMOS technology (40 nm).

Laser Fault Injection at the CMOS 28 nm Technology Node: an Analysis of the Fault Model

“…The most recent state-of-the-art was obtained at the 40 nm CMOS technology node on memory elements in static mode. [14] reports LFI experiments carried out on a 40 nm custom designed D flip-flop (DFF). Fig.…”

“…Laser-sensitivity map of a CMOS 40 nm D flip-flop cell: bit-set and bit-reset areas resp. highlighted in red and blue (courtesy of[14]). …”

Laser testing of a double-access BBICS architecture with improved SEE detection capabilities

“…To compare the BBICS results, Fig. 7 represents an SEU mapping from previous work [7] on a D Flip-Flop cell with exactly the same experimental settings. The measured SEU threshold energy was 0.5(±0.1) nJ.…”

“…Laser bench used for our experiments (injection through backside) Experimental results of a photoelectrical laser stimulation on a D Flip-Flop with a laser pulse duration of 30 ps and a laser energy of 0.7 nJ[7] …”

Practical Partial Hardware Reverse Engineering Analysis

“…Utilizing such an approach, locating specific cells can be done regardless of the device technology node and package. For instance, it can reduce attack rating for the identification and exploitation phase and can be used in conjunction with laser fault attacks [8] to bypass security mechanisms [7]. Multi-spot (bypass/fault capability) and high-power (through the substrate capability) platforms are commercially available, increasing security threat (redundancy and software check can be defeated).…”