Joel Damiens

Voltage Glitch Attacks on Mixed-Signal Systems

Supply voltage glitches are a well-known fault injection method used to attack electronic circuits. The aim of this paper is to identify the specific threats of mixed signal systems and to provide some solutions to ensure their security. Indeed, many Systems on Chip use both analog and digital circuits but, most of the time, the security of such application is considered only from an exclusively digital or sometimes analog point of view. However, in mixed-signals systems, analog and digital solutions coexist and must be considered as a unique system to ensure the security of the whole application. In this purpose, this paper gives an overview of voltage glitch attacks effects and countermeasures for analog and digital blocks as part of Mixed-Signal SoCs (AMS-SoCs). It also emphasizes the unique behavior of mixed-signal circuits during glitch attacks and suggest some guidelines to associate efficiently analog and digital solutions to secure a mixed-signal system.

Increasing the security level of analog IPs by using a dedicated vulnerability analysis methodology

With the increasing diffusion of multi-purpose systems such as smart phones and set-top boxes, security requirements are becoming as important as power consumption and silicon area constraints in SoCs and ASICs conception. In the same time, the complexity of IPs and the new technology nodes make the security evaluation more difficult. Indeed, predicting how a circuit behaves when pushed beyond its specifications limits is now a harder task. While security concerns in software development and digital hardware design are very well known, analog hardware security issues are not really studied. This paper first introduces the security concerns for analog and mixed circuits and then presents a vulnerability analysis methodology dedicated to them. Using this methodology, the security level of AMS SoC and Analog IP is increased by evaluating objectively its vulnerabilities and selecting appropriated countermeasure in the earliest design steps.

Laser attacks on integrated circuits: From CMOS to FD-SOI

The use of a laser as a means to inject errors during the computations of a secure integrated circuit (IC) for the purpose of retrieving secret data was first reported in 2002. Since then, a lot of research work, mainly experimental, has been carried out to study this threat. This paper reports research conducted, in the framework of the french national project LIESSE, to obtain an electrical model of the laser effects on CMOS ICs. Based on simulation, a first model permitted us to draw the laser sensitivity map of a SRAM cell. It demonstrates a very close correlation with experimental measures. We also introduce the preliminary results we gathered to build a similar electrical model for FD-SOI circuits. FD-SOI technology is expected to be less sensitive to laser than CMOS.

Lifetime and wearout current modeling of ultra-thin oxide antifuse bitcells using transient characterization

The lifetime modeling of antifuse bit cells is studied using transient measurements. Firstly, the wearout current is successfully modeled as Fowler-Nordheim. Secondly, the TDDB power-law voltage acceleration model is validated down to 30 0ns for a stress voltage of 5.5 V. Lifetime results are compared with the Multi-Vibrational Hydrogen Release Model.

Laser-induced fault effects in security-dedicated circuits

Lasers have become one of the most efficient means to attack secure integrated systems. Actual faults or errors induced in the system depend on many parameters, including the circuit technology and the laser characteristics. Understanding the physical effects is mandatory to correctly evaluate during the design flow the potential consequences of a laser-based attack and implement efficient counter-measures. This paper presents results obtained within the LIESSE project, aiming at defining a comprehensive approach for designers. Outcomes include the definition of fault/error models at several levels of abstraction, specific CAD tools using these models and new counter-measures well-suited to thwart laser-based attacks. Actual measures on components manufactured in the new 28 nm FDSOI technology are also presented.

Understanding the influence of antifuse bitcell dimensions the programming time and energy using an analytical model

Using TBD and Iwearout characterization and modeling, the influence of antifuse bitcell dimensions is evaluated. An analytical model based on silicon measurements and reliability laws allows the comparison of three bitcell architectures fabricated in standard CMOS 40nm (no extra processing). The model yields the time-to-breakdown and the wearout current as a function of the programming voltage and the dimensions of the antifuse bitcell. As a main result, it is demonstrated that a device with a small capacitor area exhibits shorter TBD, lower Iwearout, and hence a lower programming energy. Characterization and modeling are performed for a programming voltage range from 3.5V to 7V with a minimum TBD of 9ns.

Clock generator behavioral modeling for supply voltage glitch attack effects analysis

Supply voltage glitch attack is an easy and efficient method to induce faults in electronic devices. This attack represents a serious threat for hardware security. Considering analog circuits, due to the high simulation times and the complexity of the fault propagation, the analysis of glitch effects is still quite difficult. However, these faults can propagate to the digital part of an analog and mixed system involving serious security breaches. This work presents a behavioral modeling method applied to the analysis of the effects of glitch attacks on a clock generation system. This modeling method makes easier the fault propagation analysis and reduces the simulation time. This propagation analysis will allow developing efficient and optimal countermeasures against glitch attacks. This paper shows that, using behavioral models rather than transistor level simulation, the simulation time for fault propagation analysis can be reduced by a factor of 27 and so vulnerabilities can be identified in a shorter time.