Mathieu Lisart

Near-Field Mapping System to Scan in Time Domain the Magnetic Emissions of Integrated Circuits

This paper introduces a low cost near-field mapping system. This system scans automatically and dynamically, in the time domain, the magnetic field emitted by integrated circuits during the execution of a repetitive set of instructions. Application of this measurement system is given to an industrial chip designed with a 180nm CMOS process. This application demonstrates the efficiency of the system but also the helpfulness of the results obtained to identify paths followed by the current, enabling to locate the potential IR drop zones.

Building the electrical model of the pulsed photoelectric laser stimulation of an NMOS transistor in 90nm technology

This paper presents measurements of pulsed photoelectrical laser stimulation of an NMOS transistor in 90nm technology. The laser power was able to trig the NPN parasitic bipolar Drain/Psubstrate/Source. An electrical model is proposed in order to simulate effects induced by the laser. Results extracted from the electrical simulator are compared to measurements.

Electrical modeling of the effect of beam profile for pulsed laser fault injection

This paper presents a detailed simulation-based analysis of the influence of the laser spot shape and size on the parametric and logical transient errors that can be injected into a digital device. The effect of the impact of a Gaussian laser beam is simulated at the electrical level for different pulse durations. Results illustrate the complex interaction between the electrical function and the laser perturbation, with potential implications for secure circuit design.

Voltage Spikes on the Substrate to Obtain Timing Faults

Fault attacks are widely deployed against secure devices by hardware evaluation centers. While the least expensive fault injection techniques, like clock or voltage glitches, are well taken into account in secure devices by dedicated hardware counter-measures, more advanced techniques, such as light based attacks, require huge investments. This paper presents a new way to induce faults at a moderate cost that may defeat already in place hardware counter-measures. To demonstrate its effectiveness we applied this technique on an ASIC component. For this demonstration, fault exploitation is operated using the classic Bell core attack applied on a modular exponentiation supported by a modular arithmetic co-processor.

Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an SRAM cell

Abstract This abstract presents an electrical model of an SRAM cell exposed to a pulsed Photoelectrical Laser Stimulation (PLS), based on our past model of MOS transistor under laser illumination. The validity of our model is assessed by the very good correlation obtained between measurements and electrical simulation. These simulations are capable to explain some specific points. For example, in theory, a SRAM cell under PLS have four sensitive areas. But in measurements only three areas were revealed. A hypothesis was presented in this paper and confirmed by electrical simulation. The specific topology of the cell masks one sensitive area. Therefore the electrical model could be used as a tool of characterization of a CMOS circuits under PLS.

Experimental validation of a Bulk Built-In Current Sensor for detecting laser-induced currents

Bulk Built-In Current Sensors (BBICS) were developed to detect the transient bulk currents induced in the bulk of integrated circuits when hit by ionizing particles or pulsed laser. This paper reports the experimental evaluation of a complete BBICS architecture, designed to simultaneously monitor PMOS and NMOS transistors, under Photoelectric Laser Stimulation (PLS). The obtained results are the first experimental proof of the efficiency of BBICS in laser fault injection detection attempts. Furthermore, this paper highlights the importance of BBICS tapping in a sensitive area (logical gates) for improved laser detection. It studies the performances of this BBICS architecture and suggests modifications for its future implementation.

Robustness improvement of an SRAM cell against laser-induced fault injection

This paper presents the design of an SRAM cell with a robustness improvement against laser-induced fault injection. We report the fault sensitivity mapping of a first SRAM design. A careful analysis of its results combined with the use of an electrical model at transistor level of the photoelectric effect induced by a laser permit us to validate our approach. The robustness improvement is due to a specific layout which takes into account the topology of the cell and to the effect of a triple well implant on the laser sensitivity of NMOS transistors.

Laser attacks on integrated circuits: From CMOS to FD-SOI

The use of a laser as a means to inject errors during the computations of a secure integrated circuit (IC) for the purpose of retrieving secret data was first reported in 2002. Since then, a lot of research work, mainly experimental, has been carried out to study this threat. This paper reports research conducted, in the framework of the french national project LIESSE, to obtain an electrical model of the laser effects on CMOS ICs. Based on simulation, a first model permitted us to draw the laser sensitivity map of a SRAM cell. It demonstrates a very close correlation with experimental measures. We also introduce the preliminary results we gathered to build a similar electrical model for FD-SOI circuits. FD-SOI technology is expected to be less sensitive to laser than CMOS.

Electrical model of an NMOS body biased structure in triple-well technology under photoelectric laser stimulation

This study is driven by the need to optimize failure analysis methodologies based on laser/silicon interactions with an integrated circuit using a triple-well process. It is therefore mandatory to understand the behavior of elementary devices to laser illumination, in order to model and predict the behavior of more complex circuits. This paper presents measurements of the photoelectric currents induced by a pulsed-laser on an NMOS transistor in triple-well Psubstrate/DeepNwell/Pwell structure dedicated to low power body biasing techniques. This evaluation compares the triple-well structure to a classical Psubstrate-only structure of an NMOS transistor. It reveals the possible activation change of the bipolar transistors. Based on these experimental measurements, an electrical model is proposed that makes it possible to simulate the effects induced by photoelectric laser stimulation.

Building the electrical model of the pulsed photoelectric laser stimulation of a PMOS transistor in 90nm technology

This paper presents measurements of pulsed photoelectrical laser stimulation of a PMOS transistor in 90 nm technology. The laser power was able to trig three PNP parasitic bipolar transistors Drain/Nwell/Source, Drain/Nwell/Psubstrate and Source/Nwell/Psubstrate. An electrical model is proposed in order to simulate effects induced by the laser. Results extracted from the electrical simulator are compared to measurements.