Navid Asadizanjani

A Survey on Chip to System Reverse Engineering

The reverse engineering (RE) of electronic chips and systems can be used with honest and dishonest intentions. To inhibit RE for those with dishonest intentions (e.g., piracy and counterfeiting), it is important that the community is aware of the state-of-the-art capabilities available to attackers today. In this article, we will be presenting a survey of RE and anti-RE techniques on the chip, board, and system levels. We also highlight the current challenges and limitations of anti-RE and the research needed to overcome them. This survey should be of interest to both governmental and industrial bodies whose critical systems and intellectual property (IP) require protection from foreign enemies and counterfeiters who possess advanced RE capabilities.

Terahertz characterization of electronic components and comparison of terahertz imaging with x-ray imaging techniques

THz radiation is capable of penetrating most of nonmetallic materials and allows THz spectroscopy to be used to image the interior structures and constituent materials of wide variety of objects including Integrated circuits (ICs). The fact that many materials in THz spectral region have unique spectral fingerprints provides an authentication platform to distinguish between authentic and counterfeit electronic components. Counterfeit and authentic ICs are investigated using a high-speed terahertz spectrometer with laser pulse duration of 90 fs and repetition rate of 250 MHz with spectral range up to 3 THz. Time delays, refractive indices and absorption characteristics are extracted to distinguish between authentic and counterfeit parts. Spot measurements are used to develop THz imaging techniques. In this work it was observed that the packaging of counterfeit ICs, compared to their authentic counterparts, are not made from homogeneous materials. Moreover, THz techniques were used to observe different layers of the electronic components to inspect die and lead geometries. Considerable differences between the geometries of the dies/leads of the counterfeit ICs and their authentic counterparts were observed. Observing the different layers made it possible to distinguish blacktopped counterfeit ICs precisely. According to the best knowledge of authors the reported THz inspection techniques in this paper are reported for the first time for authentication of electronic components. Wide varieties of techniques such as X-ray tomography, scanning electron microscopy (SEM), Energy Dispersive X-ray Spectroscopy (EDS) and optical inspections using a high resolution microscope have also been being employed for detection of counterfeit ICs. In this paper, the achieved data from THz material inspections/ THz imaging are compared to the obtained results from other techniques to show excellent correlation. Compared to other techniques, THz inspection techniques have the privilege to be nondestructive, nonhazardous, less human dependent and fast.

Flower-like boehmite nanostructure formation in two-steps

Reaction between AlCl3 and TEA (triethanolamine) gave Al(OH)3 colloidal nanocrystals that were precursors to nucleation and growth of boehmite under hydrothermal conditions. Transition electron microscopic (TEM) observations revealed that flower-like nanostructures were produced through a binary self-assembly system. In the first stage, nanostrips organize themselves to form a bundle, because of NH4+ and TEA. In the second stage, the bundles form flower-like nanostructures due to the interaction of nitrate with TEA. The size of the nanopetals (length 100–200 nm; width 100–150 nm; and thickness 20–70 nm) was measured through TEM. X-ray diffraction and Brunauer–Emmett–Teller (BET-N2) results demonstrate that the obtained nanostructures were composed of a pure AlOOH phase with a surface area of 160 m2 g−1. The effect of Cl ˉ on the growth of boehmite 3-D nanoarchitectures in the presence of NO3ˉ was also investigated. Graphical Abstract

A layout-driven framework to assess vulnerability of ICs to microprobing attacks

Microprobing attacks against integrated circuits (IC) for security critical applications have become a serious concern. With the help of modern circuit editing techniques, an attacker could remove layers of materials and expose wires carrying security critical information for probing. Existing protection methods use active shielding to detect such attacks. However, this technique has been proven to be ineffective, while layers of trigger wire mesh introduce prohibitive cost overhead. In this paper, we investigate the problem of protection against microprobing attacks and present a method to scan layout for microprobing vulnerabilities so that more secure and less costly protections can be developed. Exemplary applications on OpenSPARC T1 core layout is used to evaluate the proposed flow and substantiate findings.

Chip editor: leveraging circuit edit for logic obfuscation and trusted fabrication

The globalization of the semiconductor foundry business poses grave risks in terms of intellectual property (IP) protection, especially for critical applications. Over the past few years, several techniques have been proposed that allow manufacturing of ICs at untrusted foundries by obfuscating and/or locking, albeit at high design overhead, low security guarantees and high cost. In this paper, for the first time, we utilize well-known, low-cost circuit edit techniques, which enable a designer to modify a circuit post-fabrication on a chip-by-chip basis. In the proposed design flow, obfuscated ICs are fabricated and tested at untrusted foundries, and post-fabrication focused ion beam (FIB) circuit edit techniques are utilized to revert the circuit back to its intended functionality at a trusted design house. In order to obfuscate the structural logic of the design, several possible gate-level techniques such as wire swapping and gate insertion are proposed. At the same time, the tradeoffs between layout-level modifications to aid circuit edit and the strength of obfuscation provided by the proposed approach are also assessed. Gate-level simulation results show that the chip-editor flow provides a strong level of design obfuscation and makes it infeasible for the untrusted foundry to retrieve the original design from the obfuscated layout it receives and the resultant netlist it can extract.

Acoustic Wave-Based Data Transmission for Multivariate Sensing

Improving process observability is of high relevancy to improved manufacturing process control. This paper describes a novel measurement technique using acoustic waves for the transmission of multiple physical parameters from within the cavity of an injection mold to a receiver outside: temperature, pressure, velocity, and viscosity of polymer melt. Such a technique is a key to improved monitoring and control of plastic injection molding. A coded-acoustic wave modulation scheme enables multiparameter transmission through an acoustic transmitter with variable gains. This enables selective resonant frequencies that provide the carriers for the individual parameters to be transmitted, while suppressing noise induced in the modulation process. The presented acoustic wireless sensing method is applicable to a wide range of process monitoring scenarios.

Coded acoustic wave modulation for multi-parameter transmission

Improving process observability is of high relevancy to improving manufacturing productivity. This paper describes the a data transmission technique that uses acoustic waves as the means for transmitting multiple parameters (melt temperature, pressure, velocity, and viscosity) that are critical to the monitoring and control of plastic injection molding processes. A coded-acoustic wave modulation scheme enables multi-parameter transmission through an acoustic transmitter with variable gains. This enables selective resonant frequencies that provide the carriers for the individual parameters to be transmitted, while suppressing noise induced in the modulation process. The presented sensor design principle is applicable to a wide range of process monitoring scenarios.

A New Method for Determining Melt Front Velocity Through Temperature Measurement

Online measurement of pressure, temperature, velocity, and viscosity of polymer melt within the injection mold is key to improving process control for quality assurance in injection molding. A multivariate sensing method has been introduced to enable simultaneous determination of the four parameters in injection molding using one single sensor package. Comparing with the method of measuring different physical parameters using separate sensors, the new method is advantageous in terms of system miniaturization and energy efficiency. This paper addresses the aspect of polymer melt velocity sensing based on the melt temperature measured by an Infrared (IR) sensing element integrated within the sensor package. From the Stephan-Boltzmann model, an analytical relationship between the melt front velocity and the ramping rate of the IR detector voltage output has been established. Using a Finite Element (FE) model, the process of polymer melt flowing over the IR sensor lens has been simulated. The result shows that the melt front velocity can be determined within an error of ± 0.25%, under a broad range of melt temperature and IR detector diameters. The result is experimentally confirmed by temperature measurement in a realistic injection molding machine instrumented with a reference IR sensor.Copyright

Counterfeit Electronics Detection Using Image Processing and Machine Learning

Counterfeiting is an increasing concern for businesses and governments as greater numbers of counterfeit integrated circuits (IC) infiltrate the global market. There is an ongoing effort in experimental and national labs inside the United States to detect and prevent such counterfeits in the most efficient time period. However, there is still a missing piece to automatically detect and properly keep record of detected counterfeit ICs. Here, we introduce a web application database that allows users to share previous examples of counterfeits through an online database and to obtain statistics regarding the prevalence of known defects. We also investigate automated techniques based on image processing and machine learning to detect different physical defects and to determine whether or not an IC is counterfeit.

Impact of X-Ray Tomography on the Reliability of Integrated Circuits

X-ray tomography provides 3-D information of an integrated circuit (IC) and has been utilized for counterfeit detection. Although it is a nondestructive process, electrical functionalities of IC under long time radiation has yet to be fully investigated. This paper analyzes the impact of X-ray tomography on the reliability of ICs with different fabrication technologies. We perform a 3-D imaging on Intel flash memories, Macronix flash memories, Xilinx Spartan 3, and Spartan 6 FPGAs and test the electrical functionalities after each round of tomography. We examine the impact of tomography on erase time, read margin, and program operation in flash memories. The change of ring oscillators frequency mapped in FPGAs is also investigated. A major finding is that tomography increases the erase time of flash memory of older technology nodes, eventually resulting in failure. In contrast, the flash and Xilinx FPGAs of newer technologies seem much less sensitive to tomography, as only minor degradations are observed. Degradation of IC performance is explained by considering total ionization dose effect due to tomography. Counterfeit detection requires approximately 2 h of tomography and no IC failed permanently during this time period.