exp. comparison and analysis of the sensitivity to laser fault...
TRANSCRIPT
Exp. comparison and analysis of the sensitivity to laser fault injection of CMOS FD-SOI and
CMOS bulk technologies
IOLTS 2018 24th IEEE International On-Line Testing Symposium
J.M. Dutertre1, V. Beroulle2, P. Candelier3, L.B. Faber3, M.L. Flottes4, P. Gendrier3, D. Hély2, R. Leveugle5, P. Maistri5, G. Di Natale4, A. Papadimitriou2, B. Rouzeyre4
Wednesday, July 4th 2018 Platja D’Aro, Costa Brava, Spain
(1) (2) (3) (4) (5)
Laser Fault Injection CMOS bulk vs FD-SOI
! Who’s interested in laser fault injection?
" Radiation effects community since 1967 ! ICs for spatial & aircraft applications
! Single Event Effects (SEEs) induced by ionizing particles
! Pulsed laser (ps range) used for SEE emulation
! Various countermeasures: techno. & process? (small market)
CMOS Silicon On Insulator (SOI) less sensitive to SEEs
The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits, D. Habing, 1967
2
! Who’s interested in laser fault injection?
" Hardware Security community ! Concept of fault injection: 1997 D. Boneh et al.
! Laser fault injection: 2002 S. Skorobogatov et al.
On the Importance of Checking Cryptographic Protocols for Faults, Dan Boneh et al, 1997 Optical Fault Induction Attacks, S. Skorobogatov et al, 2002
Laser Fault Injection CMOS bulk vs FD-SOI
! Technological countermeasure?
! SOI to mitigate laser fault injection
! Dev. of a dedicated process is expensive
3
Laser Fault Injection CMOS bulk vs FD-SOI
" UTBB FD-SOI (Ultra-Thin Body and Box Fully-Depleted SOI)
! is now a mature technology (ST Micro, Samsung, GlobalFoundries)
! Ultra Low Power application (low static leakage, body biasing)
! Laser-induced faults/SEEs mitigation properties?
Topic of this talk: FD-SOI laser fault injection mitigation properties, and comparison with CMOS bulk, on experimental basis at the 28 nm tech. node
4
Outline
I. Introduction II. Theory of laser fault injection
V. Conclusion
III. State of the art
5
IV. Laser sensitivity assessment of FD-SOI and CMOS bulk
Outline
I. Introduction II. Theory of laser fault injection
V. Conclusion
III. State of the art
6
IV. Laser sensitivity assessment of FD-SOI and CMOS bulk
! Mechanism, photoelectric effect
! LFI sensitivity of CMOS bulk
! LFI sensitivity of CMOS FD-SOI
Current (mA)
Current peak
Drift current
Time (ns) 0.2 0.4 0.6 0.8 1.0
Imax
Theory of laser fault injection
! Photoelectric effect: transient current generation
Drain ( Gnd )
N+ diffusion
Laser
- + + +
+ + + + +
- +
- - -
- -
-
Depletion region E
Drain ( VDD )
P substrate (Gnd)
Transient current
Laser sensitive areas: reverse biased PN junctions 7
laser beam
P substrate
N well
P+
Cout ‘1’
to Vdd
P+ N+ N+ N+ P+
to Gnd
in ‘0’
NMOS PMOS
Metal 1 MOS gate
=> ‘0’
• transient current # voltage transient (SET, single event transient)
OFF ON
! Fault injection mechanism: CMOS bulk inverter
Theory of laser fault injection
Voltage transient # fault (prop. into DFF, or memory flip) 8
pmos
B (gnd)
nmos
N+N+P+
G
DS
Nwell
P+P+ N+
D
G
S B (Vdd)
P−substrate
PN junctions = laser sensitive ares of CMOS devices: 3 types (1), (2), (3)
(1)
(3)
(2)
9
Theory of laser fault injection
! LFI sensitivity of CMOS bulk
(a) (b)
(c)
Parasitic bipolar transistors: 3 types (a), (b), (c)
NwellPwell
P+
P−substrate
P+ type Si
box
P+ P+
box
N+ N+
N+P+
Insulator (STI or box or gate oxide)N+ type Si
P type Si P−substrate gate
G
S D D S
G
rvt nmos rvt pmos
B (gnd) B (Vdd)gnd
N type Si
STI STI STI STISTI
NMOS
‘Regular Vt’ transistors
10
Theory of laser fault injection
! CMOS FD-SOI structure
NwellPwell
P+
P−substrate
P+ type Si
box
P+ P+
box
N+ N+
N+P+
Insulator (STI or box or gate oxide)N+ type Si
P type Si P−substrate gate
G
S D D S
G
rvt nmos rvt pmos
B (gnd) B (Vdd)gnd
N type Si
STI STI STI STISTI
NMOS
Isolation box (thickness < 30nm)
Channel: intrinsic Si (thickness < 10 nm)
Reduced charge collection volume
Reduced laser sensitivity?
11
‘Regular Vt’ transistors
Theory of laser fault injection
! CMOS FD-SOI structure
NwellPwell
P+
P−substrate
P+ type Si
box
P+ P+
box
N+ N+
N+P+
Insulator (STI or box or gate oxide)N+ type Si
P type Si P−substrate gate
G
S D D S
G
rvt nmos rvt pmos
B (gnd) B (Vdd)gnd
N type Si
STI STI STI STISTI
Laser sensitive PN junctions: 1 type (1)
(1)
12
‘Regular Vt’ transistors
Theory of laser fault injection
! CMOS FD-SOI structure
DrainN+
SV = 0 FGV = 0DV > 0
BGV = 0
Laser induced charge carriers
holes (h )+
Source
BOX
Pwell
Gate oxide
ChannelN+
−−
+
−electrons (e )
collector e
base h
emitter e
Parasitic bipolar NPN transistor
Theory of laser fault injection
! Laser sensitivity of FD-SOI
DrainN+
SV = 0 FGV = 0DV > 0
BGV = 0
Laser induced charge carriers
holes (h )+
Source
BOX
Pwell
Gate oxide
ChannelN+
−−
+
−electrons (e )
collector e
base h
emitter e
Laser induced charge carriers
holes: h+ electrons: e-
13
DrainN+
SV = 0 FGV = 0DV > 0
BGV = 0
Laser induced charge carriers
holes (h )+
Source
BOX
Pwell
Gate oxide
ChannelN+
−−
+
−electrons (e )
collector e
base h
emitter e
Parasitic bipolar NPN transistor
Theory of laser fault injection
! Laser sensitivity of FD-SOI
amplification effect on the laser-induced current 14
Theory of laser fault injection
! Laser sensitivity of FD-SOI vs CMOS bulk
Radiation hardness of FDSOI and FinFET technologies, M.L. Alles et al, 2011
Advantages of FD-SOI (rule of thumbs):
• isolation box under transistors x10 (factor in lower sensitivity)
• smaller sensitive area x2 (factor in lower sensitivity)
# less charge sharing between transistors.
Parasitic bipolar amplification effect on the laser-induced current:
# there are still faults
# x10 and x2 may not be fullfilled
15
Outline
I. Introduction II. Theory of laser fault injection
V. Conclusion
III. State of the art
16
IV. Laser sensitivity assessment of FD-SOI and CMOS bulk
! Radiation focused State-of-the-art
! Security focused State-of-the-art
State-of-the-art
" Radiation focused state-of-the-art
! Neutrons, heavy ions, laser
! Laser for SEE emulation: 1 µm diameter, ps range
! SOI or FD-SOI, 0.2 µm to 28 nm
! Mainly on elementary test patterns
1-2 orders of magnitude in favor of SOI/FD-SOI
17
State-of-the-art
" Security focused state-of-the-art
! CMOS bulk vs CMOS FD-SOI at 28 nm
! Elementary test patterns: wells or transistors
! Laser settings: 1,064 nm, 1-5 µm diameter, ns & µs ranges
1 order of magnitude in terms of peak current
FD-SOI: smaller extension of sensitive areas
18
Outline
I. Introduction II. Theory of laser fault injection
V. Conclusion
III. State of the art
19
IV. Laser sensitivity assessment of FD-SOI and CMOS bulk
! Experimental setup
! Radiation-centric experimental results
! Attack-centric experimental results
Laser sensitivity of FD-SOI vs CMOS bulk
" Experimental setup
20
" Experimental setup
• Backside injection
• Pulse width: 30 ps – up to 100 nJ
• Wavelength: 1,030 nm
• Pulse width: ns – 5-50 ns, max. power 1 W – 50 ns – 1 s, max. power 3 W
• Wavelength: 1,064 nm
• Spot size: 1µm or 5 µm
Laser sensitivity of FD-SOI vs CMOS bulk
21
" Test chips CMOS 28 nm ! Target: AES implementation (with parity-based CM) Vdd = 1.2 V
• IR microphotography (rear side), obj. x20
CMOS bulk CMOS FD-SOI Thickness ~ 100 µm Thickness ~ 100 µm
22
Laser sensitivity of FD-SOI vs CMOS bulk
x y
Laser head
Laser sensitivity of FD-SOI vs CMOS bulk
" Experiments description
Laser fault injection threshold + 2,000 injections attempts per test
Full functional IP running at 100 MHz 23
" Radiation-centric experimental results ! Laser parameters: 30 ps, 1 µm laser spot diameter
Laser sensitivity of FD-SOI vs CMOS bulk
Laser fault injection threshold CMOS bulk CMOS FD-SOI
[W] [mW/µm2] [W] [mW/µm2] Laser: 30 ps / 1 µm 0.2 nJ 16.9 pJ/µm2 0.6 nJ 50.6 pJ/µm2
x3
24
" Radiation-centric experimental results ! Laser parameters: 30 ps, 1 µm laser spot diameter
30 ps, 5 µm laser spot diameter
Laser sensitivity of FD-SOI vs CMOS bulk
Laser fault injection threshold CMOS bulk CMOS FD-SOI
[W] [mW/µm2] [W] [mW/µm2] Laser: 30 ps / 1 µm 0.2 nJ 16.9 pJ/µm2 0.6 nJ 50.6 pJ/µm2
Laser: 30 ps / 5 µm 0.3 nJ 2.2 pJ/µm2 2.1 nJ 15.4 pJ/µm2
x7
• FD-SOI vs bulk: x3 factor sensitivity decrease disappointing at 1 µm,
• FD-SOI vs bulk: x7 factor at 5 µm close to state-of-the-art.
25
" Attack-centric experimental results ! Laser parameters: 10 ns, 1 µm laser spot diameter
Laser sensitivity of FD-SOI vs CMOS bulk
Laser fault injection threshold CMOS bulk CMOS FD-SOI
[W] [mW/µm2] [W] [mW/µm2] Laser: 10 ns / 1 µm 0.45 38 0.8 67.5
26
" Attack-centric experimental results ! Laser parameters: 10 ns, 1 µm laser spot diameter
10 ns, 5 µm laser spot diameter
Laser sensitivity of FD-SOI vs CMOS bulk
Laser fault injection threshold CMOS bulk CMOS FD-SOI
[W] [mW/µm2] [W] [mW/µm2] Laser: 10 ns / 1 µm 0.45 38 0.8 67.5 Laser: 10 ns / 5 µm 0.6 4.4 - -
No fault (1W limit)
27
" Attack-centric experimental results ! Laser parameters: 10 ns, 1 µm -10 ns, 5 µm
50 ns, 5 µm laser spot diameter
Laser sensitivity of FD-SOI vs CMOS bulk
Laser fault injection threshold CMOS bulk CMOS FD-SOI
[W] [mW/µm2] [W] [mW/µm2] Laser: 10 ns / 1 µm 0.45 38 0.8 67.5 Laser: 10 ns / 5 µm 0.6 4.4 - - Laser: 50 ns / 5 µm 0.3 2.2 2.2 16
x7
28
Outline
I. Introduction II. Theory of laser fault injection
V. Conclusion
III. State of the art
29
IV. Laser sensitivity assessment of FD-SOI and CMOS bulk
" Analysis
Conclusion
Laser fault injection threshold CMOS bulk CMOS FD-SOI
[W] [mW/µm2] [W] [mW/µm2] Laser: 30 ps / 1 µm 0.2 nJ 16.9 pJ/µm2 0.6 nJ 50.6 pJ/µm2
Laser: 30 ps / 5 µm 0.3 nJ 2.2 pJ/µm2 2.1 nJ 15.4 pJ/µm2
Laser: 10 ns / 1 µm 0.45 38 0.8 67.5 Laser: 10 ns / 5 µm 0.6 4.4 - - Laser: 50 ns / 5 µm 0.3 2.2 2.2 16
Advantage of CMOS FD-SOI over CMOS bulk: • 1-2 order of magnitude of the SotA not fulfilled,
• At 1 µm spot diameter: a factor 2-3
• At 5 µm spot diameter: a factor 7 30
" Analysis
Conclusion
NwellPwell
P+
P−substrate
P+ type Si
box
P+ P+
box
N+ N+
N+P+
Insulator (STI or box or gate oxide)N+ type Si
P type Si P−substrate gate
G
S D D S
G
rvt nmos rvt pmos
B (gnd) B (Vdd)gnd
N type Si
STI STI STI STISTI
(1)
! FD-SOI vulnerability?
Laser sensitive PN junctions: (1)
Laser-induced Vdd drop?
31
" Analysis
Conclusion
! Interest of a 2-3 lower laser sensitivity? • Intrinsic to FD-SOI,
• Equivalent to a similar increase in laser sensors efficiency, eg BBICS:
32
Work funded by the ANR: LIESSE project
Thank you for your attention
J.M. Dutertre1, V. Beroulle2, P. Candelier3, L.B. Faber3, M.L. Flottes4, P. Gendrier3, D. Hély2, R. Leveugle5, P. Maistri5, G. Di Natale4, A. Papadimitriou2, B. Rouzeyre4
(1) (2) (3) (4) (5)