Simulation and Experimental Demonstration of the Importance of IR-Drops During Laser Fault-Injection

International audienceLaser fault injections induce transient faults into ICs by locally generating transient currents that temporarily flip the outputs of the illuminated gates. Laser fault injection can be anticipated or studied by using simulation tools at different abstraction levels: physical, electrical or logical. At the electrical level, the classical laser-fault injection model is based on the addition of current sources to the various sensitive nodes of CMOS transistors. However, this model does not take into account the large transient current components also induced between the VDD and GND of ICs designed with advanced CMOS technologies. These short-circuit currents provoke a significant IR-drop that contribute to the fault injection process. This paper describes our research on the assessment of this contribution. It shows through simulation and experiments that during laser fault injection campaigns, laser-induced IR-drop is always present when considering circuits designed with deep submicron technologies. It introduces an enhanced electrical fault model taking the laser-induced IR-drop into account. It also proposes a methodology that allows the use of the model to simulate laser-induced faults at the electrical level in large-scale circuits. On the basis of further simulations and experimental results, we found that, depending on the laser pulse characteristics, the number of injected faults may be underestimated by a factor of up to 2.4 if the laser-induced IR-drop is ignored. This could lead to incorrect estimations of the fault injection threshold, which is especially relevant to the design of countermeasure techniques for secure integrated systems

Simulation et modélisation des effets de l'injection de fautes laser sur les circuits intégrés

Laser fault injections induce transient faults into ICs by locally generating transient currents that temporarily flip the outputs of the illuminated gates. Laser fault injection can be anticipated or studied by using simulation tools at different abstraction levels: physical, electrical or logical. At the electrical level, the classical laser-fault injection model is based on the addition of current sources to the various sensitive nodes of MOS transistors. However, this model does not take into account the large transient current components also induced between the VDD and GND of ICs designed with advanced CMOS technologies. These short-circuit currents provoke a significant IR drop that contribute to the fault injection process. This thesis describes our research on the assessment of this contribution. It shows by simulation and experiments that during laser fault injection campaigns, laser-induced IR drop is always present when considering circuits designed in deep submicron technologies. It introduces an enhanced electrical fault model taking the laser-induced IR-drop into account. It also proposes a methodology that uses standard CAD tools to allow the use of the enhanced electrical model to simulate laser-induced faults at the electrical level in large-scale circuits. On the basis of further simulations and experimental results, we found that, depending on the laser pulse characteristics, the number of injected faults may be underestimated by a factor as large as 3 if the laser-induced IR-drop is ignored. This could lead to incorrect estimations of the fault injection threshold, which is especially relevant to the design of countermeasure techniques for secure integrated systems. Furthermore, experimental and simulation results show that even though laser fault injection is a very local and accurate fault injection technique, the induced IR drops have a global effect spreading through the supply network. This gives experimental evidence that the effect of laser illumination is not as local as usually considered.Les injections de fautes laser induisent des fautes transitoires dans les circuits intégrés en générant localement des courants transitoires qui inversent temporairement les sorties des portes illuminées. L'injection de fautes laser peut être anticipée ou étudiée en utilisant des outils de simulation à différents niveaux d'abstraction: physique, électrique ou logique. Au niveau électrique, le modèle classique d'injection de fautes laser repose sur l'ajout de sources de courant aux différents nœuds sensibles des transistors MOS. Cependant, ce modèle ne prend pas en compte les grands composants de courant transitoire également induits entre le VDD et le GND des circuits intégrés conçus avec des technologies CMOS avancées. Ces courants de court-circuit provoquent un significatif IR drop qui contribue au processus d'injection de faute. Cette thèse décrit notre recherche sur l'évaluation de cette contribution. Il montre par des simulations et des expériences que lors de campagnes d'injection de fautes laser, le IR drop induite par laser est toujours présente lorsque l'on considère des circuits conçus dans des technologies submicroniques profondes. Il introduit un modèle de faute électrique amélioré prenant en compte le IR drop induite par laser. Il propose également une méthodologie qui utilise des outils CAD standard pour permettre l'utilisation du modèle électrique amélioré pour simuler des fautes induits par laser au niveau électrique dans des circuits à grande échelle. Sur la base de simulations et de résultats expérimentaux supplémentaires, nous avons constaté que, selon les caractéristiques de l'impulsion laser, le nombre de fautes injectées peut être sous-estimé par un facteur aussi grand que 3 si le IR drop induite par laser est ignorée. Cela pourrait conduire à des estimations incorrectes du seuil d'injection des fautes, ce qui est particulièrement pertinent pour la conception de techniques de contre-mesures pour les systèmes intégrés sécurisés. De plus, les résultats expérimentaux et de simulation montrent que même si l'injection de fautes laser est une technique d'injection de fautes très locale et précise, les IR drops induites ont un effet global se propageant à travers le réseau d'alimentation. Cela donne des preuves expérimentales que l'effet de l'illumination laser n'est pas aussi local que d'habitude

Importance of IR Drops on the Modeling of Laser-Induced Transient Faults

International audienc

Standard CAD Tool-Based Method for Simulation of Laser-Induced Faults in Large-Scale Circuits

International audienceDesigning secure integrated systems requires methods and tools dedicated to simulating that early design stages' the effects of laser-induced transient faults maliciously injected by attackers. Existing methods for simulation of laser-induced transient faults do not take into account IR drop effects that are able to cause timing failures, abnormal reset, and SRAM flipping. This paper proposes a novel standard CAD tool-based method allowing to simulate laser-induced faults in large-scale circuits. Thanks to a power-grid network modeled by a commercial IR drop CAD tool, an additional transient current component causing laser-induced IR drop is taken into consideration. This current component flows from Vdd to Gnd and may have a significant effect on the fault injection process. The method provides fault sensitivity maps that enable a quick assessment of laser-induced fault effects on the circuit under analysis. As shown in the results, the number of induced faults is underestimated by a factor as large as 3.1 if laser-induced IR drop is ignored. This may lead to incorrect estimations of the fault injection threshold, which is especially relevant for the design of countermeasure techniques for secure integrated systems. Simulation times regarding four different circuits are also presented in the results section

Role of Laser-Induced IR Drops in the Occurrence of Faults: Assessment and Simulation

International audienceLaser fault injection attacks induce transient faults into ICs by locally generating transient currents capable of temporarily flipping the outputs of logic gates. Laser fault injection may be anticipated or studied by using simulation tools at different abstraction levels: physical, electrical or logical. At the electrical level, the general laser-fault injection model is based on the addition of current sources to the various sensitive nodes of CMOS transistors. This type of electrical model does not take into account the large transient current components also induced between VDD and GND as a result of laser illumination. Such current components have no direct effect on the logic gate output nodes. Still, they provoke a significant IR-drop that may, in turn, contribute to the fault injection process. This paper describes our research on the assessment of this contribution. It introduces an upgraded electrical model taking the laser-induced IR-drop into account. It also proposes a methodology that allows the model's use to simulate laser-induced faults at electrical level in large-scale circuits. On the basis of simulations with a case-study circuit, we found that, depending on the parameters of the laser pulse, the number of injected faults may be underestimated by a factor as large as 48 if the laser-induced IR-drop is ignored. This may lead to incorrect estimations of the fault injection threshold, which is especially relevant for the design of countermeasure techniques for secure integrated systems

Method for evaluation of transient-fault detection techniques

International audienceThis work introduces a simulation-based method for evaluating the efficiency of detection techniques in identifying transient faults provoked in combinational logic blocks. Typical fault profiles are simulated in campaigns of injections that reproduce output scenarios of fault-affected combinational circuits. Furthermore, a detection technique is proposed and compared to state-of-the-art strategies by using the method presented herein. Results show the capabilities of all studied techniques, providing a rank in terms of their efficiencies in detecting transient faults induced in combinational logic circuits, and analyzing the situations in which soft errors are produced in memory elements

Assessing Body Built-In Current Sensors for Detection of Multiple Transient Faults

International audienceOver the last few years, many architectures of body or bulk built-in current sensors (BBICSs) have been proposed to detect transient faults (TFs) in integrated circuits, all of them assessed through simulations in which only single TFs affect the circuit under run-time test. This work assesses and demonstrates the ability of a BBICS architecture in also detecting multiple and simultaneous TFs. Based on the classical double-exponential transient current model, multiple fault effects on a case-study circuit have been simulated with the injection of several current sources approximately representing the Gaussian distribution of a laser beam attack. Results show the BBICS architecture is able to detect multiple TFs simultaneously perturbing sensitive nodes of the case-study circuit

Validation Of Single BBICS Architecture In Detecting Multiple Faults

International audienc

Assessment of On-Chip Current Sensor for Detection of Thermal-Neutron Induced Transients

International audienceThis article assesses, for the first time, a body/bulk built-in current sensor (BBICS) in a CMOS 65-nm test chip under thermal neutron, high-energy neutron, and laser radiation. Experimental results suggest that the on-chip current sensor is effective to detect transient faults in different case-study subcircuits of the chip exposed to the accelerated radiation effects, opening prospects for embedding this type of sensor in reliable, secure, and low-power integrated circuit application

Assessment of Current Sensor on Chip for Detecting Neutron-Induced Transients via Body Terminals

International audienceThis work assesses for the first time a body built-in current sensor in a CMOS 65-nm test chip under neutron radiation and laser irradiation. The sensor is effective to detect transient faults induced from both