Near-field Mapping System to Scan in Time Domain the Magnetic Emissions of Integrated Circuits

International audienceThis paper introduces a low cost near-field mapping system. This system scans automatically and dynamically, in the time domain, the magnetic field emitted by integrated circuits during the execution of a repetitive set of instructions. Application of this measurement system is given to an industrial chip designed with a 180nm CMOS process. This application demonstrates the efficiency of the system but also the helpfulness of the results obtained to identify paths followed by the current and to locate the potential IR drop zones

Experimental validation of a Bulk Built-In Current Sensor for detecting laser-induced currents

International audience—Bulk Built-In Current Sensors (BBICS) were developed to detect the transient bulk currents induced in the bulk of integrated circuits when hit by ionizing particles or pulsed laser. This paper reports the experimental evaluation of a complete BBICS architecture, designed to simultaneously monitor PMOS and NMOS transistors, under Photoelectric Laser Stimulation (PLS). The obtained results are the first experimental proof of the efficiency of BBICS in laser fault injection detection attempts. Furthermore, this paper highlights the importance of BBICS tapping in a sensitive area (logical gates) for improved laser detection. It studies the performances of this BBICS architecture and suggests modifications for its future implementation

SEU sensitivity and modeling using picosecond pulsed laser stimulation of a D Flip-Flop in 40 nm CMOS technology

International audience—This paper presents the design of a CMOS 40 nm D Flip-Flop cell and reports the laser fault sensitivity mapping both with experiments and simulation results. Theses studies are driven by the need to propose a simulation methodology based on laser/silicon interactions with a complex integrated circuit. In the security field, it is therefore mandatory to understand the behavior of sensitive devices like D Flip-Flops to laser stimulation. In previous works, Roscian et al., Sarafianos et al., Lacruche et al. or Courbon et al. studied the relations between the layout of cells, its different laser-sensitive areas and their associated fault model using laser pulse duration in the nanosecond range. In this paper, we report similar experiments carried out using a shorter laser pulse duration (30 ps instead of 50 ns). We also propose an upgrade of the simulation model they used to take into account laser pulse durations in the picosecond range on a logic gate composed of a large number of transistors for a recent CMOS technology (40 nm)

ElectroMagnetic Analysis and Fault Injection onto Secure Circuits

International audienceImplementation attacks are a major threat to hardware cryptographic implementations. These attacks exploit the correlation existing between the computed data and variables such as computation time, consumed power, and electromagnetic (EM) emissions. Recently, the EM channel has been proven as an effective passive and active attack technique against secure implementations. In this paper, we review the recent results obtained on this subject, with a particular focus on EM as a fault injection tool

Influence of triple-well technology on laser fault injection and laser sensor efficiency

International audienceThis study is driven by the need to understand the influence of a Deep-Nwell implant on the sensitivity of integrated circuits to laser-induced fault injections. CMOS technologies can be either dual-well or triple-well. Triple-well technology has several advantages compared to dual-well technology in terms of electrical performances. Single-event responses have been widely studied in dual-well whereas SEE (single event effects) in triple-well is not well understood. This paper presents a comparative analysis of soft error rate and countermeasures sensors with for these two techniques in 40 nm and 90 nm CMOS technology. First, laser fault injection on registers were investigated, showing that triple-well technology is more vulnerable. Similarly, we studied the efficiency of Bulk Built-In Current Sensors (BBICS) in detecting laser induced fault injection attempts for both techniques. This sensor was found less effective in triple-well. Finally, a new BBICS compliant with body-biasing adjustments is proposed in order to improve its detection efficiency

Modeling and Simulating Electromagnetic Fault Injection

International audienceElectromagnetic Fault Injection (EMFI) has recently gained popularity as a mean to induce faults because of its inherent advantages. Despite this popularity, there is only little information on how EMFI generates faults. Within this context, this paper aims at filling this lack by proposing a complete understanding and modeling of EM induction on Integrated Circuits (IC). The presented model is confronted to experiments to endorse its soundness

Electromagnetic Fault Injection : How Faults Occur

International audienceElectromagnetic Fault Injection (EMFI) has recently gained popularity as a mean to induce faults because of its inherent advantages. Among them, the most interesting is probably its ability to generate faults in Systems on Chips without removing the package, and this even if only the frontside is exposed to the EM field. Despite this popularity, there is only little information on how EMFI generates faults. Within this context, this paper first aims at filling this lack by proposing a complete modeling of EM induction fault mechanism. In a second step, the introduced model is confronted to experimental data in order to demonstrate its soundness

Local EM perturbations into CMOS ring oscillator

International audienc

Discussion on the Model of Laser Induced Faults in SRAM Memory cells

International audienceDiscussion on the Model of Laser Induced Faults in SRAM Memory cell

Local and Direct Power Injection on CMOS Integrated Circuits

International audienceThe paper aims at demonstrating experimentally that the tiny ElectroMagnetic (EM) coupling between the tip end of a micro-antenna is su cient to locally and directly inject power into CMOS Integrated Circuits (IC). More precisely, experimental results show that such electrical couplings are sufficient to disturb, with and without removing the IC package, the behavior of 90nm CMOS Ring Oscillators; a representative structure of CMOS logic but also a constituting element ,of some True Random Number Generators (TRNGs) or clock generator