Differences

This shows you the differences between two versions of the page.

--- backside:start [2018/02/20 21:54] – mcmaster
+++ backside:start [2018/02/20 21:55] (current) – removed mcmaster
@@ Line 1: / Line 1: @@
-Backside analysis can include:
-  * Imaging transistor layout without delayering
-  * Imaging transistor activity using PMT, camera, etc for side channnel analysis
-  * Laser fault injection, bypassing security meshes and other things usually in the way
-Fabs often thin wafers and perform backside analysis to get at the transistors without going through metal.  [Functional IC Analysis] doesn't look like they thinned and they got pretty decent results.
-[[http://jiam.utk.edu/new/PDF/Allied-Backside-Thinning.pdf|Sample preparation example]]
-====== Camera ======
-mcmaster: I bought an MU800 with the intention of removing the IR filter. I also might put silicon wafer in the imaging path to filter out the visible light. Unclear if my microscope optics can pass the IR light, say, even the relay lens. But I suppose if they have an IR filter it must pass some?
-Ordering some IR lasers
-===== Sample commercial unit =====
-With IR imaging and laser fault injection
-Camera:
-  * uEeye Cockpit
-  * ueye IDS camera
-  * U124xSE-NIR
-    * Or maybe: UI24xSE-NIR
-  * think its standard camera they removed IR filter
-  * https://en.ids-imaging.com/store/produkte/kameras/usb-2-0-kameras/ueye-se.html
-====== Optical fault injection ======
-Basic idea: change how the circuit switches current in order to introduce a glitch. For a combinitorial circuit you probably want a CW laser to keep the glitch active. If its a CPU, you probably want a pulsed laser to trigger the glitch for a short period of time
-{{:backside:transmission-spectrum-of-crystalline-silicon-from-the-visible-to-the-near-ir.png?400|}}
-Above: "FIGURE 3.1 Transmission spectrum of crystalline silicon from the visible to the near-IR." ([[https://www.researchgate.net/figure/Transmission-spectrum-of-crystalline-silicon-from-the-visible-to-the-near-IR_fig1_235941520|source]])
-In its simplest form, a CSP can be strobed with a camera flash
-You need to excite the silicon with a photo of wavelength no more than 1.1 um (reference: "1234.5eV⋅nm/1.1eV is about 1100 nm. Putting 1100 back into the denominator yields 1.1 eV" (link))
-[[https://www.cl.cam.ac.uk/~sps32/ches2010-bumping.pdf|Sergei paper]] references using 1065 nm laser. The paper shows using IR objectives. So maybe a broadband source would work okay too.
-{{:backside:transmission-spectrum-of-crystalline-silicon-from-the-visible-to-the-near-ir_mod.png?400|}}
-Above: silicon transmission marked with bandgap and for 980 nm laser (commonly available)
-Possible sources:
-  * Photo flash, such as with mask
-  * 980 nm laser will have high attenuation (roughly 2% transmittance), but should work if power is high enough
-    * Specifically? Maybe 100's of mW, maybe even 500. Needs testing
-  * 1065 nm (ie 1064 nm from Nd:YAG) and such is probably ideal
-    * Must Nd:YAG are flashlamp pumped
-    * Depending on glitch target might want either flashlamp or diode pumped
-[[https://www.riscure.com/uploads/2017/09/Practical-optical-fault-injection-on-secure-microcontrollers.pdf|Riscure paper]]
-Commercial solutions include:
-  * [[http://www.alphanov.com/40-optoelectronics-systems-and-microscopy-single-spot-laser-station.html|Alphanov]]
-  * [[https://www.riscure.com/security-tools/inspector-fi/|Riscure Inspector FI]]
-  * ChipWhispherer has voltage glitching. Could probably rig something similar up for optical glitching