This is an old revision of the document!
Table of Contents
Backside analysis can include:
- Imaging transistor layout without delayering
- Imaging transistor activity using PMT, camera, etc for side channnel analysis
- Laser fault injection, bypassing security meshes and other things usually in the way
Fabs often thin wafers and perform backside analysis to get at the transistors without going through metal. [Functional IC Analysis] doesn't look like they thinned and they got pretty decent results.
Sample preparation example: http://jiam.utk.edu/new/PDF/Allied-Backside-Thinning.pdf
Camera
Sample commercial unit
With IR imaging and laser fault injection
Camera:
- uEeye Cockpit
- ueye IDS camera
- U124xSE-NIR
- Or maybe: UI24xSE-NIR
- think its standard camera they removed IR filter
Optical fault injection
In its simplest form, a CSP can be strobed with a camera flash
You need to excite the silicon with a photo of wavelength no more than 1.1 um (reference: “1234.5eV⋅nm/1.1eV is about 1100 nm. Putting 1100 back into the denominator yields 1.1 eV” (link))
https://www.cl.cam.ac.uk/~sps32/ches2010-bumping.pdf references using 1065 nm laser. The paper shows using IR objectives. So maybe a broadband source would work okay too.
Solutions include:
- ChipWispherer has voltage glitching. Could probably rig something similar up for optical glitching