backside:start
This is an old revision of the document!
Table of Contents
Backside analysis can include:
- Imaging transistor layout without delayering
- Imaging transistor activity using PMT, camera, etc for side channnel analysis
- Laser fault injection, bypassing security meshes and other things usually in the way
Fabs often thin wafers and perform backside analysis to get at the transistors without going through metal. [Functional IC Analysis] doesn't look like they thinned and they got pretty decent results.
Camera
Sample commercial unit
With IR imaging and laser fault injection
Camera:
- uEeye Cockpit
- ueye IDS camera
- U124xSE-NIR
- Or maybe: UI24xSE-NIR
- think its standard camera they removed IR filter
Optical fault injection
In its simplest form, a CSP can be strobed with a camera flash
You need to excite the silicon with a photo of wavelength no more than 1.1 um (reference: “1234.5eV⋅nm/1.1eV is about 1100 nm. Putting 1100 back into the denominator yields 1.1 eV” (link))
Sergei paper references using 1065 nm laser. The paper shows using IR objectives. So maybe a broadband source would work okay too.
Solutions include:
- ChipWispherer has voltage glitching. Could probably rig something similar up for optical glitching
backside/start.1519161913.txt.gz · Last modified: 2018/02/20 21:25 by mcmaster