August_EDFA_Digital

edfas.org 21 ELECTRONIC DEVICE FAILURE ANALYSIS | VOLUME 21 NO. 3 existing protective designs, and eliminating existing weaknesses. SEMI-INVASIVE PHYSICAL INSPECTION/ATTACKS Semi-invasive inspection/attacks live in the gray zone between noninvasive and invasive attacks. These inspec- tion/attacks are mostly based on optical techniques, i.e., methods based onUV light, laser, and x-ray. Semi-invasive attacks pose a greater threat to chip security due to their lowcost and reducedevaluation time. Inmost cases, semi- invasive methods require decapsulating the chip. The chip’s internal structure remains intact as access to direct contact with metal layers and transistors is not needed. The IC must remain functional after decapsulation. OPTICAL FAULT INJECTION INSPECTION/ATTACK It has been reported that if the photon energy is higher than the silicon bandgap energy, i.e., 1.1 eV, electron-hole pairs can be generated in the silicon. This principle can also be used for injecting faults in embedded devices such as microcontrollers and FPGAs, and even in a phys- ically unclonable function. [15] In optical fault injection inspection/attack techniques, the chip is decapsulated and mounted on a PCB to facilitate fault injection attack. Fault injection is possible from both the front side and backside. As the number of interconnect layers at the front side of a modern chip increases, the optical path of photons becomes obstructed. Such an obstruction is avoided by injecting faults from the backside. The target position canbe selectedusing reverse engineering or pho- tonic emission analysis, whichwill be discussedbriefly in a later section. To inject a fault in a circuit by flipping a bit, a precisely focused light sourcewithphotonic energy higher than the silicon bandgap energy is required. Photocurrent laser stimulation is used to introduce bit flips, whereas thermal laser stimulation introduces timing faults in the system [11] OPTICAL/PHOTONIC EMISSION SIDE-CHANNEL ANALYSIS At static states, a CMOS circuit operates in the linear region of a MOSFET. During a switching event, transistors enter into the operationmode called saturation for a short period of time. The transistors produce hot carriers that release energy in the form of photon emission. Due to the higher mobility of electrons, n-type transistors emit significantly more photons than p-type transistors. The Fig. 4 (a) Photonic emission and electro-optical frequency modulation (optical proing) techniques are used for passive and active measurements; (b) overview mirrored image of the complete Microsemi MPF300 Polarfire FPGA die at 1.3 µm laser; and (c) optical probing in a Microsemi FPGA for clock tree distribution—bright spots represent nodes connected with the clock tree. (a) (b) (c)