May_EDFA_Digital

edfas.org 7 ELECTRONIC DEV ICE FA I LURE ANALYSIS | VOLUME 23 NO . 2 1100nm, generates photocarriers in the silicon. The logical state of a CMOS circuit can be flipped if the laser is focused to a drain or source terminal of the transistor, [3,4] hence, inject a fault in the circuitry. OPTICAL ATTACK STEPS During an optical attack, the ultimate goal of an adver- sary is to acquire the chip assets withminimumperturba- tion, and to learn the asset in the chip using PEA, LFI, or optical probing. Hence, to find the location of the target, an adversarywould need to complete the following steps: 1) acquire the device from the open market or any untrusted entity in the supply chain, 2) analyze the device to localize the target modules, wires, or registers as pos- sible points-of-interest (POI), 3) Probe those locations and extract the on-device protected assets through different optical attack methodologies. SAMPLE PREPARATION In modern ICs, the number of interconnect layers at the front side of the chip is increasing. Hence, the optical path of photons gets obstructed. An adversary can avoid such obstruction by attacking the chip from the backside of the die. Besides, no protection scheme is available for the backside of ICs, which facilitates attacking the chip from the substrate layer. The chip is placed under the laser scanning microscope (LSM) or photon emission microscope (see Fig. 4). In optical attack approaches, the chip must be in operation. Therefore, the selection of sample preparation method of device under test (DUT) is dependent on the packaging of the chip. In non-flip-chip ICs, also known as wire bond chips, the silicon substrate can be accessed by decapsulating the packaging. Acid etching or selective mechanical polishing are used to expose the die. On the contrary, flip-chip or BGA packaging is widely used for modern advanced packaging. In flip-chip packaging, the silicon substrate is usually coveredwith a heat-sink, easily removed using a lab knife and hotplate. [7] Therefore, the vulnerabilities inpackaging techniques allowdirect access to the assets protected in the circuit. The backside of the sample receives a global polishing to increase the resolu- tion for PEA and LFI. However, in optical probing attacks, no further polishing of the chip is required because the modern optical probing system has the capability to change the depth-of-focus of the microscope depending on the thickness of silicon. Besides, in the case of optical probing, the spatial resolution can be further increased if the adversary has access to a solid immersion lens (SIL). LOCALIZING POINT-OF-INTEREST AND ASSET EXTRACTION Themethod of localizing the POI depends on the avail- ability of layout and capability available for the adversary. An adversary can reverse engineer the device and deter- mine the location of target wires, transistors, or registers Fig. 4 Circuit board placed under the lenses in an LSM.