exp. comparison and analysis of the sensitivity to laser fault...

Exp. comparison and analysis of the sensitivity to laser fault injection of CMOS FD-SOI and

CMOS bulk technologies

IOLTS 2018 24th IEEE International On-Line Testing Symposium

J.M. Dutertre1, V. Beroulle2, P. Candelier3, L.B. Faber3, M.L. Flottes4, P. Gendrier3, D. Hély2, R. Leveugle5, P. Maistri5, G. Di Natale4, A. Papadimitriou2, B. Rouzeyre4

Wednesday, July 4th 2018 Platja D’Aro, Costa Brava, Spain

(1) (2) (3) (4) (5)

Laser Fault Injection CMOS bulk vs FD-SOI

!  Who’s interested in laser fault injection?

"  Radiation effects community since 1967 !  ICs for spatial & aircraft applications

!  Single Event Effects (SEEs) induced by ionizing particles

!  Pulsed laser (ps range) used for SEE emulation

!  Various countermeasures: techno. & process? (small market)

CMOS Silicon On Insulator (SOI) less sensitive to SEEs

The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits, D. Habing, 1967

2

!  Who’s interested in laser fault injection?

"  Hardware Security community !  Concept of fault injection: 1997 D. Boneh et al.

!  Laser fault injection: 2002 S. Skorobogatov et al.

On the Importance of Checking Cryptographic Protocols for Faults, Dan Boneh et al, 1997 Optical Fault Induction Attacks, S. Skorobogatov et al, 2002


!  Technological countermeasure?

!  SOI to mitigate laser fault injection

!  Dev. of a dedicated process is expensive

3


"  UTBB FD-SOI (Ultra-Thin Body and Box Fully-Depleted SOI)

!  is now a mature technology (ST Micro, Samsung, GlobalFoundries)

!  Ultra Low Power application (low static leakage, body biasing)

!  Laser-induced faults/SEEs mitigation properties?

Topic of this talk: FD-SOI laser fault injection mitigation properties, and comparison with CMOS bulk, on experimental basis at the 28 nm tech. node

4

Outline

I. Introduction II. Theory of laser fault injection

V. Conclusion

III. State of the art

5

IV. Laser sensitivity assessment of FD-SOI and CMOS bulk

Outline


V. Conclusion


6


!  Mechanism, photoelectric effect

!  LFI sensitivity of CMOS bulk

!  LFI sensitivity of CMOS FD-SOI

Current (mA)

Current peak

Drift current

Time (ns) 0.2 0.4 0.6 0.8 1.0

Imax

Theory of laser fault injection

!  Photoelectric effect: transient current generation

Drain ( Gnd )

N+ diffusion

Laser

- + + +

+ + + + +

- +

- - -

- -

-

Depletion region E

Drain ( VDD )

P substrate (Gnd)

Transient current

Laser sensitive areas: reverse biased PN junctions 7

laser beam

P substrate

N well

P+

Cout ‘1’

to Vdd

P+ N+ N+ N+ P+

to Gnd

in ‘0’

NMOS PMOS

Metal 1 MOS gate

=> ‘0’

•  transient current # voltage transient (SET, single event transient)

OFF ON

!  Fault injection mechanism: CMOS bulk inverter


Voltage transient # fault (prop. into DFF, or memory flip) 8

pmos

B (gnd)

nmos

N+N+P+

G

DS

Nwell

P+P+ N+

D

G

S B (Vdd)

P−substrate

PN junctions = laser sensitive ares of CMOS devices: 3 types (1), (2), (3)

(1)

(3)

(2)

9


!  LFI sensitivity of CMOS bulk

(a) (b)

(c)

Parasitic bipolar transistors: 3 types (a), (b), (c)

NwellPwell

P+

P−substrate

P+ type Si

box

P+ P+

box

N+ N+

N+P+

Insulator (STI or box or gate oxide)N+ type Si

P type Si P−substrate gate

G

S D D S

G

rvt nmos rvt pmos

B (gnd) B (Vdd)gnd

N type Si

STI STI STI STISTI

NMOS

‘Regular Vt’ transistors

10


!  CMOS FD-SOI structure

NwellPwell

P+

P−substrate

P+ type Si

box

P+ P+

box

N+ N+

N+P+



G

S D D S

G

rvt nmos rvt pmos

B (gnd) B (Vdd)gnd

N type Si

STI STI STI STISTI

NMOS

Isolation box (thickness < 30nm)

Channel: intrinsic Si (thickness < 10 nm)

Reduced charge collection volume

Reduced laser sensitivity?

11




NwellPwell

P+

P−substrate

P+ type Si

box

P+ P+

box

N+ N+

N+P+



G

S D D S

G

rvt nmos rvt pmos

B (gnd) B (Vdd)gnd

N type Si

STI STI STI STISTI

Laser sensitive PN junctions: 1 type (1)

(1)

12




DrainN+

SV = 0 FGV = 0DV > 0

BGV = 0

Laser induced charge carriers

holes (h )+

Source

BOX

Pwell

Gate oxide

ChannelN+

−−

+

−electrons (e )

collector e

base h

emitter e

Parasitic bipolar NPN transistor


!  Laser sensitivity of FD-SOI

DrainN+

SV = 0 FGV = 0DV > 0

BGV = 0


holes (h )+

Source

BOX

Pwell

Gate oxide

ChannelN+

−−

+

−electrons (e )

collector e

base h

emitter e


holes: h+ electrons: e-

13

DrainN+

SV = 0 FGV = 0DV > 0

BGV = 0


holes (h )+

Source

BOX

Pwell

Gate oxide

ChannelN+

−−

+

−electrons (e )

collector e

base h

emitter e

Parasitic bipolar NPN transistor


!  Laser sensitivity of FD-SOI

amplification effect on the laser-induced current 14


!  Laser sensitivity of FD-SOI vs CMOS bulk

Radiation hardness of FDSOI and FinFET technologies, M.L. Alles et al, 2011

Advantages of FD-SOI (rule of thumbs):

•  isolation box under transistors x10 (factor in lower sensitivity)

•  smaller sensitive area x2 (factor in lower sensitivity)

# less charge sharing between transistors.

Parasitic bipolar amplification effect on the laser-induced current:

#  there are still faults

#  x10 and x2 may not be fullfilled

15

Outline


V. Conclusion


16


!  Radiation focused State-of-the-art

!  Security focused State-of-the-art

State-of-the-art

"  Radiation focused state-of-the-art

!  Neutrons, heavy ions, laser

!  Laser for SEE emulation: 1 µm diameter, ps range

!  SOI or FD-SOI, 0.2 µm to 28 nm

!  Mainly on elementary test patterns

1-2 orders of magnitude in favor of SOI/FD-SOI

17

State-of-the-art

"  Security focused state-of-the-art

!  CMOS bulk vs CMOS FD-SOI at 28 nm

!  Elementary test patterns: wells or transistors

!  Laser settings: 1,064 nm, 1-5 µm diameter, ns & µs ranges

1 order of magnitude in terms of peak current

FD-SOI: smaller extension of sensitive areas

18

Outline


V. Conclusion


19


!  Experimental setup

!  Radiation-centric experimental results

!  Attack-centric experimental results

Laser sensitivity of FD-SOI vs CMOS bulk

"  Experimental setup

20

"  Experimental setup

•  Backside injection

•  Pulse width: 30 ps –  up to 100 nJ

•  Wavelength: 1,030 nm

•  Pulse width: ns –  5-50 ns, max. power 1 W –  50 ns – 1 s, max. power 3 W

•  Wavelength: 1,064 nm

•  Spot size: 1µm or 5 µm


21

"  Test chips CMOS 28 nm !  Target: AES implementation (with parity-based CM) Vdd = 1.2 V

•  IR microphotography (rear side), obj. x20

CMOS bulk CMOS FD-SOI Thickness ~ 100 µm Thickness ~ 100 µm

22


x y

Laser head


"  Experiments description

Laser fault injection threshold + 2,000 injections attempts per test

Full functional IP running at 100 MHz 23

"  Radiation-centric experimental results !  Laser parameters: 30 ps, 1 µm laser spot diameter


Laser fault injection threshold CMOS bulk CMOS FD-SOI

[W] [mW/µm2] [W] [mW/µm2] Laser: 30 ps / 1 µm 0.2 nJ 16.9 pJ/µm2 0.6 nJ 50.6 pJ/µm2

x3

24

"  Radiation-centric experimental results !  Laser parameters: 30 ps, 1 µm laser spot diameter

30 ps, 5 µm laser spot diameter




Laser: 30 ps / 5 µm 0.3 nJ 2.2 pJ/µm2 2.1 nJ 15.4 pJ/µm2

x7

•  FD-SOI vs bulk: x3 factor sensitivity decrease disappointing at 1 µm,

•  FD-SOI vs bulk: x7 factor at 5 µm close to state-of-the-art.

25

"  Attack-centric experimental results !  Laser parameters: 10 ns, 1 µm laser spot diameter



[W] [mW/µm2] [W] [mW/µm2] Laser: 10 ns / 1 µm 0.45 38 0.8 67.5

26

"  Attack-centric experimental results !  Laser parameters: 10 ns, 1 µm laser spot diameter

10 ns, 5 µm laser spot diameter



[W] [mW/µm2] [W] [mW/µm2] Laser: 10 ns / 1 µm 0.45 38 0.8 67.5 Laser: 10 ns / 5 µm 0.6 4.4 - -

No fault (1W limit)

27

"  Attack-centric experimental results !  Laser parameters: 10 ns, 1 µm -10 ns, 5 µm

50 ns, 5 µm laser spot diameter



[W] [mW/µm2] [W] [mW/µm2] Laser: 10 ns / 1 µm 0.45 38 0.8 67.5 Laser: 10 ns / 5 µm 0.6 4.4 - - Laser: 50 ns / 5 µm 0.3 2.2 2.2 16

x7

28

Outline


V. Conclusion


29


"  Analysis

Conclusion



Laser: 30 ps / 5 µm 0.3 nJ 2.2 pJ/µm2 2.1 nJ 15.4 pJ/µm2

Laser: 10 ns / 1 µm 0.45 38 0.8 67.5 Laser: 10 ns / 5 µm 0.6 4.4 - - Laser: 50 ns / 5 µm 0.3 2.2 2.2 16

Advantage of CMOS FD-SOI over CMOS bulk: •  1-2 order of magnitude of the SotA not fulfilled,

•  At 1 µm spot diameter: a factor 2-3

•  At 5 µm spot diameter: a factor 7 30

"  Analysis

Conclusion

NwellPwell

P+

P−substrate

P+ type Si

box

P+ P+

box

N+ N+

N+P+



G

S D D S

G

rvt nmos rvt pmos

B (gnd) B (Vdd)gnd

N type Si

STI STI STI STISTI

(1)

!  FD-SOI vulnerability?

Laser sensitive PN junctions: (1)

Laser-induced Vdd drop?

31

"  Analysis

Conclusion

!  Interest of a 2-3 lower laser sensitivity? •  Intrinsic to FD-SOI,

•  Equivalent to a similar increase in laser sensors efficiency, eg BBICS:

32

Work funded by the ANR: LIESSE project

Thank you for your attention

[email protected]

J.M. Dutertre1, V. Beroulle2, P. Candelier3, L.B. Faber3, M.L. Flottes4, P. Gendrier3, D. Hély2, R. Leveugle5, P. Maistri5, G. Di Natale4, A. Papadimitriou2, B. Rouzeyre4

(1) (2) (3) (4) (5)

exp. comparison and analysis of the sensitivity to laser fault...

Documents