exp. comparison and analysis of the sensitivity to laser fault...

Exp. comparison and analysis of the sensitivity to laser fault injection of CMOS FD-SOI and

CMOS bulk technologies

IOLTS 2018 24th IEEE International On-Line Testing Symposium

J.M. Dutertre1, V. Beroulle2, P. Candelier3, L.B. Faber3, M.L. Flottes4, P. Gendrier3, D. Hély2, R. Leveugle5, P. Maistri5, G. Di Natale4, A. Papadimitriou2, B. Rouzeyre4

Wednesday, July 4th 2018 Platja D’Aro, Costa Brava, Spain

(1) (2) (3) (4) (5)

Laser Fault Injection CMOS bulk vs FD-SOI

!  Who’s interested in laser fault injection?

"  Radiation effects community since 1967 !  ICs for spatial & aircraft applications

!  Single Event Effects (SEEs) induced by ionizing particles

!  Pulsed laser (ps range) used for SEE emulation

!  Various countermeasures: techno. & process? (small market)

CMOS Silicon On Insulator (SOI) less sensitive to SEEs

The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits, D. Habing, 1967

2

!  Who’s interested in laser fault injection?

"  Hardware Security community !  Concept of fault injection: 1997 D. Boneh et al.

!  Laser fault injection: 2002 S. Skorobogatov et al.

On the Importance of Checking Cryptographic Protocols for Faults, Dan Boneh et al, 1997 Optical Fault Induction Attacks, S. Skorobogatov et al, 2002

Laser Fault Injection CMOS bulk vs FD-SOI

!  Technological countermeasure?

!  SOI to mitigate laser fault injection

!  Dev. of a dedicated process is expensive

3

Laser Fault Injection CMOS bulk vs FD-SOI

"  UTBB FD-SOI (Ultra-Thin Body and Box Fully-Depleted SOI)

!  is now a mature technology (ST Micro, Samsung, GlobalFoundries)

!  Ultra Low Power application (low static leakage, body biasing)

!  Laser-induced faults/SEEs mitigation properties?

Topic of this talk: FD-SOI laser fault injection mitigation properties, and comparison with CMOS bulk, on experimental basis at the 28 nm tech. node

4

Outline

I. Introduction II. Theory of laser fault injection

V. Conclusion

III. State of the art

5

IV. Laser sensitivity assessment of FD-SOI and CMOS bulk

Outline

I. Introduction II. Theory of laser fault injection

V. Conclusion

III. State of the art

6

IV. Laser sensitivity assessment of FD-SOI and CMOS bulk

!  Mechanism, photoelectric effect

!  LFI sensitivity of CMOS bulk

!  LFI sensitivity of CMOS FD-SOI

Current (mA)

Current peak

Drift current

Time (ns) 0.2 0.4 0.6 0.8 1.0

Imax

Theory of laser fault injection

!  Photoelectric effect: transient current generation

Drain ( Gnd )

N+ diffusion

Laser

- + + +

+ + + + +

- +

- - -

- -

-

Depletion region E

Drain ( VDD )

P substrate (Gnd)

Transient current

Laser sensitive areas: reverse biased PN junctions 7

laser beam

P substrate

N well

P+

Cout ‘1’

to Vdd

P+ N+ N+ N+ P+

to Gnd

in ‘0’

NMOS PMOS

Metal 1 MOS gate

=> ‘0’

•  transient current # voltage transient (SET, single event transient)

OFF ON

!  Fault injection mechanism: CMOS bulk inverter

Theory of laser fault injection

Voltage transient # fault (prop. into DFF, or memory flip) 8

pmos

B (gnd)

nmos

N+N+P+

G

DS

Nwell

P+P+ N+

D

G

S B (Vdd)

P−substrate

PN junctions = laser sensitive ares of CMOS devices: 3 types (1), (2), (3)

(1)

(3)

(2)

9

Theory of laser fault injection

!  LFI sensitivity of CMOS bulk

(a) (b)

(c)

Parasitic bipolar transistors: 3 types (a), (b), (c)

NwellPwell

P+

P−substrate

P+ type Si

box

P+ P+

box

N+ N+

N+P+

Insulator (STI or box or gate oxide)N+ type Si

P type Si P−substrate gate

G

S D D S

G

rvt nmos rvt pmos

B (gnd) B (Vdd)gnd

N type Si

STI STI STI STISTI

NMOS

‘Regular Vt’ transistors

10

Theory of laser fault injection

!  CMOS FD-SOI structure

NwellPwell

P+

P−substrate

P+ type Si

box

P+ P+

box

N+ N+

N+P+

Insulator (STI or box or gate oxide)N+ type Si

P type Si P−substrate gate

G

S D D S

G

rvt nmos rvt pmos

B (gnd) B (Vdd)gnd

N type Si

STI STI STI STISTI

NMOS

Isolation box (thickness < 30nm)

Channel: intrinsic Si (thickness < 10 nm)

Reduced charge collection volume

Reduced laser sensitivity?

11

‘Regular Vt’ transistors

Theory of laser fault injection

!  CMOS FD-SOI structure

NwellPwell

P+

P−substrate

P+ type Si

box

P+ P+

box

N+ N+

N+P+

Insulator (STI or box or gate oxide)N+ type Si

P type Si P−substrate gate

G

S D D S

G

rvt nmos rvt pmos

B (gnd) B (Vdd)gnd

N type Si

STI STI STI STISTI

Laser sensitive PN junctions: 1 type (1)

(1)

12

‘Regular Vt’ transistors

Theory of laser fault injection

!  CMOS FD-SOI structure

DrainN+

SV = 0 FGV = 0DV > 0

BGV = 0

Laser induced charge carriers

holes (h )+

Source

BOX

Pwell

Gate oxide

ChannelN+

−−

+

−electrons (e )

collector e

base h

emitter e

Parasitic bipolar NPN transistor

Theory of laser fault injection

!  Laser sensitivity of FD-SOI

DrainN+

SV = 0 FGV = 0DV > 0

BGV = 0

Laser induced charge carriers

holes (h )+

Source

BOX

Pwell

Gate oxide

ChannelN+

−−

+

−electrons (e )

collector e

base h

emitter e

Laser induced charge carriers

holes: h+ electrons: e-

13

DrainN+

SV = 0 FGV = 0DV > 0

BGV = 0

Laser induced charge carriers

holes (h )+

Source

BOX

Pwell

Gate oxide

ChannelN+

−−

+

−electrons (e )

collector e

base h

emitter e

Parasitic bipolar NPN transistor

Theory of laser fault injection

!  Laser sensitivity of FD-SOI

amplification effect on the laser-induced current 14

Theory of laser fault injection

!  Laser sensitivity of FD-SOI vs CMOS bulk

Radiation hardness of FDSOI and FinFET technologies, M.L. Alles et al, 2011

Advantages of FD-SOI (rule of thumbs):

•  isolation box under transistors x10 (factor in lower sensitivity)

•  smaller sensitive area x2 (factor in lower sensitivity)

# less charge sharing between transistors.

Parasitic bipolar amplification effect on the laser-induced current:

#  there are still faults

#  x10 and x2 may not be fullfilled

15

Outline

I. Introduction II. Theory of laser fault injection

V. Conclusion

III. State of the art

16

IV. Laser sensitivity assessment of FD-SOI and CMOS bulk

!  Radiation focused State-of-the-art

!  Security focused State-of-the-art

State-of-the-art

"  Radiation focused state-of-the-art

!  Neutrons, heavy ions, laser

!  Laser for SEE emulation: 1 µm diameter, ps range

!  SOI or FD-SOI, 0.2 µm to 28 nm

!  Mainly on elementary test patterns

1-2 orders of magnitude in favor of SOI/FD-SOI

17

State-of-the-art

"  Security focused state-of-the-art

!  CMOS bulk vs CMOS FD-SOI at 28 nm

!  Elementary test patterns: wells or transistors

!  Laser settings: 1,064 nm, 1-5 µm diameter, ns & µs ranges

1 order of magnitude in terms of peak current

FD-SOI: smaller extension of sensitive areas

18

Outline

I. Introduction II. Theory of laser fault injection

V. Conclusion

III. State of the art

19

IV. Laser sensitivity assessment of FD-SOI and CMOS bulk

!  Experimental setup

!  Radiation-centric experimental results

!  Attack-centric experimental results

Laser sensitivity of FD-SOI vs CMOS bulk

"  Experimental setup

20

"  Experimental setup

•  Backside injection

•  Pulse width: 30 ps –  up to 100 nJ

•  Wavelength: 1,030 nm

•  Pulse width: ns –  5-50 ns, max. power 1 W –  50 ns – 1 s, max. power 3 W

•  Wavelength: 1,064 nm

•  Spot size: 1µm or 5 µm

Laser sensitivity of FD-SOI vs CMOS bulk

21

"  Test chips CMOS 28 nm !  Target: AES implementation (with parity-based CM) Vdd = 1.2 V

•  IR microphotography (rear side), obj. x20

CMOS bulk CMOS FD-SOI Thickness ~ 100 µm Thickness ~ 100 µm

22

Laser sensitivity of FD-SOI vs CMOS bulk

x y

Laser head

Laser sensitivity of FD-SOI vs CMOS bulk

"  Experiments description

Laser fault injection threshold + 2,000 injections attempts per test

Full functional IP running at 100 MHz 23

"  Radiation-centric experimental results !  Laser parameters: 30 ps, 1 µm laser spot diameter

Laser sensitivity of FD-SOI vs CMOS bulk

Laser fault injection threshold CMOS bulk CMOS FD-SOI

[W] [mW/µm2] [W] [mW/µm2] Laser: 30 ps / 1 µm 0.2 nJ 16.9 pJ/µm2 0.6 nJ 50.6 pJ/µm2

x3

24

"  Radiation-centric experimental results !  Laser parameters: 30 ps, 1 µm laser spot diameter

30 ps, 5 µm laser spot diameter

Laser sensitivity of FD-SOI vs CMOS bulk

Laser fault injection threshold CMOS bulk CMOS FD-SOI

[W] [mW/µm2] [W] [mW/µm2] Laser: 30 ps / 1 µm 0.2 nJ 16.9 pJ/µm2 0.6 nJ 50.6 pJ/µm2

Laser: 30 ps / 5 µm 0.3 nJ 2.2 pJ/µm2 2.1 nJ 15.4 pJ/µm2

x7

•  FD-SOI vs bulk: x3 factor sensitivity decrease disappointing at 1 µm,

•  FD-SOI vs bulk: x7 factor at 5 µm close to state-of-the-art.

25

"  Attack-centric experimental results !  Laser parameters: 10 ns, 1 µm laser spot diameter

Laser sensitivity of FD-SOI vs CMOS bulk

Laser fault injection threshold CMOS bulk CMOS FD-SOI

[W] [mW/µm2] [W] [mW/µm2] Laser: 10 ns / 1 µm 0.45 38 0.8 67.5

26

"  Attack-centric experimental results !  Laser parameters: 10 ns, 1 µm laser spot diameter

10 ns, 5 µm laser spot diameter

Laser sensitivity of FD-SOI vs CMOS bulk

Laser fault injection threshold CMOS bulk CMOS FD-SOI

[W] [mW/µm2] [W] [mW/µm2] Laser: 10 ns / 1 µm 0.45 38 0.8 67.5 Laser: 10 ns / 5 µm 0.6 4.4 - -

No fault (1W limit)

27

"  Attack-centric experimental results !  Laser parameters: 10 ns, 1 µm -10 ns, 5 µm

50 ns, 5 µm laser spot diameter

Laser sensitivity of FD-SOI vs CMOS bulk

Laser fault injection threshold CMOS bulk CMOS FD-SOI

[W] [mW/µm2] [W] [mW/µm2] Laser: 10 ns / 1 µm 0.45 38 0.8 67.5 Laser: 10 ns / 5 µm 0.6 4.4 - - Laser: 50 ns / 5 µm 0.3 2.2 2.2 16

x7

28

Outline

I. Introduction II. Theory of laser fault injection

V. Conclusion

III. State of the art

29

IV. Laser sensitivity assessment of FD-SOI and CMOS bulk

"  Analysis

Conclusion

Laser fault injection threshold CMOS bulk CMOS FD-SOI

[W] [mW/µm2] [W] [mW/µm2] Laser: 30 ps / 1 µm 0.2 nJ 16.9 pJ/µm2 0.6 nJ 50.6 pJ/µm2

Laser: 30 ps / 5 µm 0.3 nJ 2.2 pJ/µm2 2.1 nJ 15.4 pJ/µm2

Laser: 10 ns / 1 µm 0.45 38 0.8 67.5 Laser: 10 ns / 5 µm 0.6 4.4 - - Laser: 50 ns / 5 µm 0.3 2.2 2.2 16

Advantage of CMOS FD-SOI over CMOS bulk: •  1-2 order of magnitude of the SotA not fulfilled,

•  At 1 µm spot diameter: a factor 2-3

•  At 5 µm spot diameter: a factor 7 30

"  Analysis

Conclusion

NwellPwell

P+

P−substrate

P+ type Si

box

P+ P+

box

N+ N+

N+P+

Insulator (STI or box or gate oxide)N+ type Si

P type Si P−substrate gate

G

S D D S

G

rvt nmos rvt pmos

B (gnd) B (Vdd)gnd

N type Si

STI STI STI STISTI

(1)

!  FD-SOI vulnerability?

Laser sensitive PN junctions: (1)

Laser-induced Vdd drop?

31

"  Analysis

Conclusion

!  Interest of a 2-3 lower laser sensitivity? •  Intrinsic to FD-SOI,

•  Equivalent to a similar increase in laser sensors efficiency, eg BBICS:

32

Work funded by the ANR: LIESSE project

Thank you for your attention

dutertre@emse.fr

J.M. Dutertre1, V. Beroulle2, P. Candelier3, L.B. Faber3, M.L. Flottes4, P. Gendrier3, D. Hély2, R. Leveugle5, P. Maistri5, G. Di Natale4, A. Papadimitriou2, B. Rouzeyre4

(1) (2) (3) (4) (5)