Optical Backside Attack with Nanoscale Potential C. Boit TUB Technische Universität Berlin
From backside, all nodes act alike Optical interaction through frontside: each node has individual signature due to interconnect intransparency Access through chip backside: all nodes show same interaction scenario …and compare quantitatively! Read out much more precise Nanoscale Debug & Diagnosis | TU Berlin page 1
From backside, all nodes act alike Backside point of view…. Bulk silicon node of interest Transistors Metallization Layer Passivation Nanoscale Debug & Diagnosis | TU Berlin page 2
Optical Backside Circuit Analysis • Photon Emission Laser CCD • Rise and Fall Events of Digital Signal Pattern Modulation Black Body • Modulation of reflected or Photon light by device operation: Emission Contactless Probing Bulk • Laser Stimulated Si Current or Voltage Sources: Delay / Fault Injection Laser Stimulated Electrical Signal Nanoscale Debug & Diagnosis | TU Berlin page 3
TRE in Ring Oscillator - Demonstrator Coutesy IBM / Richard Ross …impossible with frontside detection Nanoscale Debug & Diagnosis | TU Berlin page 4
Watching the Chip at Work courtesy Richard Ross / IBM …unthinkable with frontside detection Nanoscale Debug & Diagnosis | TU Berlin page 5
Reflectance Modulation Imaging V p GND The reflected light modulation due to: p+ n+ n+ Varying space charge layer – In the pinch off region – In the drain-junction region Varying Charge Density – In the channel region Laser Beam Nanoscale Debug & Diagnosis | TU Berlin page 6 6 / 55
Spectral Absorption in Silicon 10 5 1µm 10 4 Sufficient Concentration of transmission free electrons N [x 10 18 cm -3 ] through Si 10µm 10 3 good for die α (cm -1 ) 40 thickness of 24 T = 300 K 10 2 100µm 6 500µm 10 1 0.32 undoped Soref et al., IEEE J. of Quant. Elec., Vol. QE- 10 0 23, No.1, January 2.0 2.4 2.8 1.2 1.6 0.0 0.4 0.8 1987 Photon Energy (eV) Nanoscale Debug & Diagnosis | TU Berlin 7 – Near Infra Red ( λ≈ 1µm+) ideal for backside access page 7
…numerical aperture Microscope NA = n * sin δ 2 Resolution λ Solid Immersion Lens (SIL) = R 2 NA with Si-SIL: Resolution max 140nm Vendors claim: R ≈ 100-120nm n air =1 n Si = 3.5 …numerical aperture SIL SIL NA = sin δ 2 n SIL n air n silicon Nanoscale Debug & Diagnosis | TU Berlin page 8
What is the required resolution ? Pitch • NIR + Si SIL resolution G ca 100-120nm STI S/D • D&D requires to resolve pitch • Pitch ca 3.5-8x min. feature size Node • NIR good for > 20nm node ITRS: technologies Tech Node Pitch Year 45nm 160nm 2007 � But: there is some tolerance 32nm 112nm 2009 22nm 90nm 2011 14nm 70nm 2013 Nanoscale Debug & Diagnosis | TU Berlin page 9
Discussion of required resolution by Intel @ ISTFA 2015 NIR is good for… Diffraction-limited resolution δ : Correlation F (1500)= 5.81 3,91 4,36 4,32 factor F = 2017!!! F(1064)= 4.12 2,77 3.08 3,07 Resol. / Pitch Nanoscale Debug & Diagnosis | TU Berlin page 10 Table from v. Haartman et al, Proc. 41st ISTFA 2015, Nov. 1-5, Portland OR, pp 47-51
FinFET age – what is required? • NIR + Si SIL resolution ca 100-120nm • D & D requires to resolve pitch • Good for > 20nm node technologies ITRS 2013: • For FinFETs, min 2x Tech Node Pitch Year improvement necessary 16nm 80nm 2013 10nm 64nm 2015 7nm 50nm 2017 5nm 40nm 2019 3.5nm 32nm 2021 2.5nm 26nm 2023 1.8nm 20nm 2025 Nanoscale Debug & Diagnosis | TU Berlin page 11 Image: https://www.synopsys.com/Company/Publications/DWTB/PublishingImages/dwtb-finfet-jan2013-fig2.JPG
Abbe Criterion Back to bulk Si – optical access with higher resolution? R = λ /(2NA) NA = n x sin α λ : Light wavelength (NIR: ≈ 1µm) NA: Numerical aperture n: Index of refraction (Air = 1, Si = 3.5) sin α : Aperture of Objective (<1) Objective State of the art with Si-SIL: R ≈ 100-120nm SIL ..only one solution: reduction of λ Sample Nanoscale Debug & Diagnosis | TU Berlin page 12
Optical D&D Techniques using visible light What’s a good concept to start with? Absorption depth in Silicon (AD) • EOFM / LVP seems to be technique to aim at (low power technologies) • Lasers ~ 650nm available 1mm — • Absorption depth (AD) 1µm — ( = 1 / abs. coefficient ) key for device prep 1nm — • Prep to ca 10µm thickness within reach Nanoscale Debug & Diagnosis | TU Berlin http://pveducation.org/pvcdrom/materials/optical-properties-of-silicon page 13
Material for SIL in visible regime - Bandgap λ = 650nm E = 1.9 eV Lattice Constant [Angstrom] Nanoscale Debug & Diagnosis | TU Berlin page 14 http://www.tf.uni-kiel.de/matwis/amat/semitech_en/kap_2/backbone/r2_3_1.html
Material for SIL in visible regime Requirement: - transparent to λ = 650nm - n as close as possible to n Si (NIR) = 3.5 Objective • GaP identified for a while as good candidate • transparent to λ ≈ 550nm SIL • n GaP (650nm) ≈ 3.3 Nanoscale Debug & Diagnosis | TU Berlin page 15
No SIL SIL Nanoscale Debug & Diagnosis | TU Berlin page 16
VIS LVP – Average 100k Nanoscale Debug & Diagnosis | TU Berlin page 17
Backside Protection ? x LED PD d – Connection α α 380µm from L L electrically active layers to backside far too expensive – Optical interaction ? Nanoscale Debug & Diagnosis | TU Berlin page 18
Conclusion • Optical interaction for IC Signal Tracking Very Promising Even in FinFET Age • Contactless Probing Still Almost Untouched Opportunity in Attack World • Backside Protection Necessary – Progress into More Miniaturization Is No Valid Protection Concept • But: Optical Interaction Not Only Good for Attacks - May Make a Good Protection As Well Nanoscale Debug & Diagnosis | TU Berlin page 19
Recommend
More recommend
