We describe a new class of attacks on secure microcontrollers and smartcards. Illumination of a target transistor causes it to conduct, thereby inducing a transient fault. Such attacks are practical; they do not even require expensive laser equipment. We have carried them out using a flashgun bought second-hand from a camera store for $30 and with an $8 laser pointer. As an illustration of the power of this attack, we developed techniques to set or reset any individual bit of SRAM in a microcontroller. Unless suitable countermeasures are taken, optical probing may also be used to induce errors in cryptographic computations or protocols, and to disrupt the processor's control flow. It thus provides a powerful extension of existing glitching and fault analysis techniques. This vulnerability may pose a big problem for the industry, similar to those resulting from probing attacks in the mid-1990s and power analysis attacks in the late 1990s.We have therefore developed a technology to block these attacks. We use self-timed dual-rail circuit design techniques whereby a logical 1 or 0 is not encoded by a high or low voltage on a single line, but by (HL) or (LH) on a pair of lines. The combination (HH) signals an alarm, which will typically reset the processor. Circuits can be designed so that single-transistor failures do not lead to security failure. This technology may also make power analysis attacks very much harder too.

/pdf/optical-fault-induction-attacks-5e0x8zahg3.pdf

Optical Fault Induction Attacks

The effect of faults on electronic systems has been studied since the 1970s when it was noticed that radioactive particles caused errors in chips. This led to further research on the effect of charged particles on silicon, motivated by the aerospace industry who was becoming concerned about the effect of faults in airborn electronic systems. Since then various mechanisms for fault creation and propagation have been discovered and researched. This paper covers the various methods that can be used to induce faults in semiconductors and exploit such errors maliciously. Several examples of attacks stemming from the exploiting of faults are explained. Finally a series of countermeasures to thwart these attacks are described.

/pdf/the-sorcerer-s-apprentice-guide-to-fault-attacks-4wtks20l78.pdf

The Sorcerer's Apprentice Guide to Fault Attacks.

The effect of faults on electronic systems has been studied since the 1970s when it was noticed that radioactive particles caused errors in chips. This led to further research on the effect of charged particles on silicon, motivated by the aerospace industry, which was becoming concerned about the effect of faults in airborne electronic systems. Since then various mechanisms for fault creation and propagation have been discovered and researched. This paper covers the various methods that can be used to induce faults in semiconductors and exploit such errors maliciously. Several examples of attacks stemming from the exploiting of faults are explained. Finally a series of countermeasures to thwart these attacks are described.

The Sorcerer's Apprentice Guide to Fault Attacks

Total ionizing dose radiation effects on the electrical properties of metal-oxide-semiconductor devices and integrated circuits are complex in nature and have changed much during decades of device evolution. These effects are caused by radiation-induced charge buildup in oxide and interfacial regions. This paper presents an overview of these radiation-induced effects, their dependencies, and the many different approaches to their mitigation.

Radiation effects and hardening of MOS technology: devices and circuits

The application of pulsed lasers to the study of Single-Event Effects (SEEs) in integrated circuits and devices is described. The role of a pulsed laser is to provide spatial and temporal information about SEEs, information that is not available when broad-beam ion sources are used. A detailed description is given of the mechanisms involved, including light propagation and absorption by both linear and non-linear processes. Numerous examples highlight the versatility and usefulness of the technique in the study of SEEs.

Pulsed-Laser Testing for Single-Event Effects Investigations

High levels of ionization can be created in semiconductor devices by irradiating the devices with short pulses of light. If the light frequency is properly selected, sufficient and relatively uniform energy deposition is obtained which results in ionization rates orders of magnitude above those presently attainable from other sources. It is shown that a pulsed-infrared laser can be used as a relatively simple, inexpensive, and effective means of simulating the effects caused by intense gamma ray sources on semiconductors. Experimental results are presented which show that the transients induced in various types of silicon transistors when exposed to a neodymium laser are essentially identical to those obtained when the transistors are exposed to pulses of 25 MeV electrons from a linear accelerator and 600 kvp flash X-ray machine. Good agreement exists between the peak photocurrents obtained using these three sources over a dose range of 10-1 to 104 rads. Calculations based upon published as well as experimental absorption data for silicon show that energy deposition is very nearly uniform for the wavelength of light obtained from neodymium lasers (1. 06 microns - 1. 17 ev photons). By defocusing the laser light beam, dose rates in excess of 10R12 rads/ sec (silicon) in 40 x 1-99 seconds over an area of 50 cm2 have been obtained from a Q-switched 10 megawatt neodymium laser. This greatly exceeds the maximum dose rate of 1011< rads/ sec silicon) over approximately 1 c2m attainable from linear accelerators.

The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits

The effects of ionization on MOS devices as a function of time after exposure to a radiation source are functions of the radiation source and device bias time profiles. This paper presents a discussion, supported by a comprehensive series of experiments, of the time dependence of ionization-induced damage to complementary metal oxide semiconductor (CMOS) devices. Two distinct annealing or recovery mechanisms were investigated: (1) room temperature annealing in the absence of radiation, and (2) radiation enhanced room temperature annealing. Experiments were performed using both electron aid ?-ray sources with ionization rates ranging from 103 rads(Si)/sec to greater than 1011 rads(Si)/sec and observation times extending from 1 msec to 105 seconds. The experiments demonstrate that ionization-induced damage to positively biased MOS devices, such as the n-channel devices in CMOS circuits, can be annealed appreciably at room temperature by additional irradiation of the device with zero gate bias. Thus, when operation of CMOS circuitry during or immediately following radiation exposure is of interest, the experimental semipermanent-type radiation damage data typically reported must be carefully evaluated.

Room Temperature Annealing of Ionizatton-Induced Damage in CMOS Circuits

A radiation-hardened silicon gate CMOS two-port standard cell family utilizing a linear array layout topology with six to seven micron design rules and guardbanded n-channel devices has been developed. The process, structure, performance, and applications of this Expanded Linear Array (ELA) technology are described.

/pdf/a-radiation-hard-silicon-gate-bulk-cmos-cell-family-330dfvdj0t.pdf

A Radiation-Hard Silicon Gate Bulk CMOS Cell Family

It has been previously reported that, at relatively modest dose-rates (~109 rad/sec), certain transistor types exhibit an anomalous primary photocurrent response which results in serious departures from the commonly assumed linear dose-rate dependence. This paper presents additional experimental evidence concerning the anomalous photocurrent problem and develops a model which explains the observed data in terms of carrier generation and transport processes within the device. The analysis and supporting experimental evidence shows that the observed phenomenon is the result of base-emitter junction breakdown. This breakdown is induced by transverse photocurrent flow in the active base region and causes the device to assume a common emitter configuration wherein the primary photocurrent is amplified by the device gain.

Anomalous Photocurrent Generation in Transistor Structures

This paper presents the results of a comprehensive modeling and radiation effects study of a p-channel enhancement mode LSI/MOS test chip (TC) specifically designed to allow measurement of discrete device type parameters and responses for circuits constructed from similar devices on a common chip. Particular emphasis was given to the development of accurate models of the individual devices and to the demonstration of the use of these models in predicting the radiation responses of the circuits on the chip. Ionization dose and neutron effects were determined for each of the parameters used in the model which contained the basic Sah equations modified to include channel length modulation effects, the body effect, and the electric-field-dependence of channel mobility. Average values of these parameters were then used in predictions of pre- and post-radiation responses for circuits.

D. H. Habing

Papers

The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits

Room Temperature Annealing of Ionizatton-Induced Damage in CMOS Circuits

A Radiation-Hard Silicon Gate Bulk CMOS Cell Family

Anomalous Photocurrent Generation in Transistor Structures

Modeling and Radiation Effects Study of an LSI/MOS Logic System