International audienceThe use of a laser to inject faults into SRAM memory cells is well known. However, the corresponding fault model is often unknown or misunderstood: the induced faults may be described as bit-flip or bit-set/reset faults. We have investigated in this paper whether the bit-set/reset fault model or bit-flip fault model may be encountered in SRAMs. First, the fault model of a standalone SRAM was considered. Experiments revealed that the relevant fault model was the bit-set/reset. This result was further investigated through electrical simulations based on the use of an electrical model of MOS transistors under laser illumination. Then, fault injections have been performed on the RAM memory of a micro-controller to check the validity of the previous results based on experiments and simulations

International audienceThis paper presents measurements of pulsed photoelectrical laser stimulation of an NMOS transistor in 90nm technology. The laser power was able to trig the NPN parasitic bipolar Drain/Psubstrate/Source. An electrical model is proposed in order to simulate effects induced by the laser. Results extracted from the electrical simulator are compared to measurements

International audienceThis abstract presents an electrical model of an SRAM cell exposed to a pulsed Photoelectrical Laser Stimulation (PLS), based on our past model of MOS transistor under laser illumination. The validity of our model is assessed by the very good correlation obtained between measurements and electrical simulation. These simulations are capable to explain some specific points. For example, in theory, a SRAM cell under PLS have four sensitive areas. But in measurements only three areas were revealed. A hypothesis was presented in this paper and confirm by electrical simulation. The specific topology of the cell masks one sensitive area. Therefore the electrical model could be used as a tool of characterization of a CMOS circuits under PLS

International audienceBulk Built-In Current Sensors (bbicss) were introduced to detect the anomalous transient currents induced in the bulk of integrated circuits when hit by ionizing particles. To date, the experimental testing of only one bbics architecture was reported in the scientific bibliography. It reports an unexpected weakness in its ability to monitor nmos transistors. Based on experimental measures, we propose an explanation of this weakness and also the use of triple-well cmos to offset it. Further, we introduce a new bbics architecture well suited for triple-well that offers high detection sensitivity and low area overhead

Abstract-Laser fault injection into SRAM cells is a widely used technique to perform fault attacks. In previous works, Roscian and Sarafianos studied the relations between the layout of the cell, its different laser-sensitive areas and their associated fault model using 50 ns duration laser pulses. In this paper, we report similar experiments carried out using shorter laser pulses (30 ps duration instead of 50 ns). Laser-sensitive areas that did not appear at 50 ns were observed. Additionally, these experiments confirmed the validity of the bit-set/bit-reset fault model over the bit-flip one. We also propose an upgrade of the simulation model they used to take into account laser pulses in the picosecond range. Finally, we performed additional laser fault injection experiments on the RAM memory of a microcontroller to validate the previous results.