Assessment of a Chip Backside Protection

Amini, Elham; Beyreuther, Anne; Herfurth, Norbert; Steigert, Alexander; Szyszka, Bernd; Boit, Christian

doi:10.1007/s41635-018-0052-3

Cited by 26 publications

(4 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, a solely passive layer could be easily removed by polishing. As evaluated in [14], the integrity of the coating layer can be assured by in-silicon light emitters and sensors. This combines an obstruction approach (first category) with an active detection countermeasure (second category).…”

Section: Discussionmentioning

confidence: 99%

Evaluation of Low-Cost Thermal Laser Stimulation for Data Extraction and Key Readout

et al. 2019

View full text Add to dashboard Cite

Recent attacks using thermal laser stimulation (TLS) have shown that it is possible to extract cryptographic keys from the battery-backed memory on state-of-the-art fieldprogrammable gate arrays (FPGAs). However, the professional failure analysis microscopes usually employed for these attacks cost in the order of 500k to 1M dollars. In this work, we evaluate the use of a cheaper commercial laser fault injection station retrofitted with a suitable amplifier and light source to enable TLS. We demonstrate that TLS attacks are possible at a hardware cost of around 100k dollars. This constitutes a reduction of the resources required by the attacker by a factor of at least five. We showcase two actual attacks: data extraction from the SRAM memory of a low-power microcontroller and decryption key extraction from a 20 nm technology FPGA device. The strengths and weaknesses of our low-cost approach are then discussed in comparison to the conventional failure analysis equipment approach. In general, this work demonstrates that TLS backside attacks are available at a much lower cost than previously expected.

show abstract

Section: Discussionmentioning

confidence: 99%

Evaluation of Low-Cost Thermal Laser Stimulation for Data Extraction and Key Readout

et al. 2019

View full text Add to dashboard Cite

show abstract

“…The foremost requirement for our attack approach to succeed is access through the chip's backside. Active backside coatings [56] can prevent the optical access to the chip's silicon by adding an opaque coating layer. By actively checking the intactness of the coating, attempts to remove it can be detected.…”

Section: Potential Countermeasuresmentioning

confidence: 99%

Automatic Extraction of Secrets from the Transistor Jungle using Laser-Assisted Side-Channel Attacks

Krachenfels,

Kiyan,

Tajik

et al. 2021

Preprint

View full text Add to dashboard Cite

The security of modern electronic devices relies on secret keys stored on secure hardware modules as the root-of-trust (RoT). Extracting those keys would break the security of the entire system. As shown before, sophisticated side-channel analysis (SCA) attacks, using chip failure analysis (FA) techniques, can extract data from on-chip memory cells. However, since the chip's layout is unknown to the adversary in practice, secret key localization and reverse engineering are onerous tasks. Consequently, hardware vendors commonly believe that the ever-growing physical complexity of the integrated circuit (IC) designs can be a natural barrier against potential adversaries. In this work, we present a novel approach that can extract the secret key without any knowledge of the IC's layout, and independent from the employed memory technology as key storage. We automate the -traditionally very laborintensive -reverse engineering and data extraction process.To that end, we demonstrate that black-box measurements captured using laser-assisted SCA techniques from a training device with known key can be used to profile the device for a later key prediction on other victim devices with unknown keys. To showcase the potential of our approach, we target keys on three different hardware platforms, which are utilized as RoT in different products.

show abstract

“…Adding an active opaque layer can be another countermeasure against optical probing. Implementing an active monitoring scheme is required to detect the removal of such opaque layer by an adversary [78]. Since the optical beam stimulates the silicon active regions thermally, conventional photosensors fail to trigger during optical probing.…”

Section: Defense Against Contactless Probingmentioning

confidence: 99%

Defense-in-depth: A recipe for logic locking to prevail

Rahman

Wang

et al. 2020

Integration

View full text Add to dashboard Cite

Logic locking has emerged as a promising solution for protecting the semiconductor intellectual Property (IP) from the untrusted entities in the design and fabrication process. Logic locking hides the functionality of the IP by embedding additional key-gates in the circuit. The correct output of the chip is produced, once the correct key value is available at the input of the key-gates. The confidentiality of the key is imperative for the security of the locked IP as it stands as the lone barrier against IP infringement. Therefore, the logic locking is considered as a broken scheme once the key value is exposed. The research community has shown the vulnerability of the logic locking techniques against different classes of attacks, such as Oracle-guided and physical attacks. Although several countermeasures have already been proposed against such attacks, none of them is simultaneously impeccable against Oracle-guided, Oracle-less, and physical attacks. Under such circumstances, a defense-in-depth approach can be considered as a practical approach in addressing the vulnerabilities of logic locking. Defense-in-depth is a multilayer defense approach where several independent countermeasures are implemented in the device to provide aggregated protection against different attack vectors. Introducing such a multilayer defense model in logic locking is the major contribution of this paper. With regard to this, we first identify the core components of logic locking schemes, which need to be protected. Afterwards, we categorize the vulnerabilities of core components according to potential threats for the locking key in logic locking schemes. Furthermore, we propose several defense layers and countermeasures to protect the device from those vulnerabilities. Finally, we turn our focus to open research questions and conclude with suggestions for future research directions.

show abstract

Assessment of a Chip Backside Protection

Cited by 26 publications

References 7 publications

Evaluation of Low-Cost Thermal Laser Stimulation for Data Extraction and Key Readout

Evaluation of Low-Cost Thermal Laser Stimulation for Data Extraction and Key Readout

Automatic Extraction of Secrets from the Transistor Jungle using Laser-Assisted Side-Channel Attacks

Defense-in-depth: A recipe for logic locking to prevail

Contact Info

Product

Resources

About