Direct Charge Measurement in Floating Gate Transistors of Flash EEPROM Using Scanning Electron Microscopy

Abstract

We present a characterization methodology for fast direct measurement of the charge accumulated on Floating Gate (FG) transistors of Flash EEPROM cells. Using a Scanning Electron Microscope (SEM) in Passive Voltage Contrast (PVC) mode we were able to distinguish between '0' and '1' bit values stored in each memory cell. Moreover, it was possible to characterize the remaining charge on the FG; thus making this technique valuable for Failure Analysis applications for data retention measurements in Flash EEPROM. The technique is at least two orders of magnitude faster than state-of-the-art Scanning Probe Microscopy (SPM) methods. Only a relatively simple backside sample preparation is necessary for accessing the FG of memory transistors. The technique presented was successfully implemented on a 0.35 μm technology node microcontroller and a 0.21 μm smart card integrated circuit. We also show the ease of such technique to cover all cells of a memory (using intrinsic features of SEM) and to automate memory cells characterization using standard image processing technique.

Investigation of Data Deletion Vulnerabilities in NAND Flash Memory Based Storage

“…However, no data was recovered after shred delete command. We suspect that data may be recovered successfully by making customized embedded recovery setup and by using invasive microscopy based techniques such as AFM/SCM/SEM etc [14], [15].…”

Advancing hardware security using polymorphic and stochastic spin-hall effect devices

“…Note that three wires are used for the input terminal for all 16 Boolean gates (recall Fig. 3); this renders the layout of the primitive indistinguishable for optical-imaging-based RE, irrespective of the actual functionality.…”

“…III), hence indistinguishable for optical-imaging-based RE. A more sophisticated attacker might, however, leverage electron microscopy (EM) for identification and read-out attacks [16].…”

“…Physical attacks range from non-invasive (e.g., power side-channel attacks) and semi-invasive (e.g., localized faultinjection attacks) to invasive attacks (e.g., RE, microprobing the frontside/backside) [14]. Such attacks are also promising for extracting sensitive data at runtime, even from secured chips, e.g., [15], [16].…”

Is Hardware Security Prepared for Unexpected Discoveries?

“…When the existence of a backdoor in highly secure ICs was discovered [6] in the form of secret test/debug interface capable of overriding chip security policy, it raised a lot of questions about hardware security of modern ICs. Recently demonstrated method for the direct imaging of EEPROM and Flash memory contents using easily accessible Scanning Electron Microscopes (SEM) [7] challenges the security of embedded storage. This is because non-volatile memory was always considered as being highly secure against most invasive attacks due to very small electrical charge accumulated beneath very thin barrier that cannot survive de-processing.…”