Simulation and Experimental Demonstration of the Importance of IR-Drops During Laser Fault Injection

Abstract

Laser fault injections induce transient faults into ICs by locally generating transient currents that temporarily flip the outputs of the illuminated gates. Laser fault injection can be anticipated or studied by using simulation tools at different abstraction levels: physical, electrical or logical. At the electrical level, the classical laser-fault injection model is based on the addition of current sources to the various sensitive nodes of CMOS transistors. However, this model does not take into account the large transient current components also induced between the VDD and GND of ICs designed with advanced CMOS technologies. These short-circuit currents provoke a significant IR-drop that contribute to the fault injection process. This paper describes our research on the assessment of this contribution. It shows through simulation and experiments that during laser fault injection campaigns, laser-induced IR-drop is always present when considering circuits designed with deep submicron technologies. It introduces an enhanced electrical fault model taking the laserinduced IR-drop into account. It also proposes a methodology that allows the use of the model to simulate laser-induced faults at the electrical level in large-scale circuits. On the basis of further simulations and experimental results, we found that, depending on the laser pulse characteristics, the number of injected faults may be underestimated by a factor of up to 2.4 if the laser-induced IR-drop is ignored. This could lead to incorrect estimations of the fault injection threshold, which is especially relevant to the design of countermeasure techniques for secure integrated systems.

Physical Attack Protection Techniques for IC Chip Level Hardware Security

“…The body current by the laser irradiation can also be sensed through the change in self-oscillation frequencies, as similar to the EM sensing scheme, which is applicable to FPGA devices [81]. The laser-induced current is also assumed to flow in PDNs [82], which can be responded by power OCM circuits.…”

Further Analysis of Laser-induced IR-drop

“…In order to improve the existing models, which for recent technologies lack accuracy by only considering currents induced to the drain regions sensitive to laser shots, a new model that also takes into account a current flowing from VDD to GND has been proposed. This current is induced in the reversed biased P sub-Nwell junction and can have significant effects on a circuit by inducing a supply voltage drop [18], [22]. Fig.…”

“…For the application of the model, it is necessary to model the power-grid as well. In [18] the methodology applied in this work, which is based on an Electromigration / IR-drop (EMIR) CAD tool, is detailed. In Fig.…”

“…Consequently, more complex circuit simulations are needed to ensure a good representation of the real effects of laser illumination. A previous study showed, for example, that the joint effects of the photoelectric currents and of the related IRdrop can only be accurately simulated at low abstraction levels (taking into account the layout topology to better represent the physical phenomenon) in the scope of a whole system [18].…”

“…A methodology that allows LFI simulation at the electrical level in large-scale circuits by using standard CAD tools was presented in [18] as well as an enhanced electrical fault model that takes laser-induced IR-drop into account.…”