Steps Toward Automated Deprocessing of Integrated Circuits

Abstract

This paper discusses the development of an extensible programmatic workflow that leverages evolving technologies in 2D/3D imaging, distributed instrument control, image processing, and automated mechanical/chemical deprocessing technology. Initial studies involve automated backside mechanical ultra-thinning of 65nm node IC processor chips in combination with SEM imaging and X-ray tomography. Areas as large as 800μm x 800μm were deprocessed using gas-assisted plasma FIB delayering. Ongoing work involves enhancing the workflow with “intelligent automation” by bridging FIB-SEM instrument control and near real-time data analysis to establish a computationally guided microscopy suite.

REFICS: Assimilating Data-Driven Paradigms Into Reverse Engineering and Hardware Assurance on Integrated Circuits

“…Drift is more pronounced with a larger Field-of-View [33]. Although the beam drift is random, the process can be modelled using a Gaussian distribution for the true position of the beam with respect to the intended position FIGURE 5: Warpage induced in the IC die due to accumulated mechanical stresses [35]. [34].…”

“…Deprocessing requires delayering the IC die with a fixed cross-sectional thickness. Incremental removal of the material, especially the bulk of the silicon substrate supporting the IC structure, results in mechanical stress accumulating on the die and causing it to warp [35], [36]. This phenomenon, shown in Figure 5, results in a perspective distortion on the features in the imaged region.…”

Proof of Reverse Engineering Barrier: SEM Image Analysis on Covert Gates

“…Many physical inspection methods such as focused ion beam (FIB) micro-probing, FIB circuit editing, and contact-less optical probing, for failure analysis and defect localization [5], [6] have been utilized to identify regions of interests and/or extract sensitive information. SEM-based imaging, in combination with iterative integrated circuit (IC) deprocessing, can be used to recover the layout and eventually the gate-level netlist of a semiconductor IP [7], [8]. In some cases, the netlist alone is all that is needed by the attacker.…”

Practical Partial Hardware Reverse Engineering Analysis

“…X-ray-based reverse engineering (non-destructive) is widely under investigation but currently requires highly sophisticated equipment and has only been applied to a very small subset (some μm 3 ) of an IC [3,4]. While some interesting FIB/SEM techniques [5] have so far been applied to parts of a circuit, they are quite demanding in terms of knowledge, time and equipment, as illustrated in Table 1. There are also ongoing multi-electron beam source and X-ray detector investigations to allow local X-ray analysis without synchrotron [6].…”

“…Our goal is not to reverse engineer a complete chip but instead to gain partial design information for particular purposes. They lie in the area of malicious circuit modification detection but also in combined attacks where such technique [5] + + + Hundreds μm 3 X-ray [4] + + ++ Few dozens μm 3 Drain/source -Full single-layer surface would decrease the number of samples and attack time needed. Thus, a complete attack could be applied thanks to some extracted spatial information combined with standard side-channel (e.g.…”