Study of Front-Side Approach to Retrieve Stored Data in Non-Volatile Memory Devices Using Scanning Capacitance Microscopy

Tay, Jing Yun; Cheah, J.; Liu, Q.; Gan, Chee Lip

doi:10.1109/ipfa47161.2019.8984802

Cited by 5 publications

(8 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The sample was then delayered from the front side to remove the epoxy molding compound, the passivation layer, metallization layers and the control gate (CG, poly 2), so that the inter-poly oxide layer above the floating gate (FG, poly 1) was exposed (figure 1(a)). The delayering was achieved with techniques typical for failure analysis, including reactive ion etching, chemical etching and polishing, the details of which can be referred to our previous work [14].…”

Section: Methodsmentioning

confidence: 99%

“…The high-resolution SNDM mapping of the detailed memory cell structures enables exact correlation of capacitance signal with topography, and therefore provides confidence in data assignment between neighbouring cells. It tackles the long-standing challenge of having accurate data assignment between topography and capacitance signal, as no such structural details are reported in conventional scanning technologies like SCM [6,14]. This high resolution SNDM signal benefits from the precise delayering method from the front side developed by our group [14], as no structural details were observed by Cho's group [12], who presumably used a different front-side delayering approach.…”

Section: Scanning Nonlinear Dielectric Microscopymentioning

confidence: 99%

See 1 more Smart Citation

High resolution front-side visualization of charge stored in EEPROM with scanning nonlinear dielectric microscopy (SNDM)

Zeng¹,

Liu²,

Tay³

et al. 2021

Nanotechnology

View full text Add to dashboard Cite

By exposing floating gates of EEPROM memory cells with frontside sample preparation, scanning nonlinear dielectric microscopy (SNDM) succeeded in reading back the data stored in the memory cells with a 250 nm node size. At an optimized voltage bias of AC = 3 V and DC = 1 V, a clear signal contrast between programmed and erased cells is obtained. The high resolution SNDM signal reveals the details of bowling-pin shape structure of memory cells, providing high confidence in data assignment during forensic applications. Such high resolution also makes SNDM a promising technique for newer generation devices with smaller node size.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Scanning Nonlinear Dielectric Microscopymentioning

confidence: 99%

High resolution front-side visualization of charge stored in EEPROM with scanning nonlinear dielectric microscopy (SNDM)

Zeng¹,

Liu²,

Tay³

et al. 2021

Nanotechnology

View full text Add to dashboard Cite

show abstract

“…Techniques like scanning electron microscopy (SEM) [7], [8], scanning capacitance microscopy (SCM) [9], [10] scanning non-linear dielectric microscopy (SNDM) [11], [12] and scanning Kelvin probe microscopy (SKPM) [13] have been explored to access the memory data. They can detect electrical signals of capacitance or voltage to differentiate cells with electrons from those without.…”

Section: Introductionmentioning

confidence: 99%

Security Evaluation of Microcontrollers: A Case Study in Smart Watches

Zeng,

Liu,

Chua

et al. 2023

2023 IEEE International Symposium on the Physical and Failure Analysis of Integrated Circuits (IPFA)

View full text Add to dashboard Cite

Smart watches contain sensitive information like application software, user health and fitness data. Some of these data are often stored in embedded flash memory in microcontrollers. Here we explore two flash memory reading techniques to evaluate data security in smart watches against hardware attacks. One technique is the common approach of logical data acquisition, which is non-invasive and access the data through debug interface. It dumps the whole flash memory content based on its logical address. The other technique is a new selective staining approach. It extracts data directly from memory cells and requires invasive sample preparation. It extracts all binary bits in the flash memory based on its physical address. These two techniques are complementary to one another and ensure the accuracy of extracted memory content. The nature of data in the flash memory was confirmed by comparing the data between a new and a used watch. Majority of the flash memory was used for application software, with a small region found reserved to store the last shutdown information of the watch.

show abstract

“…Information of "0" and "1" states in Flash memory cells is manifested as charges stored in the floating gates [9]. Direct data retrieval for low-level analysis relies on invasive delayering techniques to expose the memory cells from either backside or frontside [10], followed by characterization based on characteristic electrical or chemical properties of floating gates [11], [12]. The complicated delayering processes and use of advanced characterization instruments limit attackers from attempting invasive approaches [13].…”

Section: Introductionmentioning

confidence: 99%

“…The complicated delayering processes and use of advanced characterization instruments limit attackers from attempting invasive approaches [13]. Literatures on invasive data extraction from Flash memory are very limited, all of which are based on either probing-based techniques or scanning electron microscopy (SEM) [10]- [12], [14]- [19]. The details of documented invasive techniques are summarized in Table I.…”

Section: Introductionmentioning

confidence: 99%

Selective Staining on Non-Volatile Memory Cells for Data Retrieval

Zeng

Liu

Tay

et al. 2022

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

A new data retrieval approach utilizing selective staining is explored to differentiate "0" from "1" cells in EEPROM and Flash memory cells with node size of 40 nm and 250 nm. A two-step staining process based on selective oxide etching and copper galvanic displacement deposition is introduced. The underlying mechanism is attributed to the difference in electric field across the tunnel oxide, which originates from the presence or absence of charges stored in the floating gates. With proper sample preparation, the selectively stained and non-stained cells can be characterized with optical microscopy and scanning electron microscopy, to facilitate direct read-out of data in a timeefficient manner. The physical layout of individual memory cells with respect to the stored data is identified. A systematic data retrieval is achieved with an accuracy of 95% at individual bit level. This selective staining technique marks the data permanently on the chip that allows for subsequent analysis and evidence retention.

show abstract

Study of Front-Side Approach to Retrieve Stored Data in Non-Volatile Memory Devices Using Scanning Capacitance Microscopy

Cited by 5 publications

References 10 publications

High resolution front-side visualization of charge stored in EEPROM with scanning nonlinear dielectric microscopy (SNDM)

High resolution front-side visualization of charge stored in EEPROM with scanning nonlinear dielectric microscopy (SNDM)

Security Evaluation of Microcontrollers: A Case Study in Smart Watches

Selective Staining on Non-Volatile Memory Cells for Data Retrieval

Contact Info

Product

Resources

About