ViTaL: Verifying Trojan-Free Physical Layouts through Hardware Reverse Engineering

Author(s):  
Matthias Ludwig ◽  
Ann-Christin Bette ◽  
Bernhard Lippmann

The semiconductor industry is heavily relying on outsourcing of design, fabrication, and testing to third parties. The threat of possibly malicious actors in this ramified supply-chain poses a risk for the integrity of integrated circuits (ICs) and hardware Trojans (HTs) are a heavily discussed topic in academia and the industry. A variety of pre- and post-silicon HT prevention and detection techniques has been suggested in prior works. Hardware reverse engineering has the potential to detect potential modification in physical layouts. Yet, there is no model to qualitatively and quantitatively rate the complex and expensive reverse engineering (RE) process addressing its inherent process aberrations and consequently provide a tool for layout verification. The ViTaL framework introduces a statistical validation technique, based on physical layout verification through RE and considers all potential sources of errors. The golden-model based framework is technology-agnostic, scaleable, and user input is optional. For the first time, results of fine pitch metallization layers of a CMOS 40nm process node IC are presented quantitatively and the limitations and possibilities are discussed.<br>

2021 ◽  
Author(s):  
Matthias Ludwig ◽  
Ann-Christin Bette ◽  
Bernhard Lippmann

The semiconductor industry is heavily relying on outsourcing of design, fabrication, and testing to third parties. The threat of possibly malicious actors in this ramified supply-chain poses a risk for the integrity of integrated circuits (ICs) and hardware Trojans (HTs) are a heavily discussed topic in academia and the industry. A variety of pre- and post-silicon HT prevention and detection techniques has been suggested in prior works. Hardware reverse engineering has the potential to detect potential modification in physical layouts. Yet, there is no model to qualitatively and quantitatively rate the complex and expensive reverse engineering (RE) process addressing its inherent process aberrations and consequently provide a tool for layout verification. The ViTaL framework introduces a statistical validation technique, based on physical layout verification through RE and considers all potential sources of errors. The golden-model based framework is technology-agnostic, scaleable, and user input is optional. For the first time, results of fine pitch metallization layers of a CMOS 40nm process node IC are presented quantitatively and the limitations and possibilities are discussed.<br>


2019 ◽  
Vol 28 (03n04) ◽  
pp. 1940021
Author(s):  
Shuai Chen ◽  
Lei Wang

The protection of intellectual property (IP) is increasingly critical for IP vendors in the semiconductor industry. Read Only Memories (ROMs) serve as important non-volatile memory in various hardware systems to store predefined data and programs, which is critical to IP protection. Its pre-determined layout pattern makes unauthorized data extraction through chip-level reverse engineering easy to carry out. Advanced reverse engineering techniques can physically disassemble the chip and derive the IPs precisely at a much lower cost than the value of IP design that chips carry. This invasive hardware attack obtaining information from IC chips always violates the IP rights of vendors. This paper proposes a new security mechanism implanted ROM design to address the vulnerability to reverse energy attacks. Irreversible via in ROM layout transform triggered by reverse engineering completely changes the electrical properties and the physical structure of ROMs that determine the stored data. Newly-created patten will significantly increase the difficulty of reverse engineering, even lead the attackers to another working function mode. Furthermore, to improve the effectiveness of the proposed technique, a systematic design method is developed targeting integrated circuits with multiple design constraints. Two widely used ROM scheme cases have been studied to test the design method and its effectiveness. Simulations have been conducted to demonstrate the capability of the proposed technique, which generates extremely large complexity for reverse engineering with manageable overhead. CCS Concepts: Security and privacy → Hardware reverse engineering; Hardware → Hard and soft IP


2017 ◽  
Vol 14 (1) ◽  
pp. 32-38
Author(s):  
C. Marsan-Loyer ◽  
D. Danovitch ◽  
N. Boyer

The requirement for closely coupled, highly integrated circuits in the semiconductor industry has spawned alternative packaging innovations such as 2.5-D/3-D integration. The incredible potential of this alternative comes with great challenges, not the least of which is the unprecedented reduction in package interconnection pitch. Market acceptance of new fine-pitch microelectronic products is strongly dependent on the development of flawless assembly processes that align with the traditional Moore-like expectation of higher performance without cost penalty. One such process is the application of flux to the interconnect surfaces to achieve effective joining. Insufficient flux quantity or flux activity can impede the formation of solid, reliable joints, whereas excessive quantities or activity can cause solder bridging or difficulties with downstream operations such as residue cleaning or underfill reinforcement. This delicate balance, already complex for traditional chip joining, is further challenged by the geometrical and spatial reductions imposed by pitch miniaturization, especially where large die, with over 100,000 interconnects, are concerned. This article presents an overall development protocol to evolving a flux dipping operation to production-level thermocompression assembly of large die (8 × 11 × 0.780 mm) with 11,343 ultrafine pitch (62 μm) copper pillar interconnections. After reviewing the state of the art for fluxing technology and detailing the specific technical issues, we present and defend the chosen flux application approach with its corresponding parameters of interest. Physical and chemical characterization results for selected flux material candidates are reported in conjunction with an analysis of how their properties correlate to the flux dip application parameters. As part of this fundamental understanding, we investigate and report on flux dip coating behavior and how it compares to other industrial dip coating applications. Finally, the results of process assembly experiments in a production-type environment are reviewed and discussed with respect to the previous characterizations. These experiments span downstream assembly process compatibility (i.e., cleaning and underfill) as well as product reliability.


2016 ◽  
Vol 2016 (1) ◽  
pp. 000054-000059
Author(s):  
C. Marsan-Loyer ◽  
D. Danovitch ◽  
N. Boyer

Abstract The requirement for closely coupled, highly integrated circuits in the semiconductor industry has spawned alternative packaging innovations such as 2.5D/3D integration. The incredible potential of this alternative comes with great challenges, not the least of which is the unprecedented reduction in package interconnection pitch. Market acceptance of new fine-pitch microelectronic products is strongly dependent upon the development of flawless assembly processes that align with the traditional Moore-like expectation of higher performance without cost penalty. One such process is the application of flux to the interconnect surfaces in order to achieve effective joining. Insufficient flux quantity or flux activity can impede the formation of solid, reliable joints, while excessive quantities or activity can cause solder bridging or difficulties with downstream operations such as residue cleaning or underfill reinforcement. This delicate balance, already complex for traditional chip joining, is further challenged by the geometrical and spatial reductions imposed by pitch miniaturization, especially where large die, with over 100,000 interconnects, are concerned. This paper presents an overall development protocol to evolving a flux dipping operation to production-level thermocompression assembly of large die with ultra-fine pitch (60 μm) copper pillar interconnections. After reviewing the state of the art for fluxing technology and detailing the specific technical issues, we present and defend the chosen flux application approach with its corresponding parameters of interest. Physical and chemical characterization results for selected flux material candidates are reported in conjunction with an analysis of how their properties correlate to the flux dip application parameters. As part of this fundamental understanding, we investigate and report on flux dip coating behaviour and how it compares to other industrial dip coating applications. Finally, the results of process assembly experiments in a production-type environment are reviewed and discussed with respect to the previous characterizations. These experiments span downstream assembly process compatibility (i.e. cleaning and underfill) as well as product reliability.


2018 ◽  
Author(s):  
Satish Kodali ◽  
Liangshan Chen ◽  
Yuting Wei ◽  
Tanya Schaeffer ◽  
Chong Khiam Oh

Abstract Optical beam induced resistance change (OBIRCH) is a very well-adapted technique for static fault isolation in the semiconductor industry. Novel low current OBIRCH amplifier is used to facilitate safe test condition requirements for advanced nodes. This paper shows the differences between the earlier and novel generation OBIRCH amplifiers. Ring oscillator high standby leakage samples are analyzed using the novel generation amplifier. High signal to noise ratio at applied low bias and current levels on device under test are shown on various samples. Further, a metric to demonstrate the SNR to device performance is also discussed. OBIRCH analysis is performed on all the three samples for nanoprobing of, and physical characterization on, the leakage. The resulting spots were calibrated and classified. It is noted that the calibration metric can be successfully used for the first time to estimate the relative threshold voltage of individual transistors in advanced process nodes.


2021 ◽  
Vol 11 (1) ◽  
Author(s):  
Hyeon-Myeong Oh ◽  
Young-Jo Park ◽  
Ha-Neul Kim ◽  
Kundan Kumar ◽  
Jae-Woong Ko ◽  
...  

AbstractMotivated by recent finding of crystallographic-orientation-dependent etching behavior of sintered ceramics, the plasma resistance of nanocrystalline Y2O3-MgO composite ceramics (YM) was evaluated for the first time. We report a remarkably high plasma etching resistance of nanostructure YM surpassing the plasma resistance of commercially used transparent Y2O3 and MgAl2O4 ceramics. The pore-free YM ceramic with grain sizes of several hundred nm was fabricated by hot press sintering, enabling theoretical maximum densification at low temperature. The insoluble two components effectively suppressed the grain growth by mutual pinning. The engineering implication of the developed YM nanocomposite imparts enhanced mechanical reliability, better cost effectiveness with excellent plasma resistance property over their counterparts in plasma using semiconductor applications.


2020 ◽  
Author(s):  
Akshay Wali ◽  
Andrew Arnold ◽  
Shamik Kundu ◽  
Soumyadeep Choudhury ◽  
Kanad Basu ◽  
...  

Abstract Reverse engineering (RE) is one of the major security threats to the semiconductor industry due to the involvement of untrustworthy parties in an increasingly globalized chip manufacturing supply chain [1-5]. RE efforts have already been successful in extracting device level functionalities from an integrated circuit (IC) with very limited resources [6]. Camouflaging is an obfuscation method that can thwart such RE [7-9]. Existing work on IC camouflaging primarily uses fabrication techniques such as doping and dummy contacts to hide the circuit structure or build cells that look alike but have different functionalities. While promising these Si complementary metal oxide semiconductor (CMOS) based obfuscation techniques adds significant area overhead and are successfully decamouflaged by the Satisfiability solver (SAT)-based reverse engineering techniques [9-13]. Emerging solutions, such as polymorphic gates based on giant spin Hall effect (GSHE) are promising but adds delay overhead in hybrid CMOS-GSHE designs restricting the camouflaging to a maximum of 15% of all the gates in the circuit. Here, we harness the unique properties of two-dimensional (2D) transition metal dichalcogenides (TMDs) including MoS2, MoSe2, MoTe2, WS2, and WSe2 and their optically transparent transition metal oxides (TMOs) to demonstrate novel area efficient camouflaging solutions that are resilient to SAT-attack and automatic test pattern generation (ATPG) attacks. We show that resistors with resistance values differing by 8 orders of magnitude, diodes with variable turn-on voltages and reverse saturation currents, and field effect transistors (FETs) with adjustable conduction type, threshold voltages and switching characteristics can be optically camouflaged to look exactly similar by engineering TMO/TMD heterostructures allowing hardware obfuscation of both digital and analog circuits. Since this 2D heterostructure devices family is intrinsically camouflaged, NAND/NOR/AND/OR gates in the circuit can be obfuscated with significantly less area overhead allowing 100% logic obfuscation compared to only 5% for CMOS-based camouflaging. Finally, we demonstrate that the largest benchmarking circuit from ISCAS’85, comprised of more than 4000 logic gates when obfuscated with the CMOS-based technique are successfully decamouflaged by SAT-attack in less than 40 minutes; whereas, it renders to be invulnerable even in more than 10 hours, when camouflaged with 2D heterostructure devices thereby corroborating our hypothesis of high resilience against RE. Our approach of connecting unique material properties to innovative devices to secure circuits can be considered as one of its kind demonstrations, highlighting the benefits of cross-layer optimization.


2019 ◽  
Vol 8 (4) ◽  
pp. 3665-3670

For decades, digital systems have been designed based on assumptions that the underlying hardware, though not perfectly reliable, is free of malicious elements. The demand for IC’s is greatly increasing due to tremendous technological development. Without appropriate resources the companies are hard pressed to produce trusted IC’s. This is driving the companies into the ‘fabless’ trend predominant in semiconductor industry, where the companies are depending on cheaper foundries for the IC fabrication instead of depending on their own resources. This growth brings with it a big rise in threat level in terms of Hardware Trojans that hits the manufacturing companies which make use of Integrated Circuits. This transcends many industries, including strategic organizations and telecommunication companies, mobile phones and computers, embedded systems used in domestic applications and health care equipment. These adversarial inclusions are generally triggered to do malicious modifications in the end user system by the intruder, which is difficult to detect in their quiescent state. This paper focuses on understanding Hardware Trojans, their implications and detection methodologies. It is extremely important for all industries and more so for defense organizations, who are involved in developing systems to protect the nation’s boundaries.


Sign in / Sign up

Export Citation Format

Share Document